{"id":53579,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah"},"modified":"2021-01-02T13:04:14","modified_gmt":"2021-01-02T11:04:14","slug":"ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","title":{"rendered":"Attacken p\u00e5 HackerOne som gav tillg\u00e5ng till st\u00e4ngda s\u00e5rbarhetsrapporter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>HackerOne-plattformen, som ger s\u00e4kerhetsforskare m\u00f6jlighet att informera utvecklare om uppt\u00e4ckta s\u00e5rbarheter och f\u00e5 bel\u00f6ningar f\u00f6r detta, har drabbats <noindex><a rel=\"nofollow\" href=\"https:\/\/hackerone.com\/reports\/745324\">rapport<\/a><\/noindex> av ett intr\u00e5ng. En av forskarna lyckades f\u00e5 tillg\u00e5ng till en s\u00e4kerhetsanalytikers konto p\u00e5 HackerOne, som hade m\u00f6jlighet att se st\u00e4ngda material, inklusive information om s\u00e5rbarheter som \u00e4nnu inte \u00e5tg\u00e4rdats. Under plattformens existens har HackerOne betalat ut totalt 23 miljoner dollar till forskare f\u00f6r att ha uppt\u00e4ckt s\u00e5rbarheter i produkter hos mer \u00e4n 100 kunder, d\u00e4ribland Twitter, Facebook, Google, Apple, Microsoft, Slack, Pentagon och den amerikanska marinen.<\/p>\n<p>Det \u00e4r v\u00e4rt att notera att kontointr\u00e5nget blev m\u00f6jligt p\u00e5 grund av den m\u00e4nskliga faktorn. En av forskarna skickade in en beg\u00e4ran om en potentiell s\u00e5rbarhet i HackerOne. En analytiker p\u00e5 HackerOne f\u00f6rs\u00f6kte under granskningen av beg\u00e4ran \u00e5terskapa den f\u00f6reslagna hackningsmetoden, men kunde inte reproducera problemet, och f\u00f6rfattaren till beg\u00e4ran fick ett svar med en f\u00f6rfr\u00e5gan om ytterligare detaljer. Under tiden missade analytikern att han av misstag skickade sin session-cookie tillsammans med resultaten av den misslyckade kontrollen. Bland annat gav analytikern exempel p\u00e5 en HTTP-f\u00f6rfr\u00e5gan utf\u00f6rd med curl, som inkluderade HTTP-rubriker d\u00e4r han gl\u00f6mde att ta bort inneh\u00e5llet i session-cookien.<\/p>\n<p>Forskaren noterade detta misstag och kunde f\u00e5 tillg\u00e5ng till det privilegierade kontot p\u00e5 hackerone.com genom att helt enkelt anv\u00e4nda det observerade cookie-v\u00e4rdet utan att beh\u00f6va genomg\u00e5 den flerfaktorsautentisering som till\u00e4mpas av tj\u00e4nsten. Attacken blev m\u00f6jlig eftersom sessionen p\u00e5 hackerone.com inte var kopplad till anv\u00e4ndarens IP-adress eller webbl\u00e4sare. Den problematiska session-ID:n togs bort tv\u00e5 timmar efter att rapporten om l\u00e4ckan publicerades. F\u00f6r att informera om problemet beslutades det att forskaren skulle f\u00e5 20 000 dollar.<\/p>\n<p>HackerOne har initierat en granskning f\u00f6r att analysera eventuell uppkomst av liknande Cookie-l\u00e4ckor i det f\u00f6rflutna och f\u00f6r att bed\u00f6ma potentiella l\u00e4ckor av konfidentiella uppgifter om kundproblem. Granskningen uppt\u00e4ckte inga tecken p\u00e5 l\u00e4ckor i det f\u00f6rflutna och fastst\u00e4llde att forskaren som visade problemet kunde ha f\u00e5tt information om cirka 5% av alla program som presenterades i tj\u00e4nsten, till vilka analytikern hade tillg\u00e5ng, vars sessionsnyckel hade anv\u00e4nts.<\/p>\n<p>F\u00f6r att skydda mot s\u00e5dana attacker i framtiden har en bindning av sessionsnyckeln implementerats till <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/lir\/ipv4\/\"   title=\"IP-adress\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"594\">IP-adress<\/a> och filtrering av sessionsnycklar och autentiseringstoken i kommentarer. I framtiden planeras bindningen till IP att ers\u00e4ttas med bindning till anv\u00e4ndarens enheter, eftersom bindning till IP \u00e4r opraktisk f\u00f6r anv\u00e4ndare med dynamiskt tilldelade adresser. Det har ocks\u00e5 beslutats att ut\u00f6ka loggsystemet med information om anv\u00e4ndartillg\u00e5ng till data och att implementera en modell f\u00f6r granul\u00e4r \u00e5tkomst f\u00f6r analytiker till kunddata.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51977\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c \u0432\u0437\u043b\u043e\u043c\u0435. \u041e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 HackerOne, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0441\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e\u0431 \u0435\u0449\u0451 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445. \u0417\u0430 \u0432\u0440\u0435\u043c\u044f \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0447\u0435\u0440\u0435\u0437 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53579","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 HackerOne, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u043e\u0442\u0447\u0451\u0442\u0430\u043c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-04T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-01-02T11:04:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Attacken mot HackerOne som gav tillg\u00e5ng till konfidentiella rapporter om s\u00e5rbarheter | ProHoster","description":"HackerOne-plattformen, som ger s\u00e4kerhetsforskare m\u00f6jlighet att informera utvecklare om uppt\u00e4ckta s\u00e5rbarheter och f\u00e5 bel\u00f6ningar f\u00f6r detta, har drabbats","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 HackerOne, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u043e\u0442\u0447\u0451\u0442\u0430\u043c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 | ProHoster","og:description":"\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2021-01-02T11:04:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53579","title":null,"description":"","keywords":"","keyphrases":null,"primary_term":null,"canonical_url":"","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:46:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-02-08 20:46:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/53579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=53579"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/53579\/revisions"}],"predecessor-version":[{"id":157785,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/53579\/revisions\/157785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=53579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=53579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=53579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}