{"id":37054,"date":"2019-10-31T22:15:30","date_gmt":"2019-10-31T19:15:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti\/"},"modified":"2019-10-31T22:15:30","modified_gmt":"2019-10-31T19:15:30","slug":"pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","title":{"rendered":"Pwnie Awards 2019: najv\u00fdznamnej\u0161ie zranite\u013enosti a zlyhania v bezpe\u010dnosti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Na ned\u00e1vnej konferencii Black Hat USA v Las Vegas <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\/\">sa konala<\/a><\/noindex> cerem\u00f3nia odovzd\u00e1vania cien <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\">Pwnie Awards 2019<\/a><\/noindex>, v r\u00e1mci ktorej boli ocenen\u00e9 najv\u00fdznamnej\u0161ie zranite\u013enosti a absurdn\u00e9 zlyhania v oblasti po\u010d\u00edta\u010dovej bezpe\u010dnosti. Pwnie Awards sa pova\u017euje za ekvivalent Oscara a Zlatej maliny v oblasti po\u010d\u00edta\u010dovej bezpe\u010dnosti a kon\u00e1 sa ka\u017edoro\u010dne od roku 2007. <\/p>\n<p>Hlavn\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\/winners\/\">v\u00ed\u0165azi<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\/nominations\">nomin\u00e1ci\u00ed<\/a><\/noindex>: <\/p>\n<ul>\n<li class=\"l\"> <b>Najlep\u0161ia serverov\u00e1 chyba<\/b>. Ude\u013euje sa za objavenie a zneu\u017eitie najtechnicky zlo\u017eitej a zauj\u00edmavej chyby v sie\u0165ovej slu\u017ebe. V\u00ed\u0165azmi sa stali v\u00fdskumn\u00edci,  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.blackhat.com\/us-19\/briefings\/schedule\/#infiltrating-corporate-intranet-like-nsa---pre-auth-rce-on-leading-ssl-vpns-15545\">ktor\u00ed identifikovali<\/a><\/noindex> zranite\u013enos\u0165 u VPN poskytovate\u013ea Pulse Secure, ktor\u00e9ho VPN slu\u017eba sa pou\u017e\u00edva vo firm\u00e1ch ako Twitter, Uber, Microsoft, sla, SpaceX, Akamai, Intel, IBM, VMware, v n\u00e1morn\u00fdch sil\u00e1ch USA, Ministerstve n\u00e1rodnej bezpe\u010dnosti USA a pravdepodobne v polovici spolo\u010dnost\u00ed zo zoznamu Fortune 500. V\u00fdskumn\u00edci objavili zadn\u00fd vstup, ktor\u00fd umo\u017e\u0148uje neautentifikovan\u00e9mu \u00fato\u010dn\u00edkovi zmeni\u0165 heslo ak\u00e9hoko\u013evek pou\u017e\u00edvate\u013ea. Demon\u0161trovan\u00e1 bola mo\u017enos\u0165 zneu\u017eitia probl\u00e9mu na z\u00edskanie root pr\u00edstupu k serveru VPN, ktor\u00fd m\u00e1 otvoren\u00fd iba port HTTPS;\n<p>Z neocenen\u00fdch nominantov mo\u017eno spomen\u00fa\u0165: <\/p>\n<ul>\n<li class=\"l\"> Zranite\u013enos\u0165 na \u00farovni pred autentifik\u00e1ciou <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/orangetw\/awesome-jenkins-rce-2019\">zranite\u013enos\u0165<\/a><\/noindex> v syst\u00e9me nepretr\u017eitej integr\u00e1cie Jenkins, ktor\u00e1 umo\u017e\u0148uje vykon\u00e1va\u0165 k\u00f3d na serveri. Zranite\u013enos\u0165 sa akt\u00edvne zneu\u017e\u00edva botmi na organizovanie \u0165a\u017eby kryptomeny na serveroch;\n<li class=\"l\"> Kritick\u00e1 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50819\">zranite\u013enos\u0165<\/a><\/noindex> zranite\u013enos\u0165 v po\u0161tovom serveri Exim, ktor\u00e1 umo\u017e\u0148uje vykon\u00e1va\u0165 k\u00f3d na serveri s pr\u00e1vami root;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/sec-consult.com\/en\/blog\/2018\/10\/millions-of-xiongmai-video-surveillance-devices-can-be-hacked-via-cloud-feature-xmeye-p2p-cloud\/\">Zranite\u013enosti<\/a><\/noindex> v IP kamer\u00e1ch Xiongmai XMeye P2P, ktor\u00e9 umo\u017e\u0148uj\u00fa prevzia\u0165 kontrolu nad zariaden\u00edm. Kamery boli dod\u00e1van\u00e9 s in\u017einierskym heslom a pri aktualiz\u00e1cii firmv\u00e9ru nepou\u017e\u00edvali kontrolu digit\u00e1lnym podpisom;\n<li class=\"l\"> Kritick\u00e1 <noindex><a rel=\"nofollow\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-0708\">zranite\u013enos\u0165<\/a><\/noindex> v implement\u00e1cii protokolu RDP vo Windows, ktor\u00e1 umo\u017e\u0148uje vzdialene vykon\u00e1va\u0165 svoj k\u00f3d;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50177\">Zranite\u013enos\u0165<\/a><\/noindex> v WordPress, nakolko nahr\u00e1vanie PHP k\u00f3du pod z\u00e1mienkou obr\u00e1zku. Probl\u00e9m umo\u017e\u0148uje vykon\u00e1va\u0165 \u013eubovo\u013en\u00fd k\u00f3d na serveri s pr\u00e1vami autora publik\u00e1ci\u00ed (Author) na str\u00e1nke;\n<\/ul>\n<li class=\"l\"> <b>Najlep\u0161ia chyba v klientskom softv\u00e9ri<\/b>. V\u00ed\u0165azom sa stala \u013eahko zneu\u017eite\u013en\u00e1 <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-6223\">zranite\u013enos\u0165<\/a><\/noindex> v syst\u00e9me skupinov\u00fdch hovorov Apple FaceTime, ktor\u00e1 umo\u017e\u0148uje inici\u00e1torovi skupinov\u00e9ho hovoru n\u00fatene prija\u0165 hovor na strane volan\u00e9ho \u00fa\u010dastn\u00edka (napr\u00edklad na odpo\u010d\u00favanie a \u0161pehovanie).\n<p>Na z\u00edskanie ceny tie\u017e kandidovali: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50679\">Zranite\u013enos\u0165<\/a><\/noindex> v aplik\u00e1cii WhatsApp, ktor\u00e1 umo\u017e\u0148uje vykonanie svojho k\u00f3du prostredn\u00edctvom \u0161peci\u00e1lne spracovan\u00e9ho hlasov\u00e9ho hovoru;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugs.chromium.org\/p\/chromium\/issues\/detail?id=899689\">Zranite\u013enos\u0165<\/a><\/noindex> v grafickej kni\u017enici Skia, pou\u017e\u00edvan\u00e9 v prehliada\u010di Chrome, ktor\u00e1 m\u00f4\u017ee sp\u00f4sobi\u0165 po\u0161kodenie pam\u00e4te kv\u00f4li chyb\u00e1m vo vykon\u00e1van\u00ed oper\u00e1ci\u00ed s pl\u00e1vaj\u00facou \u010diarkou pri niektor\u00fdch geometrick\u00fdch transform\u00e1ci\u00e1ch;\n<\/ul>\n<li class=\"l\"> <b>Najlep\u0161ia zranite\u013enos\u0165, ved\u00faca k zv\u00fd\u0161eniu opr\u00e1vnen\u00ed<\/b>. V\u00ed\u0165azstvo bolo udelen\u00e9 za odhalenie <noindex><a rel=\"nofollow\" href=\"https:\/\/googleprojectzero.blogspot.com\/2019\/01\/voucherswap-exploiting-mig-reference.html\">zranite\u013enosti<\/a><\/noindex> v jadre iOS, ktor\u00fa je mo\u017en\u00e9 zneu\u017ei\u0165 cez ipc_voucher, dostupn\u00e9 na pr\u00edstup prostredn\u00edctvom prehliada\u010da Safari.\n<p>Na z\u00edskanie ceny tie\u017e kandidovali: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-0859\">Zranite\u013enos\u0165<\/a><\/noindex> v syst\u00e9me Windows, umo\u017e\u0148uj\u00faca z\u00edska\u0165 \u00fapln\u00fa kontrolu nad syst\u00e9mom manipul\u00e1ciou s funkciou CreateWindowEx (win32k.sys). Probl\u00e9m bol odhalen\u00fd po\u010das anal\u00fdzy \u0161kodliv\u00e9ho softv\u00e9ru, ktor\u00fd zneu\u017e\u00edval zranite\u013enos\u0165 pred jej opravou;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50130\">Zranite\u013enos\u0165<\/a><\/noindex> v runc a LXC, ovplyv\u0148uj\u00faca Docker a \u010fal\u0161ie syst\u00e9my kontajnerovej izol\u00e1cie, ktor\u00e1 umo\u017e\u0148uje z pod kontrolovan\u00e9ho zlo\u010dinca izolovan\u00e9ho kontajnera zmeni\u0165 spustite\u013en\u00fd s\u00fabor runc a z\u00edska\u0165 root opr\u00e1vnenia na strane hostite\u013esk\u00e9ho syst\u00e9mu;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.zecops.com\/vulnerabilities\/exploit-of-cve-2019-7286\/\">Zranite\u013enos\u0165<\/a><\/noindex> v iOS (CFPrefsDaemon), ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 izola\u010dn\u00e9 re\u017eimy a vykona\u0165 k\u00f3d s opr\u00e1vneniami root;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-9568\">Zranite\u013enos\u0165<\/a><\/noindex> v rev\u00edzii TCP z\u00e1sobn\u00edka Linux, pou\u017e\u00edvan\u00e9ho v Androide, umo\u017e\u0148uj\u00faca lok\u00e1lnemu u\u017e\u00edvate\u013eovi zv\u00fd\u0161i\u0165 svoje opr\u00e1vnenia na zariaden\u00ed;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49931\">Zranite\u013enosti<\/a><\/noindex> v systemd-journald, umo\u017e\u0148uj\u00face z\u00edska\u0165 pr\u00e1va root;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/usn.ubuntu.com\/4077-1\/\">Zranite\u013enos\u0165<\/a><\/noindex> v utilite tmpreaper pre \u010distenie \/tmp, umo\u017e\u0148uj\u00faca uchova\u0165 svoj s\u00fabor v akejko\u013evek \u010dasti FS;\n<\/ul>\n<li class=\"l\"> <b>Najlep\u0161ia kryptografick\u00e1 \u00fatok<\/b>. Prezentuje sa za odhalenie najv\u00fdznamnej\u0161\u00edch nedostatkov v re\u00e1lnych syst\u00e9moch, protokoloch a \u0161ifrovac\u00edch algoritmoch. Cena bola udelen\u00e1 za odhalenie <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50493\">zranite\u013enost\u00ed<\/a><\/noindex> v technol\u00f3gii ochrany bezdr\u00f4tov\u00fdch siet\u00ed WPA3 a v EAP-pwd, umo\u017e\u0148uj\u00face zrekon\u0161truova\u0165 pr\u00edstupov\u00e9 heslo a z\u00edska\u0165 pr\u00edstup k bezdr\u00f4tovej sieti bez jeho znalosti.\n<p>Kandid\u00e1tmi na z\u00edskanie ceny boli tie\u017e: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48597\">Met\u00f3da<\/a><\/noindex> \u00fatoky na \u0161ifrovanie PGP a S\/MIME v e-mailov\u00fdch klientoch;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.f-secure.com\/cold-boot-attacks\/\">Pou\u017eitie<\/a><\/noindex> met\u00f3dy studen\u00e9ho re\u0161tartu na z\u00edskanie pr\u00edstupu k obsahu \u0161ifrovan\u00fdch oddielov BitLocker;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50213\">Zranite\u013enos\u0165<\/a><\/noindex> v OpenSSL, ktor\u00e1 umo\u017e\u0148uje oddeli\u0165 situ\u00e1cie z\u00edskania nespr\u00e1vneho doplnenia a nespr\u00e1vneho MAC. Probl\u00e9m je sp\u00f4soben\u00fd nespr\u00e1vnym spracovan\u00edm nulov\u00fdch bajtov v doplnen\u00ed (padding oracle);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/sec-consult.com\/en\/blog\/2018\/11\/my-name-is-johann-wolfgang-von-goethe-i-can-prove-it\/\">Probl\u00e9my<\/a><\/noindex> s kartami identifik\u00e1cie pou\u017e\u00edvan\u00fdmi v Nemecku, ktor\u00e9 vyu\u017e\u00edvaj\u00fa SAML;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/chromium-os\/u2f-ecdsa-vulnerability\">Probl\u00e9m<\/a><\/noindex> s entropiou n\u00e1hodn\u00fdch \u010d\u00edsiel v implement\u00e1cii podpory tokenov U2F v ChromeOS;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/monocypher.org\/quality-assurance\/disclosures\">Zranite\u013enos\u0165<\/a><\/noindex> v Monocypher, kv\u00f4li ktor\u00e9mu boli uznan\u00e9 platn\u00e9 nulov\u00e9 podpisy EdDSA.\n<\/ul>\n<li class=\"l\"> <b>Najviac inovat\u00edvny v\u00fdskum.<\/b>  Cena bola udelen\u00e1 v\u00fdvoj\u00e1rovi techniky <noindex><a rel=\"nofollow\" href=\"https:\/\/gamozolabs.github.io\/fuzzing\/2018\/10\/14\/vectorized_emulation.html\">Vektorizovan\u00e1 emul\u00e1cia<\/a><\/noindex>, ktor\u00e1 pou\u017e\u00edva vektorov\u00e9 in\u0161trukcie AVX-512 na emul\u00e1ciu vykon\u00e1vania programov, pri\u010dom umo\u017e\u0148uje dosiahnu\u0165 podstatn\u00e9 zv\u00fd\u0161enie r\u00fdchlosti fuzzingov\u00e9ho testovania (a\u017e 40-120 mili\u00e1rd in\u0161trukci\u00ed za sekundu). Technika umo\u017e\u0148uje s\u00fa\u010dasn\u00e9 vykon\u00e1vanie 8 64-bitov\u00fdch alebo 16 32-bitov\u00fdch virtu\u00e1lnych strojov s in\u0161trukciami na fuzzingov\u00e9 testovanie aplik\u00e1cie na ka\u017edom CPU jadre.\n<p>Na cenu boli nominovan\u00ed: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mimecast.com\/blog\/2019\/06\/exploit-using-microsoft-excel-power-query-for-remote-dde-execution-discovered\/\">Zranite\u013enos\u0165<\/a><\/noindex> v technol\u00f3gii Power Query z MS Excel, ktor\u00e1 umo\u017e\u0148uje organizova\u0165 vykon\u00e1vanie k\u00f3du a obch\u00e1dza\u0165 met\u00f3dy izol\u00e1cie aplik\u00e1ci\u00ed pri otv\u00e1ran\u00ed \u0161peci\u00e1lne naform\u00e1tovan\u00fdch elektronick\u00fdch tabuliek;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50446\">Met\u00f3da<\/a><\/noindex> podvod autopilota automobilov Tesla na vyprovokovanie jazdy do protismeru;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/sec-consult.com\/en\/blog\/2019\/02\/reverse-engineering-architecture-pinout-plc\/\">Pr\u00e1ca<\/a><\/noindex> na reverznom in\u017einierstve \u010dipu Siemens S7-1200;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/arxiv.org\/abs\/1808.10250\">SonarSnoop<\/a><\/noindex> \u2014 technika sledovania pohybu prstov na ur\u010dovanie k\u00f3du odomknutia telef\u00f3nu, zalo\u017een\u00e1 na princ\u00edpe sonarnej pr\u00e1ce \u2014 horn\u00fd a doln\u00fd reproduktor smartf\u00f3nu generuj\u00fa nesly\u0161n\u00e9 vibr\u00e1cie, zatia\u013e \u010do vstavan\u00e9 mikrof\u00f3ny ich zachyt\u00e1vaj\u00fa na anal\u00fdzu pr\u00edtomnosti odrazen\u00fdch vibr\u00e1ci\u00ed od ruky;\n<li class=\"l\"> \t<noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50260\">V\u00fdvoj<\/a><\/noindex> v NSA n\u00e1stroja na reverzn\u00e9 in\u017einierstvo Ghidra;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/@massarelli\/safe-self-attentive-function-embedding-d80abbfea794\">SAFE<\/a><\/noindex> \u2014 technika ur\u010dovania pou\u017eitia k\u00f3du rovnak\u00fdch funkci\u00ed v nieko\u013ek\u00fdch vykonate\u013en\u00fdch s\u00faboroch na z\u00e1klade anal\u00fdzy bin\u00e1rnych zostaven\u00ed;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/vulmon.com\/vulnerabilitydetails?qid=CVE-2019-11098&#038;scoretype=cvssv2\">Vytvorenie<\/a><\/noindex> met\u00f3dy obch\u00e1dzania mechanizmu Intel Boot Guard na na\u010d\u00edtanie modifikovan\u00fdch UEFI firmware bez kontroly digit\u00e1lnym podpisom.\n<\/ul>\n<li class=\"l\"> <b>Najhl\u00fapej\u0161ia reakcia dod\u00e1vate\u013ea<\/b> (Lamest Vendor Response). Nomin\u00e1cia za najneadekv\u00e1tnej\u0161iu reakciu na ozn\u00e1menie o zranite\u013enosti vo vlastnom produkte. V\u00ed\u0165azmi sa stali v\u00fdvoj\u00e1ri kryptopen\u011b\u017eenky BitFi, ktor\u00ed hl\u00e1saj\u00fa nadmern\u00fa bezpe\u010dnos\u0165 svojho produktu, ktor\u00e1 sa v skuto\u010dnosti uk\u00e1zala by\u0165 falo\u0161nou, a vyvol\u00e1vaj\u00fa perzek\u00faciu na v\u00fdskumn\u00edkov odha\u013euj\u00facich zranite\u013enosti a nevypl\u00e1caj\u00fa s\u013e\u00faben\u00e9 ceny za odhalenie probl\u00e9mov;\n<p>Medzi nominovan\u00fdmi na cenu sa tie\u017e zva\u017eovali: <\/p>\n<ul>\n<li class=\"l\"> Bezpe\u010dnostn\u00fd v\u00fdskumn\u00edk obvinil riadite\u013ea Atrient z \u00fatoku s cie\u013eom don\u00fati\u0165 ho odstr\u00e1ni\u0165 spr\u00e1vu o zisten\u00ed zranite\u013enosti, av\u0161ak riadite\u013e incident popiera a kamerov\u00fd syst\u00e9m nezaznamenal \u017eiadny \u00fatok;\n<li class=\"l\"> Spolo\u010dnos\u0165 Zoom oddialila opravu kritickej <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/bugbountywriteup\/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5\">zranite\u013enosti<\/a><\/noindex> vo svojom syst\u00e9me konferen\u010dn\u00e9ho spojenia a probl\u00e9m opravili a\u017e po verejnom odhalen\u00ed. Zranite\u013enos\u0165 umo\u017enila extern\u00e9mu \u00fato\u010dn\u00edkovi z\u00edska\u0165 d\u00e1ta z webov\u00fdch kamier pou\u017e\u00edvate\u013eov macOS pri otvoren\u00ed \u0161peci\u00e1lne upravenej str\u00e1nky v prehliada\u010di (zoom spustil na strane klienta http-server, ktor\u00fd prij\u00edmal pr\u00edkazy z lok\u00e1lnej aplik\u00e1cie).\n<li class=\"l\"> Neschopnos\u0165 opravi\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51006\">probl\u00e9m<\/a><\/noindex> s kryptografick\u00fdmi k\u013e\u00fa\u010dov\u00fdmi servermi OpenPGP, pri\u010dom sa od\u00f4vod\u0148ovalo, \u017ee k\u00f3d je nap\u00edsan\u00fd v \u0161pecifickom jazyku OCaml a zost\u00e1va bez sprievodu.\n<\/ul>\n<p><b>Najviac prehnan\u00e9 ozn\u00e1menie o zranite\u013enosti<\/b>. Prihlasuje sa za najpatetickej\u0161ie a najrozsiahlej\u0161ie oznamovanie probl\u00e9mu na internete a v m\u00e9di\u00e1ch, najm\u00e4 ak sa na konci zranite\u013enos\u0165 uk\u00e1\u017ee ako nevyu\u017eite\u013en\u00e1 v praxi. Cenu z\u00edskal \u010dasopis Bloomberg za <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49393\">vyhl\u00e1senie<\/a><\/noindex> o odhalen\u00ed \u0161pion\u00e1\u017enych \u010dipov na dosk\u00e1ch Super Micro, ktor\u00e9 sa nepotvrdilo, a zdroj uviedol \u00faplne <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49417\">in\u00fa inform\u00e1ciu<\/a><\/noindex>.<\/p>\n<p>V nomin\u00e1cii s\u00fa uveden\u00e9: <\/p>\n<ul>\n<li class=\"l\"> Zranite\u013enos\u0165 v libssh, ktor\u00e1 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49453\">sa dot\u00fdkala<\/a><\/noindex> jednotliv\u00fdch serverov\u00fdch aplik\u00e1ci\u00ed (libssh sa takmer nepou\u017e\u00edva pre servery), ale bola prezentovan\u00e1 NCC Group ako zranite\u013enos\u0165 umo\u017e\u0148uj\u00faca \u00fato\u010di\u0165 na ka\u017ed\u00fd server OpenSSH.\n<li class=\"l\"> \u00datok s pou\u017eit\u00edm obr\u00e1zkov vo form\u00e1te DICOM. Podstata spo\u010d\u00edva v tom, \u017ee je mo\u017en\u00e9 pripravi\u0165 spustite\u013en\u00fd s\u00fabor pre Windows, ktor\u00fd bude vyzera\u0165 ako platn\u00fd obr\u00e1zok vo form\u00e1te DICOM. Tento s\u00fabor je mo\u017en\u00e9 nahra\u0165 na medic\u00ednske zariadenie a spusti\u0165 ho.\n<li class=\"l\"> Zranite\u013enos\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/thrangrycat.com\/\">Thrangrycat<\/a><\/noindex>, umo\u017e\u0148uj\u00faca ob\u00eds\u0165 mechanizmus bezpe\u010dn\u00e9ho spustenia na zariadeniach Cisco. Zranite\u013enos\u0165 bola zaraden\u00e1 do kateg\u00f3rie prehnan\u00fdch probl\u00e9mov, preto\u017ee na \u00fatok vy\u017eaduje pr\u00e1va root, ale ak \u00fato\u010dn\u00edk u\u017e dok\u00e1zal z\u00edska\u0165 pr\u00edstup root, ak\u00e1 bezpe\u010dnos\u0165 m\u00f4\u017ee by\u0165 re\u010d.\n<\/ul>\n<li class=\"l\"> <b>Najv\u00e4\u010d\u0161\u00ed debakel<\/b> (Most Epic FAIL). V\u00ed\u0165azstvo bolo pridelen\u00e9 vydaniu Bloomberg za s\u00e9riu senza\u010dn\u00fdch \u010dl\u00e1nkov s bur\u00e1caj\u00facimi nadpismi, ale vymyslen\u00fdmi faktami, zaml\u010dan\u00edm zdrojov, prechodom na te\u00f3rie sprisahania, pou\u017e\u00edvan\u00edm tak\u00fdch term\u00ednov ako \u201ekyberzbra\u0148\u201c a nepr\u00edpustn\u00fdmi generaliz\u00e1ciami. Medzi ostatn\u00fdmi nominantmi:\n<ul>\n<li class=\"l\"> \u00datok Shadowhammer na slu\u017ebu aktualiz\u00e1cie firmv\u00e9ru Asus;\n<li class=\"l\"> Hackovanie \u00falo\u017eiska BitFi, propagovan\u00e9ho ako \u201eneprelomite\u013en\u00e9\u201c;\n<li class=\"l\"> \u00daniky osobn\u00fdch \u00fadajov a <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49366\">tokenov<\/a><\/noindex> pr\u00edstupu na Facebook.\n<\/ul>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Zdroj: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51267\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie Awards 2019, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u044b \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0430\u0431\u0441\u0443\u0440\u0434\u043d\u044b\u0435 \u043f\u0440\u043e\u0432\u0430\u043b\u044b \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. Pwnie Awards \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0430\u043d\u0430\u043b\u043e\u0433\u043e\u043c \u041e\u0441\u043a\u0430\u0440\u0430 \u0438 \u0417\u043e\u043b\u043e\u0442\u043e\u0439 \u043c\u0430\u043b\u0438\u043d\u044b \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0435\u0436\u0435\u0433\u043e\u0434\u043d\u043e, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2007 \u0433\u043e\u0434\u0430. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0431\u0435\u0434\u0438\u0442\u0435\u043b\u0438 \u0438 \u043d\u043e\u043c\u0438\u043d\u0430\u0446\u0438\u0438: \u041b\u0443\u0447\u0448\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u0430\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37054","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Pwnie Awards 2019: \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0432\u0430\u043b\u044b \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:30+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pwnie Awards 2019: najv\u00fdznamnej\u0161ie zranite\u013enosti a bezpe\u010dnostn\u00e9 zlyhania | ProHoster","description":"Na ned\u00e1vnej konferencii Black Hat USA v Las Vegas sa konala cerem\u00f3nia odovzd\u00e1vania ocenenia Pwnie.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Pwnie Awards 2019: \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0432\u0430\u043b\u044b \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:30+00:00","article:modified_time":"2019-10-31T19:15:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37054","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:53:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:34:24","updated":"2026-01-22 05:53:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/37054","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=37054"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/37054\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=37054"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=37054"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=37054"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}