{"id":91733,"date":"2020-08-17T19:42:21","date_gmt":"2020-08-17T17:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip"},"modified":"2020-08-17T19:42:21","modified_gmt":"2020-08-17T17:42:21","slug":"doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","title":{"rendered":"Relat\u00f3rio do conselho de seguran\u00e7a do Tor: n\u00f3s de sa\u00edda maliciosos usaram sslstrip.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"


\n \"Relat\u00f3rio<\/p>\n

<\/a><\/p>\n

<\/p>\n

A ess\u00eancia do que aconteceu<\/b><\/p>\n

Em maio de 2020, foi descoberta um grupo de n\u00f3s de sa\u00edda que interferiam nas conex\u00f5es de sa\u00edda. Em particular, eles deixavam quase todas as conex\u00f5es intocadas, mas interceptavam conex\u00f5es com um pequeno n\u00famero de exchanges de criptomoedas. Se os usu\u00e1rios acessassem a vers\u00e3o HTTP do site (ou seja, n\u00e3o criptografada e n\u00e3o autenticada), os n\u00f3s maliciosos evitavam o redirecionamento para a vers\u00e3o HTTPS (ou seja, criptografada e autenticada). Se o usu\u00e1rio n\u00e3o percebia a substitui\u00e7\u00e3o (por exemplo, a aus\u00eancia do \u00edcone de cadeado no navegador) e come\u00e7ava a enviar informa\u00e7\u00f5es importantes, essas informa\u00e7\u00f5es podiam ser interceptadas pelo atacante.<\/p>\n

O projeto Tor excluiu esses n\u00f3s da rede em maio de 2020. Em julho de 2020, um novo grupo de retransmissores foi descoberto, realizando um ataque semelhante, e tamb\u00e9m foi exclu\u00eddo. At\u00e9 agora, n\u00e3o est\u00e1 claro se algum usu\u00e1rio foi atacado com sucesso, mas dado a escala do ataque e o fato de o atacante ter repetido a tentativa (o primeiro caso afetou 23% da capacidade total de largura de banda dos n\u00f3s de sa\u00edda, o segundo aproximadamente 19%), parece razo\u00e1vel supor que o criminoso considerou os custos do ataque justific\u00e1veis.<\/p>\n

Este incidente \u00e9 um bom lembrete de que as solicita\u00e7\u00f5es HTTP n\u00e3o s\u00e3o criptografadas e n\u00e3o s\u00e3o autenticadas, portanto ainda s\u00e3o vulner\u00e1veis. O Tor Browser inclui a extens\u00e3o HTTPS-Everywhere, projetada especificamente para prevenir tais ataques, mas sua efic\u00e1cia \u00e9 limitada pela lista que n\u00e3o abrange todos os sites do mundo. Os usu\u00e1rios que visitam a vers\u00e3o HTTP dos sites sempre estar\u00e3o sob amea\u00e7a.<\/p>\n

Preven\u00e7\u00e3o de ataques semelhantes no futuro<\/b><\/p>\n

As formas de prevenir ataques se dividem em duas partes: a primeira inclui medidas que usu\u00e1rios e administradores de sites podem tomar para refor\u00e7ar sua seguran\u00e7a, enquanto a segunda diz respeito \u00e0 identifica\u00e7\u00e3o e detec\u00e7\u00e3o oportuna de n\u00f3s maliciosos na rede.<\/p>\n

A\u00e7\u00f5es recomendadas por parte dos sites: <\/p>\n

1. Habilita\u00e7\u00e3o do HTTPS (certificados gratuitos s\u00e3o fornecidos Let’s Encrypt<\/a>) <\/p>\n

<\/noindex><\/p>\n

2. Adicionando regras de redirecionamento na lista do HTTPS-Everywhere, para que os usu\u00e1rios possam estabelecer uma conex\u00e3o segura de forma preventiva, em vez de depender de um redirecionamento ap\u00f3s estabelecer uma conex\u00e3o n\u00e3o segura. Al\u00e9m disso, se a administra\u00e7\u00e3o dos servi\u00e7os web desejar evitar completamente a intera\u00e7\u00e3o com n\u00f3s de sa\u00edda, ela pode oferecer uma vers\u00e3o onion do site<\/a>.<\/p>\n

<\/noindex><\/p>\n

Atualmente, o projeto Tor est\u00e1 considerando a possibilidade de desabilitar completamente o HTTP n\u00e3o seguro no Tor Browser. H\u00e1 alguns anos, essa medida era impens\u00e1vel (muitos recursos s\u00f3 estavam dispon\u00edveis via HTTP n\u00e3o seguro), mas com o HTTPS-Everywhere e a pr\u00f3xima vers\u00e3o do Firefox, h\u00e1 uma op\u00e7\u00e3o experimental de usar HTTPS como padr\u00e3o para a primeira conex\u00e3o, com a possibilidade de retornar ao HTTP se necess\u00e1rio. N\u00e3o est\u00e1 claro como essa abordagem afetar\u00e1 os usu\u00e1rios do Tor Browser, por isso ser\u00e1 testada primeiro em n\u00edveis de seguran\u00e7a mais altos do navegador (\u00edcone de escudo).<\/p>\n

H\u00e1 volunt\u00e1rios na rede Tor que monitoram o comportamento dos retransmissores e relatam incidentes, permitindo que n\u00f3s maliciosos sejam exclu\u00eddos pelos servidores de diret\u00f3rio principais. Embora esses relat\u00f3rios geralmente sejam tratados rapidamente e os n\u00f3s maliciosos sejam desconectados imediatamente ap\u00f3s a descoberta, os recursos para monitoramento cont\u00ednuo da rede s\u00e3o insuficientes. Se voc\u00ea conseguir detectar um retransmissor malicioso, pode relatar ao projeto, instru\u00e7\u00f5es. est\u00e3o dispon\u00edveis neste link<\/a>.<\/p>\n

<\/noindex><\/p>\n

A abordagem atual tem dois problemas fundamentais: <\/p>\n

1. Ao considerar um retransmissor desconhecido, \u00e9 dif\u00edcil provar sua mal\u00edcia. Se n\u00e3o houve ataques provenientes dele, devemos mant\u00ea-lo? Ataques em massa que afetam muitos usu\u00e1rios s\u00e3o mais f\u00e1ceis de detectar, mas se os ataques afetarem apenas um pequeno n\u00famero de sites e usu\u00e1rios, o atacante pode agir de forma preventiva<\/a>A pr\u00f3pria rede Tor consiste em milhares de retransmissores localizados em todo o mundo, e essa diversidade (e a descentraliza\u00e7\u00e3o resultante) \u00e9 uma de suas grandes vantagens. <\/p>\n

<\/noindex><\/p>\n

2. Ao considerar um grupo de retransmissores desconhecidos, \u00e9 dif\u00edcil provar sua interconex\u00e3o (ou seja, se eles est\u00e3o conduzindo um ataque Sybil<\/a>). Muitos operadores de retransmiss\u00e3o volunt\u00e1rios escolhem as mesmas redes baratas para hospedagem, como Hetzner, OVH, Online, Frantech, Leaseweb, etc., e se v\u00e1rios novos retransmissores forem descobertos, ser\u00e1 dif\u00edcil supor com clareza se surgiram v\u00e1rios novos operadores ou apenas um gerenciando todos os novos retransmissores.<\/p>\n

<\/noindex><\/noindex><\/p>\n

Fonte: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u0412 \u043c\u0430\u0435 2020 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432, \u0432\u043c\u0435\u0448\u0438\u0432\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043e\u043d\u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0438 \u043d\u0435\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043d\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u043b\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u043c\u0443 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0443 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043d\u044b\u0445 \u0431\u0438\u0440\u0436. \u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0441\u0435\u0449\u0430\u043b\u0438 HTTP-\u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 (\u0442.\u0435. \u043d\u0435\u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e), \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0443\u0437\u043b\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 HTTPS-\u0432\u0435\u0440\u0441\u0438\u044e (\u0442.\u0435. \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e). \u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u0437\u0430\u043c\u0435\u0447\u0430\u043b \u043f\u043e\u0434\u043c\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91734,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91733","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Relat\u00f3rio do conselho de seguran\u00e7a do Tor: n\u00f3s de sa\u00edda maliciosos usaram sslstrip. | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043a\u043b\u0430\u0434 \u0441\u043e\u0432\u0435\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Tor: \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435 \u0443\u0437\u043b\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 sslstrip. | ProHoster","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-17T17:42:21+00:00","article:modified_time":"2020-08-17T17:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91733","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:22:22","updated":"2022-10-05 06:28:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/91733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=91733"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/91733\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/91734"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=91733"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=91733"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=91733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}