{"id":33247,"date":"2019-10-31T21:51:34","date_gmt":"2019-10-31T18:51:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/reliz-wordpress-5-2-s-podderzhkoj-proverki-obnovlenij-po-tsifrovoj-podpisi\/"},"modified":"2019-10-31T21:51:34","modified_gmt":"2019-10-31T18:51:34","slug":"reliz-wordpress-5-2-s-podderzhkoj-proverki-obnovlenij-po-tsifrovoj-podpisi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/reliz-wordpress-5-2-s-podderzhkoj-proverki-obnovlenij-po-tsifrovoj-podpisi","title":{"rendered":"L\u00ebshimi i WordPress 5.2 me mb\u00ebshtetje p\u00ebr verifikimin e azhurnimeve me n\u00ebnshkrim digjital","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Presented<\/a><\/noindex> lanso i sistemit t\u00eb menaxhimit t\u00eb p\u00ebrmbajtjes web WordPress 5.2<\/a><\/noindex>. Ky\u00e7imi ve r\u00ebnd\u00ebsis\u00eb i epopes\u00eb gjasht\u00ebvje\u00e7are<\/a><\/noindex> p\u00ebr realizimin mund\u00ebsit\u00eb<\/a><\/noindex> e kontrollit t\u00eb p\u00ebrdit\u00ebsimeve dhe degradimeve p\u00ebrmes n\u00ebnshkrimit digjital. <\/p>\n

Derisa deri tani, kur instalohej p\u00ebrdit\u00ebsimi n\u00eb WordPress, faktori kryesor i sigur\u3057t\u00eb ishte besimi n\u00eb infrastruktur\u00ebn dhe server\u00ebt e WordPress-it (pas ngarkimit, kryhej verifikimi i hash-it pa verifikimin e burimit). N\u00eb rast t\u00eb kompromitimit t\u00eb server\u00ebve t\u00eb projektit, sulmuesit kishin mund\u00ebsin\u00eb p\u00ebr t\u00eb z\u00ebvend\u00ebsuar p\u00ebrdit\u00ebsimin dhe p\u00ebr t\u00eb shp\u00ebrndar\u00eb kodin e d\u00ebmsh\u00ebm n\u00eb mes t\u00eb faqeve t\u00eb internetit q\u00eb p\u00ebrdorin sistemin e instalimit automatik t\u00eb p\u00ebrdit\u00ebsimeve. Sipas modelit t\u00eb dor\u00ebzimit t\u00eb besuesh\u00ebm t\u00eb aplikosur m\u00eb par\u00eb, n\u00eb an\u00ebn e p\u00ebrdoruesve, nj\u00eb z\u00ebvend\u00ebsim i till\u00eb do t\u00eb kishte mbetur i paevituar. <\/p>\n

Duke marr\u00eb n\u00eb konsiderat\u00eb se sipas t\u00eb dh\u00ebnave<\/a><\/noindex> projektit w3techs, plataform\u00eb WordPress p\u00ebrdoret n\u00eb 33.8% t\u00eb faqeve n\u00eb rrjet, incidenti do t\u00eb kishte marr\u00eb p\u00ebrmasa katastrofike. Nd\u00ebrkoh\u00eb, rreziku i kompromitimit t\u00eb infrastruktur\u00ebs nuk ishte hipotetik, por mjaft real. P\u00ebr shembull, disa vjet m\u00eb par\u00eb nj\u00eb nga hulumtuesit e siguris\u00eb demonstronte<\/a><\/noindex> nj\u00eb dob\u00ebsi q\u00eb lejonte sulmuesin t\u00eb ekzekutonte kodin e tij n\u00eb an\u00ebn e serverit api.wordpress.org. <\/p>\n

N\u00eb rastin e p\u00ebrdorimit t\u00eb n\u00ebnshkrimeve digjitale, marrja e kontrollit mbi serverin e shp\u00ebrndarjes s\u00eb p\u00ebrdit\u00ebsimeve nuk do t\u00eb \u00e7onte n\u00eb kompromitimin e sistemeve t\u00eb p\u00ebrdoruesve, pasi p\u00ebr t\u00eb kryer nj\u00eb sulm do t\u00eb nevojitej gjithashtu t\u00eb merrej \u00e7el\u00ebsi sekret i ruajtur ve\u00e7mas, me an\u00eb t\u00eb t\u00eb cilit b\u00ebhet n\u00ebnshkrimi i p\u00ebrdit\u00ebsimeve. <\/p>\n

Zbatimi i kontrollit t\u00eb burimit t\u00eb p\u00ebrdit\u00ebsimeve p\u00ebrmes n\u00ebnshkrimit digjital pengohej nga fakti se mb\u00ebshtetja p\u00ebr algoritmet e nevojshme kriptografike u shfaq n\u00eb paket\u00ebn standarde t\u00eb PHP relativisht s\u00eb fundmi. Algoritmet e nevojshme kriptografike u fut\u00ebn fal\u00eb integrimit t\u00eb bibliotek\u00ebs Libsodium<\/a><\/noindex> n\u00eb p\u00ebrb\u00ebrjen kryesore PHP 7.2<\/a><\/noindex>. Por si versioni minimalisht i mb\u00ebshtetur n\u00eb WordPress \u00ebsht\u00eb deklaruar \u00e7lirimi 5.2.4 (duke filluar nga WordPress 5.2 - 5.6.20). Inkludimi i mb\u00ebshtetjes p\u00ebr n\u00ebnshkrimet digjitale do t\u00eb kishte \u00e7uar n\u00eb nj\u00eb rritje t\u00eb konsiderueshme t\u00eb k\u00ebrkesave p\u00ebr versionin minimalisht t\u00eb mb\u00ebshtetur t\u00eb PHP ose n\u00eb shtimin e nj\u00eb var\u00ebsie t\u00eb jashtme, di\u00e7ka q\u00eb zhvilluesit nuk mund\u00ebn ta b\u00ebnin duke marr\u00eb parasysh p\u00ebrhapjen e versioneve t\u00eb PHP n\u00eb sistemet e hostimit.<\/a><\/noindex> \u00c7lirim 5.2.4 (nga WordPress 5.2 deri n\u00eb 5.6.20). Aktivimi i mb\u00ebshtetjes p\u00ebr n\u00ebnshkrime dixhitale do t\u00eb b\u00ebj\u00eb q\u00eb k\u00ebrkesat minimale p\u00ebr versionin e mb\u00ebshtetur PHP t\u00eb rriten ndjesh\u00ebm ose t\u00eb shtohet nj\u00eb var\u00ebsi e jashtme, gj\u00eb q\u00eb zhvilluesit nuk mund ta pranonin duke marr\u00eb parasysh p\u00ebrhapjen e versioneve PHP n\u00eb sistemet e hostimit. <\/p>\n

dhe p\u00ebrfshirja n\u00eb p\u00ebrb\u00ebrjen e WordPress 5.2 t\u00eb nj\u00eb varianti kompakt t\u00eb Libsodium - zhvillimi<\/a><\/noindex> dhe p\u00ebrfshirja n\u00eb WordPress 5.2 e nj\u00eb versioni kompakt t\u00eb Libsodium - Sodium Compat<\/a><\/noindex>, n\u00eb t\u00eb cilin \u00ebsht\u00eb implementuar nj\u00eb grup minimal algoritmesh p\u00ebr verifikimin e n\u00ebnshkrimeve digjitale n\u00eb gjuh\u00ebn PHP. Zbatimi nuk \u00ebsht\u00eb ideal n\u00eb aspektin e performanc\u00ebs, por zgjidh plot\u00ebsisht problemin e kompatibilitetit dhe lejon zhvilluesit e shtesave t\u00eb fillojn\u00eb t\u00eb implementojn\u00eb algoritmet moderne t\u00eb kriptografis\u00eb.<\/p>\n

P\u00ebr formimin e n\u00ebnshkrimeve digjitale \u00ebsht\u00eb angazhuar algoritmi Ed25519<\/a><\/noindex>, i zhvilluar me pjes\u00ebmarrjen e Daniel Bernstein (Daniel J. Bernstein). N\u00ebnshkrimi digjital formohet p\u00ebr vler\u00ebn e hash-it SHA384, e cila \u00ebsht\u00eb llogaritur nga p\u00ebrmbajtja e paket\u00ebs me p\u00ebrdit\u00ebsimin. Ed25519 ofron nj\u00eb nivel sigurie m\u00eb t\u00eb lart\u00eb se ECDSA dhe DSA, dhe tregon nj\u00eb shpejt\u00ebsi shum\u00eb t\u00eb lart\u00eb verifikimi dhe krijimi n\u00ebnshkrimesh. Rezistenca ndaj thyerjes p\u00ebr Ed25519 \u00ebsht\u00eb rreth 2^128 (n\u00eb mesatar, p\u00ebr t\u00eb sulmuar Ed25519 do t\u00eb nevojiten rreth 2^140 operacione bit, e cila p\u00ebrkon me rezistenc\u00ebn e algoritmeve si NIST P-256 dhe RSA me nj\u00eb p\u00ebrmas\u00eb \u00e7eliku prej 3000 bit ose me nj\u00eb algorit\u00ebm blokimi 128-bit). Ed25519 gjithashtu nuk \u00ebsht\u00eb i ndjesh\u00ebm ndaj problemeve t\u00eb kolizionit n\u00eb hash-e, nuk \u00ebsht\u00eb i ndjesh\u00ebm ndaj sulmeve p\u00ebrmes analiz\u00ebs s\u00eb koh\u00ebs n\u00eb cache (cache-timing) dhe sulmeve nga kanale t\u00eb jashtme. <\/p>\n

N\u00eb versionin WordPress 5.2, verifikimi i n\u00ebnshkrimit digjital p\u00ebr momentin mbulon vet\u00ebm p\u00ebrdit\u00ebsimet kryesore t\u00eb platform\u00ebs dhe nuk \u00e7on automatikisht n\u00eb bllokimin e p\u00ebrdit\u00ebsimeve, por vet\u00ebm informon p\u00ebrdoruesin p\u00ebr ndonj\u00eb problem q\u00eb ka lindur. Ka vendosur q\u00eb bllokimi t\u00eb mos p\u00ebrfshihet menj\u00ebher\u00eb p\u00ebr shkak t\u00eb nevoj\u00ebs p\u00ebr nj\u00eb verifikim t\u00eb plot\u00eb dhe p\u00ebr t\u00eb rrethuar problemet e mundshme<\/a><\/noindex>. N\u00eb t\u00eb ardhmen planifikohet gjithashtu q\u00eb verifikimi i n\u00ebnshkrimit digjital t\u00eb shtohet p\u00ebr verifikimin e burimit t\u00eb instalimit t\u00eb temave dhe shtesave (prodhuesit do t\u00eb jen\u00eb n\u00eb gjendje t\u00eb n\u00ebnshkruajn\u00eb l\u00ebshimet me \u00e7el\u00ebsin e tyre).<\/p>\n

P\u00ebrve\u00e7 mb\u00ebshtetjes p\u00ebr n\u00ebnshkrimet digjitale, n\u00eb WordPress 5.2 mund t\u00eb p\u00ebrmendim ndryshimet e m\u00ebposhtme:<\/p>\n