{"id":111112,"date":"2023-10-26T21:10:14","date_gmt":"2023-10-26T19:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor"},"modified":"2023-10-26T21:10:14","modified_gmt":"2023-10-26T19:10:15","slug":"rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","title":{"rendered":"Resultados da auditoria do Tor Browser e componentes da infraestrutura Tor","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Os desenvolvedores da rede an\u00f4nima Tor publicaram os resultados da auditoria do Tor Browser e das ferramentas OONI Probe, rdsys, BridgeDB e Conjure, que s\u00e3o usadas para contornar a censura. A auditoria foi realizada pela empresa Cure53, de novembro de 2022 a abril de 2023.     <\/p>\n<p>Durante a verifica\u00e7\u00e3o, foram identificadas 9 vulnerabilidades, sendo duas classificadas como perigosas, uma atribu\u00edda a um n\u00edvel de amea\u00e7a m\u00e9dio e 6 categorizadas como problemas com baixo n\u00edvel de risco. Al\u00e9m disso, foram encontradas 10 falhas no c\u00f3digo que n\u00e3o est\u00e3o relacionadas \u00e0 seguran\u00e7a. De maneira geral, o c\u00f3digo do projeto Tor \u00e9 considerado conforme as pr\u00e1ticas de programa\u00e7\u00e3o segura.      <\/p>\n<p>A primeira vulnerabilidade cr\u00edtica estava presente no backend do sistema distribu\u00eddo rdsys, que garante a entrega de recursos censurados a usu\u00e1rios, como listas de proxies e links para download. A vulnerabilidade foi causada pela falta de autentica\u00e7\u00e3o ao acessar o manipulador de registro de recursos, permitindo que um atacante registrasse seu pr\u00f3prio recurso malicioso para entrega aos usu\u00e1rios. A explora\u00e7\u00e3o consiste em enviar uma solicita\u00e7\u00e3o HTTP para o manipulador rdsys.   <center><img decoding=\"async\" alt=\"Resultados da auditoria do Tor Browser e componentes da infraestrutura Tor\" src=\"\/wp-content\/uploads\/2023\/10\/59560b2962adcce743937eb500061be1.png\" style=\"display:block;margin: 0 auto;\" \/><\/center>      <\/p>\n<p>A segunda vulnerabilidade cr\u00edtica encontrada no Tor Browser foi causada pela falta de verifica\u00e7\u00e3o de assinatura digital ao obter a lista de n\u00f3s pontes atrav\u00e9s do rdsys e BridgeDB. Como a lista \u00e9 carregada no navegador antes da conex\u00e3o com a rede an\u00f4nima Tor, a aus\u00eancia de verifica\u00e7\u00e3o da assinatura digital criptogr\u00e1fica permitia que um atacante substitu\u00edsse o conte\u00fado da lista, por exemplo, atrav\u00e9s da intercepta\u00e7\u00e3o da conex\u00e3o ou invas\u00e3o  <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/pt\/server\/dts-los-angeles\/\"   title=\"servidor\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3897\">servidor<\/a>, pela qual a lista \u00e9 disseminada. Em caso de ataque bem-sucedido, o invasor poderia direcionar os usu\u00e1rios para seu pr\u00f3prio n\u00f3 de ponte comprometido.        <\/p>\n<p>Uma vulnerabilidade de risco m\u00e9dio estava presente na subsistema rdsys, em um script de implanta\u00e7\u00e3o de builds, e permitia que um atacante elevasse suas permiss\u00f5es de usu\u00e1rio nobody para usu\u00e1rio rdsys, se tivesse acesso a <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/pt\/server\/dts-shicago\/\"   title=\"servidor\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2930\">servidor<\/a> e as capacidades de grava\u00e7\u00e3o no diret\u00f3rio com arquivos tempor\u00e1rios. A explora\u00e7\u00e3o da vulnerabilidade se resume a substituir um arquivo execut\u00e1vel armazenado no diret\u00f3rio \/tmp. Obter permiss\u00f5es do usu\u00e1rio rdsys permite que o atacante fa\u00e7a altera\u00e7\u00f5es nos arquivos execut\u00e1veis executados pelo rdsys.    <\/p>\n<p>As vulnerabilidades de baixo grau de severidade estavam principalmente relacionadas ao uso de depend\u00eancias desatualizadas que continham vulnerabilidades conhecidas, ou \u00e0 possibilidade de causar um ataque de nega\u00e7\u00e3o de servi\u00e7o. Entre as vulnerabilidades menores no Tor Browser, destaca-se a possibilidade de contornar a proibi\u00e7\u00e3o de execu\u00e7\u00e3o de JavaScript ao definir o n\u00edvel m\u00e1ximo de prote\u00e7\u00e3o, a falta de restri\u00e7\u00f5es de upload de arquivos e a potencial vazamento de informa\u00e7\u00f5es atrav\u00e9s da p\u00e1gina inicial do usu\u00e1rio, permitindo monitorar usu\u00e1rios entre reinicializa\u00e7\u00f5es.    <\/p>\n<p>Atualmente, todas as vulnerabilidades foram corrigidas, incluindo a implementa\u00e7\u00e3o de autentica\u00e7\u00e3o para todos os manipuladores do rdsys e a adi\u00e7\u00e3o de verifica\u00e7\u00e3o de listas carregadas no Tor Browser por meio de assinatura digital.      <\/p>\n<p>Al\u00e9m disso, menciona-se o lan\u00e7amento do Tor Browser 13.0.1. A vers\u00e3o foi sincronizada com a base de c\u00f3digo do Firefox 115.4.0 ESR, na qual 19 vulnerabilidades foram corrigidas (13 consideradas severas). As corre\u00e7\u00f5es de vulnerabilidades da vers\u00e3o do Firefox 119 foram transferidas para a vers\u00e3o do Tor Browser 13.0.1 para Android.<br \/>\n<br \/>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59999\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0410\u0443\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cure53 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u044b \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043e\u0434\u043d\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0441\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":111113,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 Tor Browser \u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b Tor | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-10-26T19:10:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-10-26T19:10:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Resultados da auditoria do Tor Browser e dos componentes de infraestrutura do Tor | ProHoster","description":"Os desenvolvedores da rede an\u00f4nima Tor publicaram os resultados da auditoria do Tor Browser e das ferramentas desenvolvidas pelo projeto OONI Probe, rdsys, BridgeDB e Conjure, utilizadas para contornar a censura.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 Tor Browser \u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b Tor | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-26T19:10:15+00:00","article:modified_time":"2023-10-26T19:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111112","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:05","updated":"2026-02-22 15:31:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/111112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=111112"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/111112\/revisions"}],"predecessor-version":[{"id":162425,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/111112\/revisions\/162425"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/111113"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=111112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=111112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=111112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}