{"id":111112,"date":"2023-10-26T21:10:14","date_gmt":"2023-10-26T19:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor"},"modified":"2023-10-26T21:10:14","modified_gmt":"2023-10-26T19:10:15","slug":"rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","title":{"rendered":"Rezultatele auditului Tor Browser \u0219i componentelor infrastructurii Tor","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dezvoltatorii re\u021belei anonime Tor au publicat rezultatele auditului browserului Tor Browser \u0219i al instrumentelor dezvoltate de proiect, OONI Probe, rdsys, BridgeDB \u0219i Conjure, utilizate pentru ocolirea cenzurii. Auditul a fost realizat de compania Cure53 \u00eentre noiembrie 2022 \u0219i aprilie 2023. <\/p>\n

\u00cen urma verific\u0103rii, au fost identificate 9 vulnerabilit\u0103\u021bi, dintre care dou\u0103 au fost clasificate ca fiind periculoase, una a primit un nivel mediu de pericol, iar 6 au fost considerate probleme cu un nivel de pericol neglijabil. De asemenea, \u00een baza de cod au fost g\u0103site 10 probleme, catalogate ca nefiind legate de vulnerabilit\u0103\u021bi de securitate. \u00cen general, codul proiectului Tor a fost evaluat ca fiind conform practicilor de programare sigur\u0103. <\/p>\n

Prima vulnerabilitate periculoas\u0103 s-a reg\u0103sit \u00een backend-ul sistemului distribuit rdsys, care asigur\u0103 livrarea de resurse c\u0103tre utilizatorii cenzura\u021bi, cum ar fi listele de proxy \u0219i linkurile pentru desc\u0103rcare. Vulnerabilitatea este cauzat\u0103 de lipsa autentific\u0103rii \u00een accesarea handler-ului de \u00eenregistrare a resurselor \u0219i permite unui atacator s\u0103 \u00eenregistreze propria sa resurs\u0103 d\u0103un\u0103toare pentru a o livra utilizatorilor. Exploatarea const\u0103 \u00een trimiterea unei cereri HTTP c\u0103tre handlerul rdsys.

\"Rezultatele<\/center> <\/p>\n

A doua vulnerabilitate periculoas\u0103 a fost g\u0103sit\u0103 \u00een Tor Browser \u0219i a fost cauzat\u0103 de lipsa verific\u0103rii semn\u0103turii digitale la primirea listei de noduri bridge prin rdsys \u0219i BridgeDB. Deoarece lista este \u00eenc\u0103rcat\u0103 \u00een browser \u00een etapa prealabil\u0103 conect\u0103rii la re\u021beaua anonim\u0103 Tor, lipsa verific\u0103rii prin semn\u0103tur\u0103 digital\u0103 criptografic\u0103 permitea unui atacator s\u0103 \u00eenlocuiasc\u0103 con\u021binutul listei, de exemplu, prin interceptarea conexiunii sau prin atacuri de tip hacking, prin care se distribuia lista. \u00cen cazul unui atac reu\u0219it, atacatorul putea organiza conexiunea utilizatorilor prin propriul nod bridge compromis. server<\/a>, prin care se r\u0103sp\u00e2nde\u0219te lista. \u00cen cazul unui atac reu\u0219it, atacatorul ar putea organiza conectarea utilizatorilor prin intermediul propriei noduri de pod compromise. <\/p>\n

O vulnerabilitate de nivel mediu a fost prezent\u0103 \u00een subsistemul rdsys \u00een scriptul de desf\u0103\u0219urare a pachetelor \u0219i permitea unui atacator s\u0103-\u0219i creasc\u0103 privilegiile de la utilizatorul nobody la utilizatorul rdsys, av\u00e2nd acces la server<\/a> \u0219i posibilitatea de a scrie \u00een catalogul cu fi\u0219iere temporare. Exploatarea vulnerabilit\u0103\u021bii const\u0103 \u00een \u00eenlocuirea fi\u0219ierului executabil plasat \u00een catalogul \/tmp. Ob\u021binerea drepturilor utilizatorului rdsys permite atacatorului s\u0103 efectueze modific\u0103ri \u00een fi\u0219ierele executabile lansate prin rdsys. <\/p>\n

Vulnerabilit\u0103\u021bile de nivel sc\u0103zut au fost \u00een principal asociate cu utilizarea unor dependen\u021be \u00eenvechite, care con\u021bineau vulnerabilit\u0103\u021bi cunoscute sau cu posibilitatea de a provoca un refuz de serviciu. Printre vulnerabilit\u0103\u021bile menor s\u0103rb\u0103torite \u00een Tor Browser se num\u0103r\u0103 capacitatea de a ocoli restric\u021biile privind executarea JavaScript la nivelul maxim de protec\u021bie, lipsa unor limit\u0103ri ale \u00eenc\u0103rc\u0103rii fi\u0219ierelor \u0219i o poten\u021bial\u0103 scurgere de informa\u021bii prin pagina de acas\u0103 a utilizatorului, care permite monitorizarea utilizatorilor \u00eentre sesiuni. <\/p>\n

\u00cen prezent, toate vulnerabilit\u0103\u021bile au fost remediate, inclusiv implementarea autentific\u0103rii pentru toate handler-urile rdsys \u0219i ad\u0103ugarea verific\u0103rii semn\u0103turilor digitale pentru listele \u00eenc\u0103rcate \u00een Tor Browser. <\/p>\n

De asemenea, se poate men\u021biona lansarea browserului Tor Browser 13.0.1. Aceast\u0103 lansare a fost sincronizat\u0103 cu baza de cod Firefox 115.4.0 ESR, care a remediat 19 vulnerabilit\u0103\u021bi (13 dintre ele fiind considerate critice). \u00cen versiunea Tor Browser 13.0.1 pentru Android au fost transferate corecturi de vulnerabilitate din ramura Firefox 119.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0410\u0443\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cure53 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u044b \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043e\u0434\u043d\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0441\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":111113,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rezultatele auditului Tor Browser \u0219i ale componentelor infrastructurii Tor | ProHoster","description":"Dezvoltatorii re\u021belei anonime Tor au publicat rezultatele auditului browserului Tor Browser \u0219i al uneltelor dezvoltate de proiectul OONI Probe, rdsys, BridgeDB \u0219i Conjure, folosite pentru a ocoli cenzur\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 Tor Browser \u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b Tor | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-26T19:10:15+00:00","article:modified_time":"2023-10-26T19:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111112","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:05","updated":"2026-02-22 15:31:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=111112"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111112\/revisions"}],"predecessor-version":[{"id":162425,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111112\/revisions\/162425"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/111113"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=111112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=111112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=111112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}