{"id":37054,"date":"2019-10-31T22:15:30","date_gmt":"2019-10-31T19:15:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti\/"},"modified":"2019-10-31T22:15:30","modified_gmt":"2019-10-31T19:15:30","slug":"pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","title":{"rendered":"Pwnie Awards 2019: De mest betydande s\u00e5rbarheterna och s\u00e4kerhetsmissarna","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Under konferensen Black Hat USA som h\u00f6lls i Las Vegas <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\/\">h\u00f6lls<\/a><\/noindex> ceremonin f\u00f6r utdelning av priser <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\">Pwnie Awards 2019<\/a><\/noindex>, d\u00e4r de mest betydelsefulla s\u00e5rbarheterna och absurda felen inom dators\u00e4kerhet lyfts fram. Pwnie Awards anses vara motsvarigheten till Oscars och Golden Raspberry inom dators\u00e4kerhet och delas ut \u00e5rligen sedan 2007. <\/p>\n<p>Huvud <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\/winners\/\">vinnarna<\/a><\/noindex> och <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\/nominations\">nomineringskategorin<\/a><\/noindex>: <\/p>\n<ul>\n<li class=\"l\"> <b>B\u00e4sta serverfel<\/b>. Tilldelas f\u00f6r uppt\u00e4ckten och utnyttjandet av den mest tekniskt komplexa och intressanta buggen i en n\u00e4tverksservice. Vinnarna uts\u00e5gs till forskarna som  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.blackhat.com\/us-19\/briefings\/schedule\/#infiltrating-corporate-intranet-like-nsa---pre-auth-rce-on-leading-ssl-vpns-15545\">uppt\u00e4ckte<\/a><\/noindex> en s\u00e5rbarhet hos VPN-leverant\u00f6ren Pulse Secure, vars tj\u00e4nst anv\u00e4nds av Twitter, Uber, Microsoft, SLA, SpaceX, Akamai, Intel, IBM, VMware, den amerikanska marinen, Department of Homeland Security (DHS) i USA och f\u00f6rmodligen h\u00e4lften av f\u00f6retagen p\u00e5 Fortune 500-listan. Forskarna hittade en bakd\u00f6rr som till\u00e5ter en icke-autentiserad angripare att \u00e4ndra l\u00f6senordet f\u00f6r vilken anv\u00e4ndare som helst. M\u00f6jligheten att utnyttja problemet visades f\u00f6r att erh\u00e5lla root-\u00e5tkomst till VPN-servern, d\u00e4r endast HTTPS-porten \u00e4r \u00f6ppen;\n<p>Bland de icke-vinnande kandidaterna kan n\u00e4mnas: <\/p>\n<ul>\n<li class=\"l\"> Utnyttjande f\u00f6re autentiseringssteget <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/orangetw\/awesome-jenkins-rce-2019\">s\u00e5rbarhet<\/a><\/noindex> i systemet f\u00f6r kontinuerlig integration Jenkins, vilket m\u00f6jligg\u00f6r k\u00f6rning av kod p\u00e5 servern. S\u00e5rbarheten anv\u00e4nds aktivt av botar f\u00f6r att genomf\u00f6ra kryptovaluta-mining p\u00e5 servrar;\n<li class=\"l\"> Kritisk <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50819\">s\u00e5rbarhet<\/a><\/noindex> i e-postservern Exim, vilket m\u00f6jligg\u00f6r k\u00f6rning av kod p\u00e5 servern med root-beh\u00f6righet;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/sec-consult.com\/en\/blog\/2018\/10\/millions-of-xiongmai-video-surveillance-devices-can-be-hacked-via-cloud-feature-xmeye-p2p-cloud\/\">S\u00e5rbarheter<\/a><\/noindex> i IP-kameror Xiongmai XMeye P2P, vilket g\u00f6r det m\u00f6jligt att ta kontroll \u00f6ver enheten. Kamerorna levererades med ingenj\u00f6rsl\u00f6senord och anv\u00e4nde inte verifiering av digital signatur vid firmwareuppdateringar;\n<li class=\"l\"> Kritisk <noindex><a rel=\"nofollow\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-0708\">s\u00e5rbarhet<\/a><\/noindex> i implementeringen av RDP-protokollet i Windows, vilket g\u00f6r det m\u00f6jligt att k\u00f6ra sin egen kod p\u00e5 distans;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50177\">S\u00e5rbarhet<\/a><\/noindex> i WordPress, relaterat till uppladdning av PHP-kod under sken av en bild. Problemet till\u00e5ter att k\u00f6ra godtycklig kod p\u00e5 servern, med f\u00f6rfattartillst\u00e5nd (Author) p\u00e5 webbplatsen;\n<\/ul>\n<li class=\"l\"> <b>B\u00e4sta fel i klientprogramvara<\/b>. Vinnaren \u00e4r en l\u00e4tt utnyttjad <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-6223\">s\u00e5rbarhet<\/a><\/noindex> i Apples FaceTime-gruppsamtalsystem, vilket g\u00f6r det m\u00f6jligt f\u00f6r initiativtagaren av gruppsamtalet att tvinga mottagaren att svara (till exempel f\u00f6r att avlyssna och spionera).\n<p>Priset var \u00e4ven nominerat till: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50679\">S\u00e5rbarhet<\/a><\/noindex> i WhatsApp, vilket g\u00f6r det m\u00f6jligt att k\u00f6ra sin kod genom att skicka ett s\u00e4rskilt utformat r\u00f6stanrop;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugs.chromium.org\/p\/chromium\/issues\/detail?id=899689\">S\u00e5rbarhet<\/a><\/noindex> i grafikbiblioteket Skia, som anv\u00e4nds i webbl\u00e4saren Chrome, vilket kan leda till minneskorruption p\u00e5 grund av felaktigheter vid flyttaloperationer vid vissa geometriska transformationer;\n<\/ul>\n<li class=\"l\"> <b>Den b\u00e4sta s\u00e5rbarheten som leder till \u00f6kad beh\u00f6righet<\/b>. Vinsten tilldelades f\u00f6r att ha uppt\u00e4ckt <noindex><a rel=\"nofollow\" href=\"https:\/\/googleprojectzero.blogspot.com\/2019\/01\/voucherswap-exploiting-mig-reference.html\">s\u00e5rbarheten<\/a><\/noindex> i k\u00e4rnan av iOS, som kan utnyttjas via ipc_voucher, tillg\u00e4ngligt f\u00f6r \u00e5tkomst via webbl\u00e4saren Safari.\n<p>Priset var \u00e4ven nominerat till: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-0859\">S\u00e5rbarhet<\/a><\/noindex> i Windows, vilket ger full kontroll \u00f6ver systemet genom manipulation med funktionen CreateWindowEx (win32k.sys). Problemet uppt\u00e4cktes under analys av skadlig programvara som utnyttjade s\u00e5rbarheten innan den \u00e5tg\u00e4rdades;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50130\">S\u00e5rbarhet<\/a><\/noindex> i runc och LXC, som p\u00e5verkar Docker och andra system f\u00f6r containerisolering, vilket m\u00f6jligg\u00f6r att en angripare kan \u00e4ndra k\u00f6rningsfilen runc fr\u00e5n en kontrollerad isolerad container och f\u00e5 root-beh\u00f6righeter p\u00e5 v\u00e4rdsystemet;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.zecops.com\/vulnerabilities\/exploit-of-cve-2019-7286\/\">S\u00e5rbarhet<\/a><\/noindex> i iOS (CFPrefsDaemon), vilket g\u00f6r det m\u00f6jligt att kringg\u00e5 isoleringsl\u00e4gen och k\u00f6ra kod med root-beh\u00f6righeter;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-9568\">S\u00e5rbarhet<\/a><\/noindex> i TCP-stacken i Linux, som anv\u00e4nds i Android, vilket m\u00f6jligg\u00f6r f\u00f6r en lokal anv\u00e4ndare att h\u00f6ja sina beh\u00f6righeter p\u00e5 enheten;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49931\">S\u00e5rbarheter<\/a><\/noindex> i systemd-journald, vilket m\u00f6jligg\u00f6r att f\u00e5 root-beh\u00f6righeter;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/usn.ubuntu.com\/4077-1\/\">S\u00e5rbarhet<\/a><\/noindex> i verktyget tmpreaper f\u00f6r att rensa \/tmp, vilket g\u00f6r det m\u00f6jligt att spara sin fil var som helst i filsystemet;\n<\/ul>\n<li class=\"l\"> <b>Den b\u00e4sta kryptografiska attacken<\/b>. Tilldelas f\u00f6r att ha uppt\u00e4ckt de mest betydande bristerna i verkliga system, protokoll och krypteringsalgoritmer. Priset har tilldelats f\u00f6r att ha uppt\u00e4ckt <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50493\">s\u00e5rbarheter<\/a><\/noindex> i WPA3 tr\u00e5dl\u00f6sa n\u00e4tverkssky teknologin och i EAP-pwd, vilket m\u00f6jligg\u00f6r rekonstruktion av anslutningsl\u00f6senordet och \u00e5tkomst till det tr\u00e5dl\u00f6sa n\u00e4tverket utan att veta l\u00f6senordet.\n<p>Nominerade f\u00f6r priset var ocks\u00e5: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48597\">Metod<\/a><\/noindex> attacker p\u00e5 PGP och S\/MIME-kryptering i e-postklienter;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.f-secure.com\/cold-boot-attacks\/\">Till\u00e4mpning<\/a><\/noindex> metoden f\u00f6r kall omstart f\u00f6r att f\u00e5 \u00e5tkomst till inneh\u00e5llet i krypterade partitioner med Bitlocker;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50213\">S\u00e5rbarhet<\/a><\/noindex> i OpenSSL, vilket m\u00f6jligg\u00f6r separering av situationer f\u00f6r att f\u00e5 felaktig till\u00e4ggspadding och felaktig MAC. Problemet orsakas av felaktig hantering av nollbyte i till\u00e4ggspadding (padding oracle);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/sec-consult.com\/en\/blog\/2018\/11\/my-name-is-johann-wolfgang-von-goethe-i-can-prove-it\/\">Problem<\/a><\/noindex> med identifieringskort som anv\u00e4nds i Tyskland och som anv\u00e4nder SAML;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/chromium-os\/u2f-ecdsa-vulnerability\">Problemet<\/a><\/noindex> med slumpm\u00e4ssig entropi i implementeringen av st\u00f6d f\u00f6r U2F-token i ChromeOS;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/monocypher.org\/quality-assurance\/disclosures\">S\u00e5rbarhet<\/a><\/noindex> i Monocypher, som gjorde att nollsignaturer EdDSA bed\u00f6mdes som giltiga.\n<\/ul>\n<li class=\"l\"> <b>Den mest innovativa forskningen.<\/b>  Priset tilldelades teknikens utvecklare <noindex><a rel=\"nofollow\" href=\"https:\/\/gamozolabs.github.io\/fuzzing\/2018\/10\/14\/vectorized_emulation.html\">Vektoriseringsemulation<\/a><\/noindex>, som anv\u00e4nder AVX-512 vektorinstruktioner f\u00f6r att emulera programk\u00f6rning, vilket m\u00f6jligg\u00f6r en betydande \u00f6kning av hastigheten f\u00f6r fuzzing-testning (upp till 40-120 miljarder instruktioner per sekund). Tekniken g\u00f6r det m\u00f6jligt att parallellt k\u00f6ra 8 64-bitars eller 16 32-bitars virtuella maskiner med instruktioner f\u00f6r fuzzing-testning av applikationen p\u00e5 varje CPU-k\u00e4rna.\n<p>Nominerade till priset var: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mimecast.com\/blog\/2019\/06\/exploit-using-microsoft-excel-power-query-for-remote-dde-execution-discovered\/\">S\u00e5rbarhet<\/a><\/noindex> Power Query-teknologi fr\u00e5n MS Excel, som m\u00f6jligg\u00f6r utf\u00f6rande av kod och kringg\u00e5ende av isoleringsmetoder f\u00f6r applikationer vid \u00f6ppning av s\u00e4rskilt utformade kalkylblad;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50446\">Metod<\/a><\/noindex> bedr\u00e4geri av Tesla-bilar f\u00f6r att provocera fram en k\u00f6rning p\u00e5 fel fil;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/sec-consult.com\/en\/blog\/2019\/02\/reverse-engineering-architecture-pinout-plc\/\">Arbete<\/a><\/noindex> omv\u00e4nd ingenj\u00f6rskonst av ASICS-chippet Siemens S7-1200;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/arxiv.org\/abs\/1808.10250\">SonarSnoop<\/a><\/noindex> &#8212; \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u043f\u0430\u043b\u044c\u0446\u0435\u0432 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0440\u0430\u0437\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043d\u0430 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043e\u043d\u0430\u0440\u0430 &#8212; \u0432\u0435\u0440\u0445\u043d\u0438\u0439 \u0438 \u043d\u0438\u0436\u043d\u0438\u0439 \u0434\u0438\u043d\u0430\u043c\u0438\u043a\u0438 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0430 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u044e\u0442 \u043d\u0435\u0441\u043b\u044b\u0448\u0438\u043c\u044b\u0435 \u043a\u043e\u043b\u0435\u0431\u0430\u043d\u0438\u044f, \u0430 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043c\u0438\u043a\u0440\u043e\u0444\u043e\u043d\u044b \u0443\u043b\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u0438\u0445 \u0434\u043b\u044f  \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043e\u0442\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u043e\u0442 \u0440\u0443\u043a\u0438 \u043a\u043e\u043b\u0435\u0431\u0430\u043d\u0438\u0439;\n<li class=\"l\"> \t<noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50260\">Utveckling<\/a><\/noindex> verktyg p\u00e5 NSA f\u00f6r omv\u00e4nd ingenj\u00f6rskonst Ghidra;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/@massarelli\/safe-self-attentive-function-embedding-d80abbfea794\">SAFE<\/a><\/noindex> &#8212; \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0432 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430  \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/vulmon.com\/vulnerabilitydetails?qid=CVE-2019-11098&#038;scoretype=cvssv2\">Skapande<\/a><\/noindex> av en metod f\u00f6r att kringg\u00e5 Intel Boot Guard-mekanismen f\u00f6r att ladda modifierade UEFI-firmware utan kontroll av digital signatur.\n<\/ul>\n<li class=\"l\"> <b>Den lamaste reaktionen fr\u00e5n leverant\u00f6ren<\/b> (Lamest Vendor Response). Nominering f\u00f6r den mest inadekvata reaktionen p\u00e5 meddelandet om en s\u00e5rbarhet i egen produkt. Vinnarna erk\u00e4nns som utvecklarna av kryptovaluta-pl\u00e5nboken BitFi, som skriker om sin produkts extrema s\u00e4kerhet, vilken i verkligheten visade sig vara en illusion, och som trakasserar forskare som uppt\u00e4cker s\u00e5rbarheter och inte betalar ut lovade priser f\u00f6r att identifiera problem;\n<p>Bland kandidaterna till priset \u00f6verv\u00e4gdes \u00e4ven: <\/p>\n<ul>\n<li class=\"l\"> En s\u00e4kerhetsforskare anklagade VD:n f\u00f6r Atrient f\u00f6r ett angrepp f\u00f6r att tvinga denne att ta bort rapporten om en uppt\u00e4ckt s\u00e5rbarhet, men VD:n f\u00f6rnekar incidenten och \u00f6vervakningskameror f\u00e5ngade inte detta angrepp;\n<li class=\"l\"> F\u00f6retaget Zoom f\u00f6rdr\u00f6jde \u00e5tg\u00e4rder f\u00f6r att \u00e5tg\u00e4rda den kritiska <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/bugbountywriteup\/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5\">s\u00e5rbarheten<\/a><\/noindex> i deras konferenssystem och \u00e5tg\u00e4rdade problemet f\u00f6rst efter offentlig upplysning. S\u00e5rbarheten till\u00e4t en extern angripare att h\u00e4mta data fr\u00e5n anv\u00e4ndarnas webbkameror p\u00e5 macOS genom att \u00f6ppna en s\u00e4rskilt utformad sida i webbl\u00e4saren (zoom startade en http-server p\u00e5 klientsidan som tog emot kommandon fr\u00e5n det lokala programmet).\n<li class=\"l\"> Of\u00f6rm\u00e5ga att \u00e5tg\u00e4rda p\u00e5 mer \u00e4n 10 \u00e5r <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51006\">problemet<\/a><\/noindex> med OpenPGP-krypteringsnycklar, med motiveringen att koden \u00e4r skriven i det specifika spr\u00e5ket OCaml och saknar f\u00f6ljeslagare.\n<\/ul>\n<p><b>Det mest \u00f6verdrivna tillk\u00e4nnagivandet om s\u00e5rbarhet<\/b>. Tilldelas f\u00f6r den mest uppbl\u00e5sta och omfattande belysningen av problemet p\u00e5 n\u00e4tet och i media, s\u00e4rskilt om s\u00e5rbarheten sedan visar sig vara praktiskt taget oanv\u00e4ndbar. Priset tilldelades Bloomberg f\u00f6r <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49393\">ett uttalande<\/a><\/noindex> uppt\u00e4ckten av spionchip p\u00e5 Super Micro-moderkort, vilket inte bekr\u00e4ftades, och k\u00e4llan angav helt <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49417\">annan information<\/a><\/noindex>.<\/p>\n<p>I nomineringen n\u00e4mns: <\/p>\n<ul>\n<li class=\"l\"> S\u00e5rbarhet i libssh, som <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49453\">p\u00e5verkade<\/a><\/noindex> enkla serverapplikationer (libssh anv\u00e4nds n\u00e4stan inte f\u00f6r servrar), men presenterades av NCC Group som en s\u00e5rbarhet som till\u00e5ter attack mot vilken OpenSSH-server som helst.\n<li class=\"l\"> Attack med hj\u00e4lp av DICOM-bilder. Id\u00e9n \u00e4r att man kan f\u00f6rbereda en k\u00f6rbar fil f\u00f6r Windows som ser ut som en giltig DICOM-bild. Denna fil kan laddas upp p\u00e5 en medicinsk enhet och k\u00f6ras.\n<li class=\"l\"> S\u00e5rbarhet <noindex><a rel=\"nofollow\" href=\"https:\/\/thrangrycat.com\/\">Thrangrycat<\/a><\/noindex>, som g\u00f6r det m\u00f6jligt att kringg\u00e5 s\u00e4kerhetsstartsmekanismen p\u00e5 Cisco-enheter. S\u00e5rbarheten klassificerades som en uppbl\u00e5st fr\u00e5ga eftersom den kr\u00e4ver root-r\u00e4ttigheter f\u00f6r attack, men om angriparen redan har f\u00e5tt root-\u00e5tkomst, vad g\u00e4ller d\u00e5 s\u00e4kerhet? S\u00e5rbarheten vann samtidigt i kategorin mest underskattade problem, eftersom den till\u00e5ter att inf\u00f6ra en permanent bakd\u00f6rr i Flash;\n<\/ul>\n<li class=\"l\"> <b>Den st\u00f6rsta misslyckandet<\/b> (Most Epic FAIL). \u041f\u043e\u0431\u0435\u0434\u0430 \u043f\u0440\u0438\u0441\u0443\u0436\u0434\u0435\u043d\u0430 \u0438\u0437\u0434\u0430\u043d\u0438\u044e Bloomberg  \u0437\u0430 \u0440\u044f\u0434 \u0441\u0435\u043d\u0441\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 c \u0433\u0440\u043e\u043c\u043a\u0438\u043c\u0438 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u043c\u0438,  \u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u043d\u043d\u044b\u043c\u0438 \u0444\u0430\u043a\u0442\u0430\u043c\u0438, \u0443\u043c\u0430\u043b\u0447\u0438\u0432\u0430\u043d\u0438\u0435\u043c \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432, \u0441\u043a\u0430\u0442\u044b\u0432\u0430\u043d\u0438\u0435\u043c \u0432 \u0442\u0435\u043e\u0440\u0438\u044e \u0437\u0430\u0433\u043e\u0432\u043e\u0440\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0430\u043a\u0438\u0445 \u0442\u0435\u0440\u043c\u0438\u043d\u043e\u0432, \u043a\u0430\u043a &#171;\u043a\u0438\u0431\u0435\u0440\u043e\u0440\u0443\u0436\u0438\u0435&#187;, \u0438 \u043d\u0435\u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u043c\u0438 \u043e\u0431\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438. \u0421\u0440\u0435\u0434\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043d\u043e\u043c\u0438\u043d\u0430\u043d\u0442\u043e\u0432:\n<ul>\n<li class=\"l\"> Shadowhammer-attacken p\u00e5 Asus firmware-uppdateringstj\u00e4nst;\n<li class=\"l\"> \u0412\u0437\u043b\u043e\u043c \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 BitFi, \u0440\u0430\u0437\u0440\u0435\u043a\u043b\u0430\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u0430\u043a &#171;\u043d\u0435\u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0435\u043c\u043e\u0435&#187;;\n<li class=\"l\"> L\u00e4ckor av personlig information och <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49366\">token<\/a><\/noindex> \u00e5tkomst till Facebook.\n<\/ul>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>K\u00e4lla: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51267\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie Awards 2019, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u044b \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0430\u0431\u0441\u0443\u0440\u0434\u043d\u044b\u0435 \u043f\u0440\u043e\u0432\u0430\u043b\u044b \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. Pwnie Awards \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0430\u043d\u0430\u043b\u043e\u0433\u043e\u043c \u041e\u0441\u043a\u0430\u0440\u0430 \u0438 \u0417\u043e\u043b\u043e\u0442\u043e\u0439 \u043c\u0430\u043b\u0438\u043d\u044b \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0435\u0436\u0435\u0433\u043e\u0434\u043d\u043e, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2007 \u0433\u043e\u0434\u0430. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0431\u0435\u0434\u0438\u0442\u0435\u043b\u0438 \u0438 \u043d\u043e\u043c\u0438\u043d\u0430\u0446\u0438\u0438: \u041b\u0443\u0447\u0448\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u0430\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37054","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Pwnie Awards 2019: \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0432\u0430\u043b\u044b \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:30+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pwnie Awards 2019: de mest betydande s\u00e5rbarheterna och s\u00e4kerhetsmissarna | ProHoster","description":"Vid den nyligen h\u00e5llna konferensen Black Hat USA i Las Vegas h\u00f6lls en ceremoni f\u00f6r utdelning av Pwnie-priserna.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Pwnie Awards 2019: \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0432\u0430\u043b\u044b \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:30+00:00","article:modified_time":"2019-10-31T19:15:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37054","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:53:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:34:24","updated":"2026-01-22 05:53:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/37054","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=37054"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/37054\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=37054"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=37054"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=37054"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}