{"id":101183,"date":"2021-09-03T10:22:53","date_gmt":"2021-09-03T08:22:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovany-rezultaty-audita-vpn-klienta-mozilla"},"modified":"2021-09-03T10:22:53","modified_gmt":"2021-09-03T08:22:53","slug":"opublikovany-rezultaty-audita-vpn-klienta-mozilla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","title":{"rendered":"Resultaten av granskningen av Mozilla VPN-klienten har publicerats","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla har tillk\u00e4nnagett att de har avslutat en oberoende revision av klientprogramvaran f\u00f6r att ansluta till tj\u00e4nsten Mozilla VPN. Under revisionen genomf\u00f6rdes en analys av det frist\u00e5ende klientprogrammet, skrivet med Qt-biblioteket och tillg\u00e4ngligt f\u00f6r Linux, macOS, Windows, Android och iOS. Mozilla VPN drivs av mer \u00e4n 400 servrar fr\u00e5n den svenska VPN-leverant\u00f6ren Mullvad, som \u00e4r placerade i \u00f6ver 30 l\u00e4nder. Anslutningen till VPN<\/a>-tj\u00e4nsten g\u00f6rs med hj\u00e4lp av WireGuard-protokollet. <\/p>\n

Revisionen genomf\u00f6rdes av Cure53, som tidigare har reviderat projekten NTPsec, SecureDrop, Cryptocat, F-Droid och Dovecot. Revisionen omfattade granskning av k\u00e4llkoder och inkluderade tester f\u00f6r att identifiera potentiella s\u00e5rbarheter (fr\u00e5gor relaterade till kryptografi behandlades inte). Under granskningen identifierades 16 s\u00e4kerhetsproblem, varav 8 hade karakt\u00e4ren av rekommendationer, 5 bed\u00f6mdes som l\u00e5g risk, tv\u00e5 som medelrisk och ett som h\u00f6g risk. <\/p>\n

Endast ett problem med medelh\u00f6g risk klassades som en s\u00e5rbarhet, eftersom detta enda var exploaterbart. Det aktuella problemet ledde till l\u00e4ckage av information om anv\u00e4ndningen av VPN i koden f\u00f6r att identifiera ett captive portal p\u00e5 grund av okrypterade, direkta HTTP-f\u00f6rfr\u00e5gningar som s\u00e4ndes utanf\u00f6r VPN-tunneln och exponerade anv\u00e4ndarens huvud-IP-adress om en angripare kan kontrollera transiterings-trafiken. Problemet l\u00f6ses genom att st\u00e4nga av l\u00e4get f\u00f6r att identifiera captive portal i inst\u00e4llningarna. <\/p>\n

Det andra problemet av medelhög risk är kopplat till bristen på korrekt rengöring av icke-numeriska värden i portnumret, vilket möjliggör läckage av OAuth-autentiseringsparametrar genom att ersätta portnumret med en sträng som "1234@example.com", vilket leder till att taggen installeras <img src="»http:\/\/127.0.0.1:1234@example.com\/?code=…»" alt="»»">, som hänvisar till example.com istället för 127.0.0.1. <\/p>\n

Det tredje problemet, som markerades som farligt, till\u00e5ter vilken lokal applikation som helst att oauktoriserat komma \u00e5t VPN-klienten via WebSocket, kopplad till localhost. Som exempel visades hur, med en aktiv VPN-klient, vilken webbplats som helst skulle kunna skapa och skicka en sk\u00e4rmdump genom att generera h\u00e4ndelsen screen_capture. Problemet klassades inte som en s\u00e5rbarhet eftersom WebSocket endast anv\u00e4ndes i interna testversioner och anv\u00e4ndningen av denna kommunikationskanal planerades f\u00f6r framtiden f\u00f6r att m\u00f6jligg\u00f6ra interaktion med ett webbl\u00e4sartill\u00e4gg.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 Mozilla VPN. \u0412 \u0445\u043e\u0434\u0435 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u044b\u043b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d \u0430\u043d\u0430\u043b\u0438\u0437 \u043e\u0431\u043e\u0441\u043e\u0431\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Qt \u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f Linux, macOS, Windows, Android \u0438 iOS. \u0420\u0430\u0431\u043e\u0442\u0443 Mozilla VPN \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 400 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0448\u0432\u0435\u0434\u0441\u043a\u043e\u0433\u043e VPN-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 Mullvad, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 30 \u0441\u0442\u0440\u0430\u043d\u0430\u0445. \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101183","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Resultaten av revisionen av Mozilla VPN-klienten har publicerats | ProHoster","description":"Mozilla har tillk\u00e4nnagett att de har avslutat en oberoende revision av klientprogramvaran f\u00f6r att ansluta till tj\u00e4nsten Mozilla VPN.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 Mozilla | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 Mozilla VPN.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-03T08:22:53+00:00","article:modified_time":"2021-09-03T08:22:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101183","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-03 08:33:23","updated":"2026-02-04 14:42:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/101183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=101183"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/101183\/revisions"}],"predecessor-version":[{"id":156742,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/101183\/revisions\/156742"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=101183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=101183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=101183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}