uBlock Origin yawonjezera kutsekereza kwa script pakusanthula madoko a netiweki

Zosefera zomwe zimagwiritsidwa ntchito muBlock Origin Zosavuta anawonjezera malamulo otsekereza zolembedwa zojambulira pa netiweki pamakina am'deralo. Tikumbukenso kuti mu May Izo zinawulula kusanthula madoko akomweko mukatsegula eBay.com. Zinapezeka kuti mchitidwewu suli pa eBay ndi ambiri masamba ena (Citibank, TD Bank, Sky, GumTree, WePay, etc.) amagwiritsa ntchito kusanthula kwa doko kwa kachitidwe kameneka ka wogwiritsa ntchito pamene akutsegula masamba awo, pogwiritsa ntchito code kuti azindikire zoyesayesa zopezeka kuchokera ku makompyuta omwe adabedwa omwe amaperekedwa ndi ntchito ya ThreatMetrix.

Pankhani ya eBay, ma doko 14 olumikizana ndi ma seva olowera kutali monga VNC, TeamViewer, Anyplace Control, Aeroadmin, Ammy Admin ndi RDP adafufuzidwa. Mwina kufufuza kukuchitika za kuzindikira kupezeka kwa kuwonongeka kwa dongosolo ndi pulogalamu yaumbanda kuti mupewe kugula mwachinyengo pogwiritsa ntchito botnets. Kusanthula kungagwiritsidwenso ntchito kupeza deta yosadziwika chizindikiritso cha ogwiritsa.

Njira yomwe imagwiritsidwa ntchito kusanthula idakhazikitsidwa poyesa kukhazikitsa ma doko osiyanasiyana a netiweki a 127.0.0.1 (localhost) kudzera. WebSockets. Kukhalapo kwa doko lotseguka la netiweki kumatsimikiziridwa mosalunjika kutengera kusiyana kwa kasamalidwe kolakwika pamalumikizidwe kumadoko a netiweki omwe akugwira ntchito komanso osagwiritsidwa ntchito. WebSocket imakupatsani mwayi wotumiza zopempha za HTTP zokha, koma pempho lotere la doko losagwira ntchito limalephera nthawi yomweyo, ndipo padoko logwira ntchito pakangotha ​​nthawi yayitali kuyesa kukambirana. Kuphatikiza apo, ngati doko losagwira ntchito, WebSocket imatulutsa khodi yolakwika yolumikizira (ERR_CONNECTION_REFUSED), ndipo ngati ili ndi doko logwira ntchito, cholakwika cholumikizira kulumikizana.

Kuphatikiza pakusanthula padoko, WebSockets imathanso gwiritsani ntchito pakuwukira kwa makina opanga mawebusayiti omwe amayendetsa ma WebSocket pamapulogalamu a React pamakina akomweko. Tsamba lakunja limatha kusaka pamadoko a netiweki, kudziwa kukhalapo kwa wogwirizira wotero, ndikulumikizana nawo. Ngati wopanga alakwitsa, wowukira atha kupeza zomwe zili mu data ya debug, yomwe ingaphatikizepo zambiri zachinsinsi.

Source: opennet.ru