{"id":55546,"date":"2020-01-23T00:00:00","date_gmt":"2020-01-22T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/otkryt-kod-klientskih-prilozhenij-protonvpn"},"modified":"2020-02-18T14:03:40","modified_gmt":"2020-02-18T11:03:40","slug":"otkryt-kod-klientskih-prilozhenij-protonvpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/otkryt-kod-klientskih-prilozhenij-protonvpn","title":{"rendered":"C\u00f3digo dos aplicativos clientes ProtonVPN aberto","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A empresa Proton Technologies, que desenvolve um servi\u00e7o de e-mail seguro e VPN, anunciou<\/a><\/noindex> anunciou a abertura dos c\u00f3digos-fonte<\/a><\/noindex> dos programas clientes ProtonVPN para Windows<\/a><\/noindex>, macOS<\/a><\/noindex>, Android<\/a><\/noindex> e iOS<\/a><\/noindex> (cliente de console Linux aberto inicialmente). O c\u00f3digo foi liberado sob a licen\u00e7a GPLv3. Relat\u00f3rios sobre a realiza\u00e7\u00e3o de uma auditoria independente dos aplicativos mencionados tamb\u00e9m foram publicados. Durante a auditoria, n\u00e3o foram encontradas quest\u00f5es que poderiam levar \u00e0 decripta\u00e7\u00e3o do tr\u00e1fego VPN ou ao aumento de privil\u00e9gios.<\/a><\/noindex> O c\u00f3digo foi aberto como parte de uma iniciativa para garantir a transpar\u00eancia do projeto, para que especialistas independentes possam verificar se o c\u00f3digo est\u00e1 de acordo com as especifica\u00e7\u00f5es declaradas e monitorar a corre\u00e7\u00e3o da auditoria de seguran\u00e7a. Dentro da colabora\u00e7\u00e3o com a Mozilla, que<\/p>\n

desenvolve um servi\u00e7o VPN pago, tamb\u00e9m foi dado acesso aos engenheiros da Mozilla a outras tecnologias do ProtonVPN para auditoria. \u00c9 destacado que o pr\u00f3ximo passo ser\u00e1 tornar p\u00fablicos os demais aplicativos do ProtonVPN.<\/a><\/noindex> Entre os incidentes anteriores com o ProtonVPN, pode-se destacar <\/p>\n

a descoberta de uma vulnerabilidade<\/a><\/noindex> no aplicativo para Windows, que permitia ao usu\u00e1rio elevar seus privil\u00e9gios no sistema para administrador (a vulnerabilidade foi causada pela intera\u00e7\u00e3o inadequada entre o cliente GUI sem privil\u00e9gios e o servi\u00e7o de sistema).<\/a><\/noindex> A auditoria do c\u00f3digo do aplicativo para Windows, conclu\u00edda h\u00e1 alguns dias, identificou <\/p>\n

4 vulnerabilidades (duas de gravidade m\u00e9dia e duas menores): armazenamento de tokens de sess\u00e3o e credenciais na mem\u00f3ria do processo, chaves do servidor VPN predefinidas no arquivo de configura\u00e7\u00e3o (n\u00e3o usadas para autentica\u00e7\u00e3o), inclus\u00e3o de informa\u00e7\u00f5es de depura\u00e7\u00e3o e aceita\u00e7\u00e3o de conex\u00f5es em todas as interfaces de rede.<\/a><\/noindex> Na vers\u00e3o para <\/p>\n

n\u00e3o foram encontradas vulnerabilidades. Na vers\u00e3o para iOS, foram encontradas duas menores macOS<\/a><\/noindex> (n\u00e3o utiliza o v\u00ednculo do certificado SSL e n\u00e3o bloqueia a opera\u00e7\u00e3o em dispositivos ap\u00f3s jailbreak). Na vers\u00e3o para Android, no aplicativo para Windows, que permitia ao usu\u00e1rio elevar seus privil\u00e9gios no sistema para administrador (a vulnerabilidade foi causada pela intera\u00e7\u00e3o inadequada entre o cliente GUI sem privil\u00e9gios e o servi\u00e7o de sistema).<\/a><\/noindex> foram identificados quatro problemas menores (inclus\u00e3o de mensagens de depura\u00e7\u00e3o, falta de bloqueio de backup por meio da ferramenta ADB, criptografia de configura\u00e7\u00f5es com uma chave predefinida, aus\u00eancia de v\u00ednculo do certificado SSL) e uma vulnerabilidade de gravidade m\u00e9dia (encerramento incompleto da sess\u00e3o, permitindo a reutiliza\u00e7\u00e3o de tokens de sess\u00e3o).<\/a><\/noindex> quatro problemas menores (inclus\u00e3o de mensagens de depura\u00e7\u00e3o, falta de bloqueio de backup com a ferramenta ADB, criptografia de configura\u00e7\u00f5es com uma chave predefinida, aus\u00eancia da vincula\u00e7\u00e3o do certificado SSL) e uma vulnerabilidade de gravidade m\u00e9dia (finaliza\u00e7\u00e3o incompleta da sess\u00e3o, permitindo a reutiliza\u00e7\u00e3o dos tokens de sess\u00e3o).<\/p>\n

Lembramos que a Proton Technologies foi fundada por v\u00e1rios pesquisadores do CERN (Organiza\u00e7\u00e3o Europeia para Pesquisa Nuclear) e est\u00e1 registrada na Su\u00ed\u00e7a, que possui uma legisla\u00e7\u00e3o rigorosa em mat\u00e9ria de prote\u00e7\u00e3o da privacidade, impedindo que servi\u00e7os secretos controlem informa\u00e7\u00f5es. O projeto ProtonVPN oferece um alto n\u00edvel de prote\u00e7\u00e3o do canal de comunica\u00e7\u00e3o (o tr\u00e1fego \u00e9 criptografado com AES-256, a troca de chaves \u00e9 baseada em chaves RSA de 2048 bits e HMAC, a autentica\u00e7\u00e3o utiliza SHA-256, e h\u00e1 prote\u00e7\u00e3o contra ataques baseados em correla\u00e7\u00e3o de fluxos de dados), n\u00e3o mant\u00e9m registros e \u00e9 orientado n\u00e3o para lucro, mas para aumentar a seguran\u00e7a e a privacidade na Web (o projeto \u00e9 financiado pela funda\u00e7\u00e3o FONGIT, apoiada pela Comiss\u00e3o Europeia). <\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Proton Technologies, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0438 VPN, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c ProtonVPN \u0434\u043b\u044f Windows, macOS, Android \u0438 iOS (\u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u044b\u0439 Linux-\u043a\u043b\u0438\u0435\u043d\u0442 \u043e\u0442\u043a\u0440\u044b\u0442 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e). \u041a\u043e\u0434 \u043e\u0442\u043a\u0440\u044b\u0442 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv3. \u041e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0442\u0447\u0451\u0442\u044b \u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 VPN-\u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u0432 \u0445\u043e\u0434\u0435 \u0430\u0443\u0434\u0438\u0442\u0430 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55546","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 O c\u00f3digo dos aplicativos clientes do ProtonVPN est\u00e1 aberto | ProHoster","description":"A Proton Technologies, que desenvolve um servi\u00e7o de e-mail seguro e VPN, anunciou a abertura","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/otkryt-kod-klientskih-prilozhenij-protonvpn","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u043a\u0440\u044b\u0442 \u043a\u043e\u0434 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 ProtonVPN | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Proton Technologies, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0438 VPN, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/otkryt-kod-klientskih-prilozhenij-protonvpn","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-22T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55546","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:42:37","updated":"2022-10-07 23:49:44","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/55546","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=55546"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/55546\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=55546"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=55546"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=55546"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}