{"id":105525,"date":"2022-11-11T21:36:51","date_gmt":"2022-11-11T19:36:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-android-pozvolyayushhaya-obojti-blokirovku-ekrana"},"modified":"2022-11-11T21:36:51","modified_gmt":"2022-11-11T19:36:51","slug":"uyazvimost-v-android-pozvolyayushhaya-obojti-blokirovku-ekrana","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-android-pozvolyayushhaya-obojti-blokirovku-ekrana","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb Android, e cila lejon anashkalimin e bllokimit t\u00eb ekranit.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb platform\u00ebn Android \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2022-20465), i cili lejon \u00e7aktivizimin e bllokimit t\u00eb ekranit p\u00ebrmes rind\u00ebrritjes s\u00eb SIM kartel\u00ebs dhe shkrimit t\u00eb kodit PUK. Mund\u00ebsia e \u00e7aktivizimit \u00ebsht\u00eb demonstruar n\u00eb pajisjet Google Pixel, por pasi rregullimi prek baz\u00ebn e kodit t\u00eb Android, \u00ebsht\u00eb e mundur q\u00eb problemi t\u00eb preki edhe firmware-t nga prodhues t\u00eb tjer\u00eb. Problemi \u00ebsht\u00eb zgjidhur n\u00eb paket\u00ebn e rregullimeve t\u00eb n\u00ebntorit p\u00ebr \u00e7\u00ebshtjet e siguris\u00eb p\u00ebr Android. K\u00ebrkuesi q\u00eb vuri re problemin mori nj\u00eb shp\u00ebrblim prej 70 mij\u00eb dollar\u00ebsh nga kompanin\u00eb Google. <\/p>\n

Problemi shkaktohet nga p\u00ebrpunimi i gabuar i \u00e7eljes pas shkrimit t\u00eb kodit PUK (Personal Unblocking Key), i cili p\u00ebrdoret p\u00ebr t\u00eb rikthyer funksionalitetin e SIM kartel\u00ebs, e cila ishte bllokuar pas shum\u00eb tentativave t\u00eb gabuara p\u00ebr t\u00eb futur PIN-in. P\u00ebr t\u00eb \u00e7aktivizuar bllokimin e ekranit, mjafton t\u00eb vendosni SIM kartel\u00ebn tuaj n\u00eb telefon, e cila ka nj\u00eb mbrojtje t\u00eb bazuar n\u00eb PIN. Pas nd\u00ebrrimit t\u00eb SIM kartel\u00ebs me mbrojtje PIN, n\u00eb ekran fillimisht shfaqet k\u00ebrkesa p\u00ebr PIN. N\u00ebse futet gabim tre her\u00eb PIN-i, SIM kartela do t\u00eb bllokohet, pas s\u00eb cil\u00ebs do t\u00eb ofrohet mund\u00ebsia p\u00ebr t\u00eb shkruar kodin PUK p\u00ebr rikthim. Doli se futja e sakt\u00eb e kodit PUK jo vet\u00ebm q\u00eb \u00e7liron SIM kartel\u00ebn, por \u00e7on n\u00eb kalimin n\u00eb nd\u00ebrfaqen kryesore duke anashkaluar ruajt\u00ebsin e ekranit, pa k\u00ebrkuar konfirmim t\u00eb aksesit me fjal\u00ebkalimin kryesor ose \u00e7el\u00ebsin grafik.

\r\n \"Luaj\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Vulnerabiliteti shkaktohet nga nj\u00eb gabim n\u00eb logjik\u00ebn e kontrollit t\u00eb kodit PUK n\u00eb menaxherin KeyguardSimPukViewController, i cili \u00ebsht\u00eb p\u00ebrgjegj\u00ebs p\u00ebr shfaqjen e ekranit t\u00eb shtes\u00ebs s\u00eb autentifikimit. N\u00eb Android p\u00ebrdoren disa lloje ekranesh autentifikimi (p\u00ebr PIN, PUK, fjal\u00ebkalim, \u00e7el\u00ebs grafik, autentifikim biometrik) dhe k\u00ebta ekrane thirren nj\u00ebri pas tjetrit kur k\u00ebrkohen disa kontrolla, p\u00ebr shembull, kur k\u00ebrkohet PIN-i dhe \u00e7el\u00ebsi grafik. <\/p>\n

Kur p\u00ebrfshihet n\u00eb m\u00ebnyr\u00eb korrekte kodin PIN, aktivizohet faza e dyt\u00eb e verifikimit, e cila k\u00ebrkon hyrjen e kodit t\u00eb p\u00ebrgjithsh\u00ebm t\u00eb \u00e7eljes, por kur futet kodi PUK, nj\u00eb faz\u00eb e till\u00eb bootimi anashkalohet dhe aksesit i jepet pa k\u00ebrkuar fjal\u00ebkalimin kryesor ose \u00e7el\u00ebsin grafik. Anashkalimi i faz\u00ebs s\u00eb ardhshme t\u00eb \u00e7eljes b\u00ebhet pasi kur thirret KeyguardSecurityContainerController#dismiss(), nuk b\u00ebhet krahasimi i metod\u00ebs s\u00eb pritur dhe metod\u00ebs s\u00eb kaluar t\u00eb verifikimit, dmth. procesori mendon se nuk ka ndodhur nd\u00ebrrimi i metod\u00ebs s\u00eb verifikimit dhe p\u00ebrfundimi i verifikimit t\u00eb kodit PUK tregon se autorizimi \u00ebsht\u00eb konfirmuar me sukses. <\/p>\n

Vulnerabiliteti u zbulua rast\u00ebsisht \u2014 p\u00ebrdoruesi iu shkarkua telefoni dhe pas karikimit dhe ndezjes ai gaboi disa her\u00eb gjat\u00eb hyrjes s\u00eb PIN-it, pas t\u00eb cil\u00ebs hoqi bllokimin me kodin PUK dhe u habit q\u00eb sistemi nuk k\u00ebrkoi fjal\u00ebkalimin kryesor, i p\u00ebrdorur p\u00ebr t\u00eb dekriptuar t\u00eb dh\u00ebnat, pas s\u00eb cil\u00ebs u ngrit me mesazhin \"Pixel \u00ebsht\u00eb duke u nisur...\". P\u00ebrdoruesi doli t\u00eb ishte i kujdessh\u00ebm, vendosi t\u00eb kuptonte se \u00e7far\u00eb po ndodhte dhe filloi t\u00eb eksperimentonte me metoda t\u00eb ndryshme t\u00eb hyrjes s\u00eb kodit PIN dhe PUK, derisa rast\u00ebsisht harroi t\u00eb riniste pajisjen pas nd\u00ebrrimit t\u00eb kart\u00ebs SIM dhe mori n\u00eb vend t\u00eb ngritjes akses n\u00eb mjedis. <\/p>\n

Reagimi i Google ndaj raportit p\u00ebr dob\u00ebsin\u00eb \u00ebsht\u00eb ve\u00e7an\u00ebrisht interesant. Informacioni mbi problemin u d\u00ebrgua n\u00eb qershor, por deri n\u00eb shtator, hulumtuesi nuk arriti t\u00eb merrte nj\u00eb p\u00ebrgjigje t\u00eb kuptueshme. Ai mendoi se nj\u00eb sjellje e till\u00eb shpjegohet nga fakti se ai nuk ishte i pari q\u00eb raportoi k\u00ebt\u00eb gabim. Dyshimet se di\u00e7ka po shkon keq u shfaq\u00ebn n\u00eb shtator, kur problemi mbeti i pazbuluar pas instalimit t\u00eb nj\u00eb azhurnimi, i cili u l\u00ebshua pas 90 dit\u00ebve, kur ndodhi q\u00eb periudha e shpallur e mos-shpalljes ishte p\u00ebrfunduar. <\/p>\n

Pasi q\u00eb p\u00ebrpjekjet p\u00ebr t\u00eb m\u00ebsuar statusin e mesazhit t\u00eb d\u00ebrguar mbi probleme ishin t\u00eb pashpres\u00eb dhe p\u00ebrfunduan me p\u00ebrgjigje automatike dhe shabllone, hulumtuesi p\u00ebrpiqi t\u00eb lidhej personalisht me punonj\u00ebsit e Google p\u00ebr t\u00eb sqaruar situat\u00ebn mbi p\u00ebrgatitjen e nj\u00eb rregullimi dhe madje demonstroi dob\u00ebsin\u00eb n\u00eb zyr\u00ebn e Google n\u00eb Lond\u00ebr. Vet\u00ebm pas k\u00ebsaj, puna p\u00ebr t\u00eb eliminuar dob\u00ebsin\u00eb mori nj\u00eb hov. Gjat\u00eb shqyrtimit doli se dikush kishte raportuar m\u00eb par\u00eb p\u00ebr problemin, por Google vendosi t\u00eb b\u00ebnte nj\u00eb p\u00ebrjashtim dhe t\u00eb paguante shp\u00ebrblimin p\u00ebr raportimin e dyt\u00eb t\u00eb problemit, pasi fal\u00eb insistenc\u00ebs s\u00eb autorit t\u00eb tij, problemi u vuri n\u00eb dukje.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Android \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-20465), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u044d\u043a\u0440\u0430\u043d\u0430 \u043f\u0443\u0442\u0451\u043c \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 SIM-\u043a\u0430\u0440\u0442\u044b \u0438 \u0432\u0432\u043e\u0434\u0430 PUK-\u043a\u043e\u0434\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Google Pixel, \u043d\u043e \u0442\u0430\u043a \u043a\u0430\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 Android, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f \u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a \u043e\u0442 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u043c \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0434\u043b\u044f Android. \u041e\u0431\u0440\u0430\u0442\u0438\u0432\u0448\u0438\u0439 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105525","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia n\u00eb Android q\u00eb lejon anashkalimin e bllokimit t\u00eb ekranit | ProHoster","description":"N\u00eb platform\u00ebn Android \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi (CVE-2022-20465), e cila lejon \u00e7aktivizimin e bllokimit t\u00eb ekranit duke rregulluar kart\u00ebn SIM dhe duke futur kodin PUK.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-android-pozvolyayushhaya-obojti-blokirovku-ekrana","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u044d\u043a\u0440\u0430\u043d\u0430 | ProHoster","og:description":"\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Android \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-20465), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u044d\u043a\u0440\u0430\u043d\u0430 \u043f\u0443\u0442\u0451\u043c \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 SIM-\u043a\u0430\u0440\u0442\u044b \u0438 \u0432\u0432\u043e\u0434\u0430 PUK-\u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-android-pozvolyayushhaya-obojti-blokirovku-ekrana","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-11T19:36:51+00:00","article:modified_time":"2022-11-11T19:36:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/105525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=105525"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/105525\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=105525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=105525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=105525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}