{"id":145046,"date":"2025-10-14T11:12:25","date_gmt":"2025-10-14T09:12:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-pixnapping-opredelyayushhaya-soderzhimoe-ekrana-dlya-perehvata-2fa-kodov-v-android"},"modified":"2025-10-14T11:12:25","modified_gmt":"2025-10-14T09:12:26","slug":"ataka-pixnapping-opredelyayushhaya-soderzhimoe-ekrana-dlya-perehvata-2fa-kodov-v-android","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-pixnapping-opredelyayushhaya-soderzhimoe-ekrana-dlya-perehvata-2fa-kodov-v-android","title":{"rendered":"Sulmi Pixnapping, q\u00eb p\u00ebrcakton p\u00ebrmbajtjen e ekranit p\u00ebr kapjen e kod\u00ebve 2FA n\u00eb Android","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb grup k\u00ebrkuesish nga kat\u00ebr universitete amerikane krijuan nj\u00eb teknike sulmi t\u00eb quajtur Pixnapping (CVE-2025-48561), e cila lejon aplikacioneve Android t\u00eb pa privilegjuara, t\u00eb cilat nuk k\u00ebrkojn\u00eb t\u00eb drejta shtes\u00eb, t\u00eb identifikojn\u00eb p\u00ebrmbajtjen q\u00eb shfaqet n\u00eb ekran nga aplikacione t\u00eb tjera. Si shembull i p\u00ebrdorimit praktik t\u00eb sulmit, \u00ebsht\u00eb demonstruar identifikimi i kodeve t\u00eb autentikimit dyfaktor q\u00eb shfaqen nga aplikacioni Google Authenticator. Po ashtu \u00ebsht\u00eb treguar si mund t\u00eb aplikohet sulmi p\u00ebr t\u00eb nxjerr\u00eb t\u00eb dh\u00ebna t\u00eb ndjeshme q\u00eb shfaqen n\u00eb ekran gjat\u00eb p\u00ebrdorimit t\u00eb Gmail, Signal, Venmo dhe Google Maps. <\/p>\n

P\u00ebr t\u00eb identifikuar p\u00ebrmbajtjen e ekranit \u00ebsht\u00eb p\u00ebrdorur metoda e analiz\u00ebs pixel pas pixel, e realizuar n\u00eb vitin 2023 nga e nj\u00ebjta ekip k\u00ebrkuesish n\u00eb sulmin p\u00ebr kanalet an\u00ebsore GPU.zip dhe p\u00ebr her\u00eb t\u00eb par\u00eb e p\u00ebrshkruar n\u00eb vitin 2013. Q\u00ebllimi i metod\u00ebs \u00ebsht\u00eb q\u00eb p\u00ebr shkak t\u00eb optimizimeve q\u00eb jan\u00eb t\u00eb pranishme n\u00eb GPU, vizatimi i pixel-it me ngjyr\u00eb q\u00eb p\u00ebrs\u00ebrit ngjyr\u00ebn e shfaqur tashm\u00eb n\u00eb ekran, b\u00ebhet m\u00eb shpejt se sa pixel-i me ngjyr\u00eb tjet\u00ebr. Duke vler\u00ebsuar ndryshimin n\u00eb koh\u00ebn e vizatimit t\u00eb pixel-\u00ebve, mund t\u00eb rikrijohet p\u00ebrmbajtja e pranishme tashm\u00eb n\u00eb ekran dhe t\u00eb formohet nj\u00eb imazh i ngjash\u00ebm me nj\u00eb screenshot. <\/p>\n

Sulmi Pixnapping konsiston n\u00eb thirrjen e aplikacionit t\u00eb synuar, duke renditur mbi t\u00eb dritaren e saj dhe duke b\u00ebr\u00eb nj\u00eb analiz\u00eb piksel-piksel t\u00eb p\u00ebrmbajtjes me analizimin e koh\u00ebs s\u00eb ekzekutimit t\u00eb operacioneve grafike p\u00ebr secilin piksel. Kjo analiz\u00eb lejon me nj\u00eb probabilitet t\u00eb lart\u00eb t\u00eb p\u00ebrcaktoj\u00eb se cilat piksel kan\u00eb ngjyr\u00eb t\u00eb bardh\u00eb sfondi dhe cilat marrin pjes\u00eb n\u00eb shfaqjen e simboleve. P\u00ebr t\u00eb fshehur manipulimet me pikselet nga p\u00ebrdoruesi, vendosen shtresa me maska \u2014 gjat\u00eb sulmit, vizualisht n\u00eb ekran vazhdon t\u00eb shfaqet p\u00ebrmbajtja e dritares s\u00eb aplikacionit nga e cila b\u00ebhet sulmi. <\/p>\n

P\u00ebr t\u00eb aktivizuar aplikacionin e sulmuar dhe p\u00ebr t\u00eb sjell\u00eb pixel-at nga dritarja e tij n\u00eb tubin e vizatimit, b\u00ebhet nd\u00ebrrimi midis aktiviteteve Android n\u00ebp\u00ebrmjet k\u00ebrkesave intent. Mbi dritaren e aplikacionit t\u00eb sulmuar shfaqen dritare poliprezente, t\u00eb cilat dallojn\u00eb pixel-at e ve\u00e7ant\u00eb dhe nxisin ekzekutimin e operacioneve grafike me ta n\u00ebp\u00ebrmjet API Window Blurs. P\u00ebr t\u00eb matur koh\u00ebn e sakt\u00eb t\u00eb vizatimit t\u00eb pixel-\u00ebve, p\u00ebrdoren thirrje callback t\u00eb lidhura me VSync.

\"Sulmi<\/center> <\/p>\n

Kufizimi i metod\u00ebs s\u00eb propozuar m\u00eb par\u00eb GPU.zip ishte performanca e ul\u00ebt \u2014 gjat\u00eb sulmit n\u00eb shfletuesin, p\u00ebrcaktimi i emrit me t\u00eb cilin p\u00ebrdoruesi kishte hyr\u00eb n\u00eb Wikipedia n\u00eb nj\u00eb sked\u00eb tjet\u00ebr k\u00ebrkonte 30 minuta n\u00eb GPU AMD Ryzen 7 4800U dhe 215 minuta n\u00eb GPU Intel i7-8700 me nj\u00eb sakt\u00ebsi prej 97-98%. P\u00ebr t\u00eb p\u00ebrmbushur intervalin e azhurnimit prej 30 sekondash n\u00eb Google Authenticator, metoda u p\u00ebrmir\u00ebsua dhe u optimizua. Numri i kontrollimeve p\u00ebr secilin piksel u reduktua nga 64 n\u00eb 16, dhe vonesa midis p\u00ebrpunimit t\u00eb pikseve u ul nga 1.5 sekonda n\u00eb 70 milisekonda. Skanime u kryen vet\u00ebm n\u00eb zon\u00ebn ku Google Authenticator tregon kodin, dhe jo n\u00eb t\u00eb gjith\u00eb ekranin. <\/p>\n

Metoda u provua n\u00eb smartphones Pixel 6, 7, 8 dhe 9 me versionet Android 13-16 p\u00ebr t\u00eb p\u00ebrcaktuar nj\u00ebqind kodet gjasht\u00ebshifrore t\u00eb autentikimit me dy faktor\u00eb, t\u00eb gjeneruara n\u00eb Google Authenticator. Sakt\u00ebsia e p\u00ebrcaktimit t\u00eb kodave n\u00eb smartphone-t e sh\u00ebnuar ishte 73%, 53%, 29% dhe 53%, dhe koha e p\u00ebrcaktimit ishte 14.3, 25.8, 24.9 dhe 25.3 sekonda, p\u00ebrkat\u00ebsisht. N\u00eb smartphone-n Samsung Galaxy S25, hulumtuesit nuk arrit\u00ebn t\u00eb p\u00ebrfshihen n\u00eb intervalin 30-sekond\u00ebsh p\u00ebr shkak t\u00eb zhurm\u00ebs q\u00eb shkakton puna e aplikacioneve t\u00eb tjera, por n\u00eb pajisje u treguan variante sulmesh p\u00ebr aplikacione t\u00eb tjera p\u00ebr t\u00eb cilat nuk kishte kufizime kohe. Mekanizmat e p\u00ebrdorur n\u00eb sulm nuk jan\u00eb specifik\u00eb p\u00ebr modelet e ve\u00e7anta t\u00eb smartphone-ve dhe sulmi potencialisht prek \u00e7do pajisje Android.