{"id":105525,"date":"2022-11-11T21:36:51","date_gmt":"2022-11-11T19:36:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-android-pozvolyayushhaya-obojti-blokirovku-ekrana"},"modified":"2022-11-11T21:36:51","modified_gmt":"2022-11-11T19:36:51","slug":"uyazvimost-v-android-pozvolyayushhaya-obojti-blokirovku-ekrana","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-android-pozvolyayushhaya-obojti-blokirovku-ekrana","title":{"rendered":"O vulnerabilitate \u00een Android care permite ocolirea bloc\u0103rii ecranului","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O vulnerabilitate a fost identificat\u0103 pe platforma Android (CVE-2022-20465), care permite dezactivarea bloc\u0103rii ecranului prin schimbarea cartela SIM \u0219i introducerea codului PUK. Posibilitatea de a dezactiva blocarea a fost demonstrat\u0103 pe dispozitivele Google Pixel, \u00eens\u0103, deoarece remedierile afecteaz\u0103 baza de cod principal Android, este probabil ca problema s\u0103 afecteze \u0219i versiunile de firmware ale altor produc\u0103tori. Problema a fost corectat\u0103 \u00een pachetul de actualiz\u0103ri de securitate din noiembrie pentru Android. Cercet\u0103torul care a semnalat problema a primit din partea Google o recompens\u0103 de 70.000 de dolari. <\/p>\n

Problema este cauzat\u0103 de o procesare incorect\u0103 a debloc\u0103rii dup\u0103 introducerea codului PUK (Personal Unblocking Key), utilizat pentru a restabili func\u021bionarea cartela SIM-ului, blocat\u0103 dup\u0103 introduceri gre\u0219ite repetate ale codului PIN. Pentru a dezactiva blocarea ecranului, este suficient s\u0103 introduce\u021bi cartela SIM cu protec\u021bie pe baza codului PIN \u00een telefon. Dup\u0103 schimbarea cartela SIM, protejat\u0103 cu cod PIN, pe ecran apare mai \u00eent\u00e2i solicitarea codului PIN. Dac\u0103 codul PIN este introdus gre\u0219it de trei ori, cartela SIM va fi blocat\u0103, dup\u0103 care se va oferi posibilitatea de a introduce codul PUK pentru deblocare. S-a constatat c\u0103 introducerea corect\u0103 a codului PUK nu doar c\u0103 deblocheaz\u0103 cartela SIM, ci conduce \u0219i la trecerea \u00een interfa\u021ba principal\u0103, ocolind blocatorul de ecran, f\u0103r\u0103 a necesita confirmarea accesului cu parola principal\u0103 sau cu un model grafic.

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Vulnerabilitatea este cauzat\u0103 de o eroare \u00een logica verific\u0103rii codurilor PUK \u00een handler-ul KeyguardSimPukViewController, care este responsabil pentru afi\u0219area ecranului suplimentar de autentificare. Android utilizeaz\u0103 mai multe tipuri de ecrane de autentificare (pentru PIN, PUK, parol\u0103, model grafic, autentificare biometric\u0103) \u0219i aceste ecrane sunt apelate secven\u021bial atunci c\u00e2nd se solicit\u0103 mai multe verific\u0103ri, de exemplu, atunci c\u00e2nd sunt necesare at\u00e2t PIN-ul, c\u00e2t \u0219i modelul grafic. <\/p>\n

C\u00e2nd PIN-ul este introdus corect, se activeaz\u0103 a doua etap\u0103 de verificare, care necesit\u0103 introducerea codului principal de deblocare, dar, \u00een cazul introducerii codului PUK, aceast\u0103 etap\u0103 este s\u0103rit\u0103, iar accesul este oferit f\u0103r\u0103 a solicita parola principal\u0103 sau cheia grafic\u0103. S\u0103rind etapa de deblocare urm\u0103toare, deoarece la apelarea KeyguardSecurityContainerController#dismiss() nu se efectueaz\u0103 compararea metodei de verificare a\u0219teptate cu cea parcurs\u0103, adic\u0103 handler-ul consider\u0103 c\u0103 metoda de verificare nu a fost schimbat\u0103, iar finalizarea verific\u0103rii codului PUK semnific\u0103 confirmarea cu succes a legitimit\u0103\u021bii. <\/p>\n

Vulnerabilitatea a fost descoperit\u0103 \u00eent\u00e2mpl\u0103tor \u2012 utilizatorului i s-a desc\u0103rcat telefonul \u0219i, dup\u0103 ce l-a \u00eenc\u0103rcat \u0219i l-a pornit, a gre\u0219it de c\u00e2teva ori la introducerea PIN-ului. Ulterior, a deblocat telefonul cu codul PUK \u0219i a fost surprins c\u0103 sistemul nu i-a cerut parola principal\u0103, folosit\u0103 pentru decriptarea datelor, moment \u00een care s-a blocat cu mesajul \u201ePixel is starting\u2026\u201d. Utilizatorul, fiind curios, a decis s\u0103 \u00een\u021beleag\u0103 ce s-a \u00eent\u00e2mplat \u0219i a \u00eenceput s\u0103 experimenteze cu introducerea codurilor PIN \u0219i PUK, p\u00e2n\u0103 c\u00e2nd, din \u00eent\u00e2mplare, a uitat s\u0103 reporneasc\u0103 dispozitivul dup\u0103 schimbarea cartelei SIM \u0219i a ob\u021binut acces la mediu \u00een loc de blocare. <\/p>\n

Reac\u021bia Google la raportul privind vulnerabilitatea este deosebit de interesant\u0103. Informa\u021biile despre problem\u0103 au fost trimise \u00een iunie, dar p\u00e2n\u0103 \u00een septembrie cercet\u0103torul nu a reu\u0219it s\u0103 ob\u021bin\u0103 un r\u0103spuns clar. Acesta a considerat c\u0103 un comportament similar este explicabil prin faptul c\u0103 nu este prima persoan\u0103 care semnaleaz\u0103 aceast\u0103 eroare. Suspiciunile c\u0103 ceva nu este \u00een regul\u0103 au ap\u0103rut \u00een septembrie, c\u00e2nd problema a r\u0103mas nerezolvat\u0103 dup\u0103 instalarea actualiz\u0103rii firmware-ului, care a fost lansat\u0103 la 90 de zile dup\u0103, c\u00e2nd perioada declarat\u0103 de confiden\u021bialitate a expirat deja. <\/p>\n

Deoarece toate \u00eencerc\u0103rile de a ob\u021bine o actualizare privind starea mesajului trimis despre problem\u0103 au dus doar la r\u0103spunsuri automate \u0219i standardizate, cercet\u0103torul a \u00eencercat s\u0103 contacteze personal angaja\u021bii Google pentru a clarifica situa\u021bia cu privire la preg\u0103tirea remedierii \u0219i a demonstrat chiar vulnerabilitatea la biroul Google din Londra. Abia dup\u0103 aceea, lucr\u0103rile pentru eliminarea vulnerabilit\u0103\u021bii au avansat. \u00cen urma analizei, s-a constatat c\u0103 cineva mai raportase anterior problema, dar Google a decis s\u0103 fac\u0103 o excep\u021bie \u0219i s\u0103 ofere o recompens\u0103 pentru raportarea repetat\u0103 a problemei, deoarece doar datorit\u0103 insisten\u021bei autorului s\u0103u problema a fost adus\u0103 \u00een aten\u021bie.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Android \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-20465), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u044d\u043a\u0440\u0430\u043d\u0430 \u043f\u0443\u0442\u0451\u043c \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 SIM-\u043a\u0430\u0440\u0442\u044b \u0438 \u0432\u0432\u043e\u0434\u0430 PUK-\u043a\u043e\u0434\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Google Pixel, \u043d\u043e \u0442\u0430\u043a \u043a\u0430\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 Android, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f \u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a \u043e\u0442 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u043c \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0434\u043b\u044f Android. \u041e\u0431\u0440\u0430\u0442\u0438\u0432\u0448\u0438\u0439 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105525","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een Android, care permite ocolirea bloc\u0103rii ecranului | ProHoster","description":"O vulnerabilitate (CVE-2022-20465) a fost identificat\u0103 \u00een platforma Android, care permite deblocarea ecranului prin schimbarea cartela SIM \u0219i introducerea codului PUK.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-android-pozvolyayushhaya-obojti-blokirovku-ekrana","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u044d\u043a\u0440\u0430\u043d\u0430 | ProHoster","og:description":"\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Android \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-20465), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u044d\u043a\u0440\u0430\u043d\u0430 \u043f\u0443\u0442\u0451\u043c \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 SIM-\u043a\u0430\u0440\u0442\u044b \u0438 \u0432\u0432\u043e\u0434\u0430 PUK-\u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-android-pozvolyayushhaya-obojti-blokirovku-ekrana","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-11T19:36:51+00:00","article:modified_time":"2022-11-11T19:36:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=105525"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105525\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=105525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=105525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=105525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}