{"id":91733,"date":"2020-08-17T19:42:21","date_gmt":"2020-08-17T17:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip"},"modified":"2020-08-17T19:42:21","modified_gmt":"2020-08-17T17:42:21","slug":"doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","title":{"rendered":"Spr\u00e1va bezpe\u010dnostn\u00e9ho v\u00fdboru Tor: \u0161kodliv\u00e9 v\u00fdstupn\u00e9 uzly pou\u017e\u00edvali sslstrip.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"


\n \"Spr\u00e1va<\/p>\n

<\/a><\/p>\n

<\/p>\n

Podstata udalosti<\/b><\/p>\n

V m\u00e1ji 2020 bola objaven\u00e1 skupina v\u00fdstupn\u00fdch uzlov, ktor\u00e9 zasahovali do odch\u00e1dzaj\u00facich pripojen\u00ed. Konkr\u00e9tne nech\u00e1vali takmer v\u0161etky pripojenia nedotknut\u00e9, ale zachyt\u00e1vali pripojenia k mal\u00e9mu po\u010dtu kryptomenov\u00fdch b\u00farz. Ak pou\u017e\u00edvatelia nav\u0161t\u00edvili HTTP verziu webovej str\u00e1nky (t. j. neza\u0161ifrovan\u00fa a neautentifikovan\u00fa), \u0161kodliv\u00e9 uzly br\u00e1nili presmerovaniu na HTTPS verziu (t. j. za\u0161ifrovan\u00fa a autentifikovan\u00fa). Ak si pou\u017e\u00edvate\u013e nev\u0161imol v\u00fdmenu (napr\u00edklad absenciu ikony z\u00e1mku v prehliada\u010di) a za\u010dal zasiela\u0165 d\u00f4le\u017eit\u00e9 inform\u00e1cie, tieto inform\u00e1cie mohli by\u0165 zachyten\u00e9 \u00fato\u010dn\u00edkom.<\/p>\n

Projekt Tor vyl\u00fa\u010dil tieto uzly z siete v m\u00e1ji 2020. V j\u00fali 2020 bola objaven\u00e1 \u010fal\u0161ia skupina retransl\u00e1ci\u00ed, ktor\u00e1 vykon\u00e1vala podobn\u00fd \u00fatok, po \u010dom boli taktie\u017e vyl\u00fa\u010den\u00e9. Doteraz nie je jasn\u00e9, \u010di boli \u00faspe\u0161ne napadnut\u00ed nejak\u00ed pou\u017e\u00edvatelia, ale vzh\u013eadom na rozsah \u00fatoku a fakt, \u017ee \u00fato\u010dn\u00edk opakoval pokus (prv\u00fd pr\u00edpad sa dotkol 23% s\u00fahrnnej priepustnosti v\u00fdstupn\u00fdch uzlov, druh\u00fd - pribli\u017ene 19%), je rozumn\u00e9 predpoklada\u0165, \u017ee \u00fato\u010dn\u00edk pova\u017eoval n\u00e1klady na \u00fatok za opr\u00e1vnen\u00e9.<\/p>\n

Tento incident je dobr\u00e9 pripomenutie, \u017ee HTTP po\u017eiadavky nie s\u00fa \u0161ifrovan\u00e9 a neautentifikovan\u00e9, a preto s\u00fa st\u00e1le zranite\u013en\u00e9. Tor Browser m\u00e1 v s\u00faprave roz\u0161\u00edrenie HTTPS-Everywhere, \u0161peci\u00e1lne navrhnut\u00e9 na zabr\u00e1nenie podobn\u00fdm \u00fatokom, av\u0161ak jeho \u00fa\u010dinnos\u0165 je obmedzen\u00e1 zoznamom, ktor\u00fd nepokr\u00fdva v\u0161etky webov\u00e9 str\u00e1nky na svete. Pou\u017e\u00edvatelia pri n\u00e1v\u0161teve HTTP verzi\u00ed str\u00e1nok bud\u00fa v\u017edy ohrozen\u00ed.<\/p>\n

Prevencia podobn\u00fdch \u00fatokov v bud\u00facnosti<\/b><\/p>\n

Sp\u00f4soby prevencie \u00fatokov sa delia na dve \u010dasti: prv\u00e1 zah\u0155\u0148a opatrenia, ktor\u00e9 m\u00f4\u017eu podnikn\u00fa\u0165 pou\u017e\u00edvatelia a administr\u00e1tori str\u00e1nok na posilnenie svojej bezpe\u010dnosti, zatia\u013e \u010do druh\u00e1 sa t\u00fdka identifik\u00e1cie a v\u010dasn\u00e9ho odhalenia \u0161kodliv\u00fdch uzlov v sieti.<\/p>\n

Odpor\u00fa\u010dan\u00e9 akcie zo strany str\u00e1nok: <\/p>\n

1. Zapnutie HTTPS (bezpe\u010dn\u00e9 certifik\u00e1ty poskytuje Let’s Encrypt<\/a>) <\/p>\n

<\/noindex><\/p>\n

2. Pridanie pravidiel pre presmerovanie do zoznamu HTTPS-Everywhere, aby pou\u017e\u00edvatelia mohli prevent\u00edvne vytvori\u0165 zabezpe\u010den\u00e9 spojenie a nemuseli sa spolieha\u0165 na presmerovanie po nadviazan\u00ed nezabezpe\u010den\u00e9ho spojenia. Okrem toho, ak spr\u00e1va webov\u00fdch slu\u017eieb chce \u00faplne zabr\u00e1ni\u0165 interakcii s v\u00fdstupn\u00fdmi uzlami, m\u00f4\u017ee poskytn\u00fa\u0165 onion-verziu str\u00e1nky<\/a>.<\/p>\n

<\/noindex><\/p>\n

Moment\u00e1lne projekt Tor zva\u017euje \u00fapln\u00e9 vypnutie nezabezpe\u010den\u00e9ho HTTP v Tor Browseri. Pred nieko\u013ek\u00fdmi rokmi by tak\u00e1to opatrenie bola nemyslite\u013en\u00e1 (pr\u00edli\u0161 ve\u013ea zdrojov malo len nezabezpe\u010den\u00e9 HTTP), av\u0161ak HTTPS-Everywhere a nadch\u00e1dzaj\u00faca verzia Firefoxu maj\u00fa experiment\u00e1lnu mo\u017enos\u0165 pou\u017e\u00edva\u0165 HTTPS ako predvolen\u00e9 pre prv\u00e9 spojenie, s mo\u017enos\u0165ou vr\u00e1ti\u0165 sa sp\u00e4\u0165 k HTTP, ak je to nevyhnutn\u00e9. Je st\u00e1le nejasn\u00e9, ako tak\u00fdto pr\u00edstup ovplyvn\u00ed pou\u017e\u00edvate\u013eov Tor Browsera, preto bude najprv sk\u00fa\u0161an\u00fd na vy\u0161\u0161\u00edch \u00farovniach bezpe\u010dnosti prehliada\u010da (ikona \u0161t\u00edtu).<\/p>\n

Z h\u013eadiska siete Tor s\u00fa dobrovo\u013en\u00edci, ktor\u00ed sleduj\u00fa spr\u00e1vanie retransl\u00e1ci\u00ed a hl\u00e1sia incidenty, v\u010faka \u010domu m\u00f4\u017eu by\u0165 \u0161kodliv\u00e9 uzly vyl\u00fa\u010den\u00e9 kore\u0148ov\u00fdmi servermi katal\u00f3gov. Hoci tieto hl\u00e1senia s\u00fa zvy\u010dajne posudzovan\u00e9 r\u00fdchlo a \u0161kodliv\u00e9 uzly s\u00fa vypnut\u00e9 okam\u017eite po zisten\u00ed, prostriedkov na trval\u00e9 sledovanie siete nie je dostatok. Ak sa v\u00e1m podarilo objavi\u0165 \u0161kodliv\u00fd retransl\u00e1tor - m\u00f4\u017eete to nahl\u00e1si\u0165 projektu, n\u00e1vod je dostupn\u00fd na tomto odkaze<\/a>.<\/p>\n

<\/noindex><\/p>\n

Aktu\u00e1lny pr\u00edstup m\u00e1 dva z\u00e1kladn\u00e9 probl\u00e9my: <\/p>\n

1. Pri posudzovan\u00ed nezn\u00e1meho retransl\u00e1tora je \u0165a\u017ek\u00e9 dok\u00e1za\u0165 jeho \u0161kodlivos\u0165. Ak neboli pozorovan\u00e9 \u00fatoky z jeho strany, m\u00e1 sa necha\u0165 na mieste? Hromadn\u00e9 \u00fatoky, ktor\u00e9 zasahuj\u00fa mnoh\u00fdch pou\u017e\u00edvate\u013eov, sa \u013eah\u0161ie odha\u013euj\u00fa, ale ak \u00fatoky zasahuj\u00fa len mal\u00e9 mno\u017estvo str\u00e1nok a pou\u017e\u00edvate\u013eov, \u00fato\u010dn\u00edk m\u00f4\u017ee kona\u0165 proakt\u00edvne<\/a>. Samotn\u00e1 sie\u0165 Tor pozost\u00e1va z tis\u00edcov retransl\u00e1ci\u00ed rozmiestnen\u00fdch po celom svete a podobn\u00e1 rozmanitos\u0165 (a z nej vypl\u00fdvaj\u00faca decentraliz\u00e1cia) je jednou z jej siln\u00fdch str\u00e1nok. <\/p>\n

<\/noindex><\/p>\n

2. Pri posudzovan\u00ed skupiny nezn\u00e1mych retransl\u00e1torov je \u0165a\u017ek\u00e9 dok\u00e1za\u0165 ich vz\u00e1jomn\u00fa prepojenos\u0165 (to znamen\u00e1, robia \u00fatok Sybil<\/a>). Mnoh\u00ed dobrovo\u013en\u00ed oper\u00e1tori retransl\u00e1torov si vyberaj\u00fa tie ist\u00e9 lacn\u00e9 siete na umiestnenie, ako Hetzner, OVH, Online, Frantech, Leaseweb a pod., a ak sa objav\u00ed nieko\u013eko nov\u00fdch retransl\u00e1torov, bude \u0165a\u017ek\u00e9 jednozna\u010dne predpoklada\u0165, \u010di sa objavilo nieko\u013eko nov\u00fdch oper\u00e1torov alebo len jeden, ktor\u00fd ovl\u00e1da v\u0161etk\u00fdch nov\u00fdch retransl\u00e1ci\u00ed.<\/p>\n

<\/noindex><\/noindex><\/p>\n

Zdroj: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u0412 \u043c\u0430\u0435 2020 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432, \u0432\u043c\u0435\u0448\u0438\u0432\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043e\u043d\u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0438 \u043d\u0435\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043d\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u043b\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u043c\u0443 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0443 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043d\u044b\u0445 \u0431\u0438\u0440\u0436. \u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0441\u0435\u0449\u0430\u043b\u0438 HTTP-\u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 (\u0442.\u0435. \u043d\u0435\u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e), \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0443\u0437\u043b\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 HTTPS-\u0432\u0435\u0440\u0441\u0438\u044e (\u0442.\u0435. \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e). \u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u0437\u0430\u043c\u0435\u0447\u0430\u043b \u043f\u043e\u0434\u043c\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91734,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91733","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Spr\u00e1va rady bezpe\u010dnosti Tor: \u0161kodliv\u00e9 v\u00fdstupn\u00e9 uzly pou\u017eili sslstrip. | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043a\u043b\u0430\u0434 \u0441\u043e\u0432\u0435\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Tor: \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435 \u0443\u0437\u043b\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 sslstrip. | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-17T17:42:21+00:00","article:modified_time":"2020-08-17T17:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91733","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:22:22","updated":"2022-10-05 06:28:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/91733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=91733"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/91733\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/91734"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=91733"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=91733"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=91733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}