{"id":36939,"date":"2019-10-31T22:14:51","date_gmt":"2019-10-31T19:14:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer\/"},"modified":"2019-10-31T22:14:51","modified_gmt":"2019-10-31T19:14:51","slug":"opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer","title":{"rendered":"Opublikowano kod analizy bezpiecze\u0144stwa oprogramowania FwAnalyzer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Firma Cruise, specjalizuj\u0105ca si\u0119 w technologiach automatycznego prowadzenia pojazd\u00f3w, <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/cruise\/firmware-security-fwanalyzer-dcbd95cef717\">otworzy\u0142a<\/a><\/noindex> \u017ar\u00f3d\u0142owe teksty projektu  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.fwanalyzer.io\">FwAnalyzer<\/a><\/noindex>, dostarczaj\u0105ca narz\u0119dzia do analizy obraz\u00f3w firmware'u opartego na systemie Linux oraz identyfikacji potencjalnych luk w zabezpieczeniach i wyciek\u00f3w danych. Kod zosta\u0142 napisany w j\u0119zyku Go i <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/cruise-automation\/fwanalyzer\">rozpowszechniany<\/a><\/noindex> na licencji Apache 2.0.<\/p>\n<p>Obs\u0142ugiwane s\u0105 obrazy korzystaj\u0105ce z system\u00f3w plik\u00f3w ext2\/3\/4, FAT\/VFat, SquashFS oraz UBIFS. Do rozpakowywania obraz\u00f3w u\u017cywane s\u0105 standardowe narz\u0119dzia, takie jak e2tools, mtools, squashfs-tools oraz ubi_reader. FwAnalyzer wydobywa z obrazu drzewo katalog\u00f3w i ocenia zawarto\u015b\u0107 na podstawie zestawu regu\u0142. Regu\u0142y mog\u0105 by\u0107 przypisane do metadanych systemu plik\u00f3w, typu plik\u00f3w i zawarto\u015bci. Na wyj\u015bciu generowany jest raport w formacie JSON, podsumowuj\u0105cy informacje wydobyte z firmware'u oraz przedstawiaj\u0105cy ostrze\u017cenia i list\u0119 plik\u00f3w, kt\u00f3re nie odpowiadaj\u0105 przetworzonym regu\u0142om. <\/p>\n<p>Obs\u0142ugiwana jest kontrola uprawnie\u0144 do plik\u00f3w i katalog\u00f3w (na przyk\u0142ad identyfikacja dost\u0119pu do zapisu oraz niepoprawnych UID\/GID), ustalana jest obecno\u015b\u0107 plik\u00f3w wykonywalnych z flag\u0105 suid oraz korzystanie z etykiet SELinux, identyfikowane s\u0105 zapomniane klucze szyfrowania oraz potencjalnie niebezpieczne pliki. W zawarto\u015bci wyr\u00f3\u017cniane s\u0105 pozostawione in\u017cynierskie has\u0142a oraz dane do debugowania, przedstawiane s\u0105 informacje o wersjach, przeprowadzana jest weryfikacja zawarto\u015bci na podstawie skr\u00f3t\u00f3w SHA-256 oraz poszukiwanie przy u\u017cyciu statycznych masek i wyra\u017ce\u0144 regularnych. Istnieje mo\u017cliwo\u015b\u0107 powi\u0105zania zewn\u0119trznych skrypt\u00f3w analitycznych z okre\u015blonymi typami plik\u00f3w. Dla firmware'\u00f3w opartych na Androidzie okre\u015blane s\u0105 parametry kompilacji (np. wykorzystanie trybu ro.secure=1, stan ro.build.type oraz aktywacja SELinux).<\/p>\n<p>FwAnalyzer mo\u017cna wykorzysta\u0107 do uproszczenia analizy problem\u00f3w z bezpiecze\u0144stwem w obcych firmware'ach, jednak jego g\u0142\u00f3wnym celem jest kontrola jako\u015bci w\u0142asnych firmware'\u00f3w lub dostarczanych przez zewn\u0119trznych dostawc\u00f3w na mocy umowy. Regu\u0142y FwAnalyzer pozwalaj\u0105 na stworzenie dok\u0142adnej specyfikacji stanu firmware'u oraz identyfikacj\u0119 niedopuszczalnych odchyle\u0144, takich jak przyznawanie niew\u0142a\u015bciwych uprawnie\u0144 dost\u0119pu czy pozostawianie zamkni\u0119tych kluczy i kodu debugowania (na przyk\u0142ad kontrole pozwalaj\u0105 unikn\u0105\u0107 takich sytuacji jak <noindex><a rel=\"nofollow\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2018-5399\">pozostawienie<\/a><\/noindex> u\u017cywanego na etapie testowania serwera ssh, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=46175\">zdefiniowane<\/a><\/noindex> in\u017cynierskie has\u0142o, <noindex><a rel=\"nofollow\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2014-5457\">dost\u0119pny<\/a><\/noindex> do odczytu \/etc\/config\/shadow lub <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=43043\">zapomniane<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=42986\">klucze<\/a><\/noindex> tworzenia podpisu cyfrowego).<\/p>\n<p><center><noindex><a rel=\"nofollow\" href=\"https:\/\/miro.medium.com\/max\/627\/0*pHcZA7XBqCy_pv2V?a.png\"><img decoding=\"async\" alt=\"Opublikowano kod analizy bezpiecze\u0144stwa oprogramowania FwAnalyzer\" src=\"\/wp-content\/uploads\/2019\/08\/e4fe0f2486b7a3755e388756b8deafc9.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>\u0179r\u00f3d\u0142o: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51249\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cruise, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f\u0445 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u044f\u043c\u0438, \u043e\u0442\u043a\u0440\u044b\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 FwAnalyzer, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a \u043d\u0430 \u0431\u0430\u0437\u0435 Linux \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432 \u043d\u0438\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445. \u041a\u043e\u0434 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Go \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 Apache 2.0. \u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0430\u043d\u0430\u043b\u0438\u0437 \u043e\u0431\u0440\u0430\u0437\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b ext2\/3\/4, FAT\/VFat, SquashFS \u0438 UBIFS. \u0414\u043b\u044f \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27676,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36939","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cruise, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f\u0445 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u044f\u043c\u0438, \u043e\u0442\u043a\u0440\u044b\u043b\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0434 \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a FwAnalyzer | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cruise, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f\u0445 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u044f\u043c\u0438, \u043e\u0442\u043a\u0440\u044b\u043b\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:14:51+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Opublikowano kod analizatora bezpiecze\u0144stwa firmware'\u00f3w FwAnalyzer | ProHoster","description":"Firma Cruise, specjalizuj\u0105ca si\u0119 w technologiach automatycznego zarz\u0105dzania samochodami, zosta\u0142a otwarta.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0434 \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a FwAnalyzer | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cruise, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f\u0445 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u044f\u043c\u0438, \u043e\u0442\u043a\u0440\u044b\u043b\u0430.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:51+00:00","article:modified_time":"2019-10-31T19:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36939","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:26:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:36:24","updated":"2026-01-22 05:26:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/36939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=36939"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/36939\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/27676"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=36939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=36939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=36939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}