{"id":53579,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah"},"modified":"2021-01-02T13:04:14","modified_gmt":"2021-01-02T11:04:14","slug":"ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","title":{"rendered":"Sulmi ndaj HackerOne, i cili lejoi qasje n\u00eb raportet e mbyllura mbi dob\u00ebsit\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Platforma HackerOne, e cila u jep mund\u00ebsin\u00eb hulumtuesve t\u00eb siguris\u00eb t'i informojn\u00eb zhvilluesit mbi identifikimin e dob\u00ebsive dhe t\u00eb marrin shp\u00ebrblime p\u00ebr k\u00ebt\u00eb, ka marr\u00eb raportin<\/a><\/noindex> p\u00ebr thyerjen e saj. Nj\u00eb nga hulumtuesit arriti t\u00eb aksesoj\u00eb llogarin\u00eb e nj\u00eb analisti t\u00eb siguris\u00eb n\u00eb kompanin\u00eb HackerOne, i cili kishte mund\u00ebsin\u00eb t\u00eb shihte materialet e mbyllura, p\u00ebrfshir\u00eb ato q\u00eb kishin informacione p\u00ebr dob\u00ebsi q\u00eb ende nuk ishin eliminuar. Gjat\u00eb ekzistenc\u00ebs s\u00eb platform\u00ebs, hulumtuesve u jan\u00eb paguar gjithsej 23 milion dollar\u00eb p\u00ebr identifikimin e dob\u00ebsive n\u00eb produktet e m\u00eb shum\u00eb se 100 klient\u00ebve, p\u00ebrfshir\u00eb Twitter, Facebook, Google, Apple, Microsoft, Slack, Pentagonin dhe Marin\u00ebn e SHBA.<\/p>\n

R\u00ebnd\u00ebsish\u00ebm \u00ebsht\u00eb se kapja e llogaris\u00eb u b\u00eb e mundur p\u00ebr shkak t\u00eb faktor\u00ebve njer\u00ebzor\u00eb. Nj\u00eb nga hulumtuesit d\u00ebrgoi p\u00ebr shqyrtim nj\u00eb k\u00ebrkes\u00eb p\u00ebr nj\u00eb dob\u00ebsi t\u00eb mundshme n\u00eb HackerOne. Analisti i HackerOne gjat\u00eb shqyrtimit t\u00eb k\u00ebrkes\u00ebs p\u00ebrpiqej t\u00eb riprodhonte metod\u00ebn e propozuar t\u00eb thyerjes, por nuk arriti t\u00eb riprodhonte problemin, dhe autorit t\u00eb k\u00ebrkes\u00ebs iu d\u00ebrgua nj\u00eb p\u00ebrgjigje me nj\u00eb k\u00ebrkes\u00eb p\u00ebr detaje t\u00eb m\u00ebtejshme. N\u00eb k\u00ebt\u00eb rast, analisti nuk vuri re se s\u00eb bashku me rezultatet e kontrollit t\u00eb pasuksessh\u00ebm, p\u00ebr shkak t\u00eb pakujdesis\u00eb, d\u00ebrgoi t\u00eb dh\u00ebnat e cookies s\u00eb sesionit t\u00eb tij.<\/p>\n

Hulumtuesi vuri re k\u00ebt\u00eb gabim dhe ishte n\u00eb gjendje t\u00eb aksesonte llogarin\u00eb me privilegje n\u00eb faqen hackerone.com, duke thjesht futur vler\u00ebn e v\u00ebrejtur t\u00eb cookie pa pasur nevoj\u00eb t\u00eb kalonte p\u00ebrmes verifikimit me shum\u00eb faktor\u00eb q\u00eb aplikohej n\u00eb sh\u00ebrbim. Sulmi u b\u00eb i mundur, pasi n\u00eb hackerone.com nuk u aplikua lidhja e sesionit me IP-n\u00eb apo shfletuesin e p\u00ebrdoruesit. Identifikuesi problematik i sesionit u fshi pas dy or\u00ebsh nga publikimi i raportit t\u00eb rrjedhjes. P\u00ebr informimin mbi problemin, vendosi t'i paguante hulumtuesit 20 mij\u00eb dollar\u00eb.<\/p>\n

HackerOne ka iniciuar nj\u00eb audit p\u00ebr t\u00eb analizuar mund\u00ebsin\u00eb e shfaqjes s\u00eb ngjashme t\u00eb gjinive Cookie n\u00eb t\u00eb kaluar\u00ebn dhe p\u00ebr t\u00eb vler\u00ebsuar potencialet e shfaqjeve t\u00eb informacionit t\u00eb mbyllur rreth problemeve t\u00eb klient\u00ebve t\u00eb sh\u00ebrbimit. Auditi nuk identifikoi fakte t\u00eb shfaqjeve n\u00eb t\u00eb kaluar\u00ebn dhe p\u00ebrcaktoi se hulumtuesi q\u00eb e demonstroi problemin mund t\u00eb kishte marr\u00eb informacion rreth rreth 5% t\u00eb t\u00eb gjitha programeve t\u00eb paraqitura n\u00eb sh\u00ebrbim, p\u00ebr t\u00eb cilat analisti kishte akses, \u00e7el\u00ebsi i sesionit t\u00eb t\u00eb cilit ishte p\u00ebrdorur.<\/p>\n

P\u00ebr t\u00eb mbrojtur nga realizimi i sulmeve t\u00eb ngjashme n\u00eb t\u00eb ardhmen, \u00ebsht\u00eb realizuar lidhja e \u00e7el\u00ebsit t\u00eb sesionit me adres\u00eb IP<\/a> dhe filtrimi i \u00e7el\u00ebsave t\u00eb sesionit dhe tokeneve t\u00eb autentikimit n\u00eb komente. M\u00eb von\u00eb, plani \u00ebsht\u00eb t\u00eb z\u00ebvend\u00ebsohet lidhja me IP me lidhjen me pajisjet e p\u00ebrdoruesve, pasi lidhja me IP \u00ebsht\u00eb e pak\u00ebndshme p\u00ebr p\u00ebrdoruesit me adresa q\u00eb jepen dinamikisht. Po ashtu, \u00ebsht\u00eb vendosur t\u00eb zgjerohen sistemet e regjistrit me informacion rreth aksesit t\u00eb p\u00ebrdoruesve n\u00eb t\u00eb dh\u00ebna dhe t\u00eb implementohet nj\u00eb model i aksesit t\u00eb granuar t\u00eb analist\u00ebve n\u00eb t\u00eb dh\u00ebnat e klient\u00ebve.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c \u0432\u0437\u043b\u043e\u043c\u0435. \u041e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 HackerOne, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0441\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e\u0431 \u0435\u0449\u0451 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445. \u0417\u0430 \u0432\u0440\u0435\u043c\u044f \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0447\u0435\u0440\u0435\u0437 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53579","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sulmi ndaj HackerOne q\u00eb mund\u00ebsoi qasje n\u00eb raportet e mbyllura p\u00ebr dob\u00ebsit\u00eb | ProHoster","description":"Platforma HackerOne, e cila u jep mund\u00ebsin\u00eb hulumtuesve t\u00eb siguris\u00eb t'i informojn\u00eb zhvilluesit mbi identifikimin e dob\u00ebsive dhe t\u00eb marrin shp\u00ebrblime p\u00ebr k\u00ebt\u00eb, ka marr\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 HackerOne, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u043e\u0442\u0447\u0451\u0442\u0430\u043c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 | ProHoster","og:description":"\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2021-01-02T11:04:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53579","title":null,"description":"","keywords":"","keyphrases":null,"primary_term":null,"canonical_url":"","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:46:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-02-08 20:46:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=53579"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53579\/revisions"}],"predecessor-version":[{"id":157785,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53579\/revisions\/157785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=53579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=53579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=53579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}