{"id":76851,"date":"2020-04-05T07:42:20","date_gmt":"2020-04-05T05:42:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android"},"modified":"2020-04-05T07:42:20","modified_gmt":"2020-04-05T05:42:20","slug":"rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android","title":{"rendered":"Resultat av analys av bakd\u00f6rrar i Android-appar","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Forskare fr\u00e5n Helmholtz-centret f\u00f6r informationss\u00e4kerhet (CISPA), Ohio State University och New York University <noindex><a rel=\"nofollow\" href=\"https:\/\/cispa.saarland\/2020\/04\/03\/hidden-functions-make-mobile-phone-apps-vulnerable-to-hackers.html\">ett<\/a><\/noindex> unders\u00f6ker dold funktionalitet i applikationer f\u00f6r Android-plattformen. Analys av 100 000 mobilapplikationer fr\u00e5n Google Play-katalogen, 20 000 fr\u00e5n en alternativ katalog (Baidu) och 30 000 f\u00f6rinstallerade p\u00e5 olika smartphones, utvalda fr\u00e5n 1 000 firmwareversioner med SamMobile, <noindex><a rel=\"nofollow\" href=\"https:\/\/panda.moyix.net\/~moyix\/papers\/inputscope_oakland20.pdf\">att det \u00e4r enkelt att f\u00e5 ett EV-certifikat i namn av 'Stripe, Inc' (ett popul\u00e4rt betalsystem) bara genom att registrera ett f\u00f6retag med samma namn i en annan stat. F\u00f6r att uppt\u00e4cka skillnaden m\u00e5ste man i alla fall se \u00f6ver detaljerna om webbplatsen \u2013 informationen fr\u00e5n adressf\u00e4ltet \u00e4r otillr\u00e4cklig. En annan forskare, James Burton, fick certifikatet i namn av sitt registrerade f\u00f6retag 'Identity Verified', vilket ocks\u00e5 l\u00e4tt kan vilseleda anv\u00e4ndare.<\/a><\/noindex>, att 12 706 (8,5%) program inneh\u00e5ller funktionalitet som \u00e4r dold f\u00f6r anv\u00e4ndaren men kan aktiveras med hj\u00e4lp av speciella sekvenser, vilket kan klassificeras som bakd\u00f6rrar. <\/p>\n<p>Specifikt inkluderade 7 584 applikationer inbyggda hemliga \u00e5tkomstnycklar, 501 \u2013 inbyggda masterl\u00f6senord och 6 013 \u2013 dolda kommandon. Problemprogram f\u00f6rekommer i alla granskade programk\u00e4llor \u2013 i procent utgjorde bakd\u00f6rrar 6,86% (6 860) av de studerade programmen fr\u00e5n Google Play, 5,32% (1 064) fr\u00e5n den alternativa katalogen och 15,96% (4 788) fr\u00e5n listan \u00f6ver f\u00f6rinstallerade applikationer. De identifierade bakd\u00f6rrarna ger vem som helst som k\u00e4nner till nycklarna, aktiveringsl\u00f6senorden och sekvenserna f\u00f6r att anropa kommandon, tillg\u00e5ng till applikationen och alla relaterade data. <\/p>\n<p>Till exempel, i en applikation f\u00f6r att str\u00f6mma sportmatcher, med 5 miljoner installationer, hittades en inbyggd nyckel f\u00f6r att logga in i administrationsgr\u00e4nssnittet, vilket till\u00e5ter \u00e4ndringar av applikationens inst\u00e4llningar och ger tillg\u00e5ng till ytterligare funktionalitet. I en sk\u00e4rml\u00e5sapp, som ocks\u00e5 har 5 miljoner installationer, hittades en \u00e5tkomstnyckel som m\u00f6jligg\u00f6r \u00e5terst\u00e4llning av l\u00f6senordet som anv\u00e4ndaren st\u00e4ller in f\u00f6r att l\u00e5sa enheten. I en \u00f6vers\u00e4ttningsprogram med 1 miljon installationer finns det en nyckel som till\u00e5ter k\u00f6p i applikationen och uppgraderingar till pro-versionen utan faktiskt betalning.<\/p>\n<p> I programmet f\u00f6r fj\u00e4rrstyrning av f\u00f6rlorade enheter, som har 10 miljoner installationer, har ett masterl\u00f6senord identifierats som g\u00f6r det m\u00f6jligt att ta bort blockeringen som anv\u00e4ndaren har st\u00e4llt in vid f\u00f6rlust av enheten. I programmet f\u00f6r att hantera anteckningar har ett masterl\u00f6senord uppt\u00e4ckts som g\u00f6r det m\u00f6jligt att l\u00e5sa upp hemliga anteckningar. I m\u00e5nga applikationer har ocks\u00e5 fels\u00f6kningsl\u00e4gen uppt\u00e4ckts, vilket ger tillg\u00e5ng till l\u00e5gniv\u00e5funktioner; till exempel aktiverades en proxyserver i shoppingappen genom att skriva in en viss kombination, och i utbildningsprogrammet fanns det m\u00f6jlighet att kringg\u00e5 tester.<\/p>\n<p>F\u00f6rutom bakd\u00f6rrar har 4028 (2,7%) applikationer visat tecken p\u00e5 svartlistor som anv\u00e4nds f\u00f6r att censurera information fr\u00e5n anv\u00e4ndare. De anv\u00e4nda svartlistorna inneh\u00e5ller upps\u00e4ttningar av ord som \u00e4r f\u00f6rbjudna att n\u00e4mna, inklusive namn p\u00e5 politiska partier och politiker, samt typiska fraser som anv\u00e4nds f\u00f6r att skr\u00e4mma och diskriminera vissa befolkningsgrupper. Svartlistor har uppt\u00e4ckts i 1,98% av de studerade programmen fr\u00e5n Google Play, 4,46% fr\u00e5n alternativa kataloger och 3,87% fr\u00e5n listan \u00f6ver f\u00f6rinstallerade appar.<\/p>\n<p>F\u00f6r analysen anv\u00e4ndes ett verktyg skapat av forskarna, InputScope, vars kod snart kommer att <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OSUSecLab\/InputScope\">publicerades<\/a><\/noindex> publiceras p\u00e5 GitHub (forskarna har tidigare publicerat en statisk analysator <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OSUSecLab\/LeakScope\">LeakScope<\/a><\/noindex>, som automatiskt identifierar informationsl\u00e4ckor i applikationer).<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>K\u00e4lla: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52677\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA), \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0448\u0442\u0430\u0442\u0430 \u041e\u0433\u0430\u0439\u043e \u0438 \u041d\u044c\u044e-\u0419\u043e\u0440\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android. \u0410\u043d\u0430\u043b\u0438\u0437 100 \u0442\u044b\u0441\u044f\u0447 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 Google Play, 20 \u0442\u044b\u0441\u044f\u0447 \u0438\u0437 \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 (Baidu) \u0438 30 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u0435\u0434\u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043d\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0438\u0437 1000 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a \u0441 SamMobile, \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e 12706 (8.5%) [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-76851","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA), \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0448\u0442\u0430\u0442\u0430 \u041e\u0433\u0430\u0439\u043e \u0438 \u041d\u044c\u044e-\u0419\u043e\u0440\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Android | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA), \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0448\u0442\u0430\u0442\u0430 \u041e\u0433\u0430\u0439\u043e \u0438 \u041d\u044c\u044e-\u0419\u043e\u0440\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-05T05:42:20+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-05T05:42:20+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Resultat av analysen av bakd\u00f6rrar i Android-appar | ProHoster","description":"Forskare fr\u00e5n Helmholtz-centret f\u00f6r informationss\u00e4kerhet (CISPA), Ohio State University och New York University","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Android | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA), \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0448\u0442\u0430\u0442\u0430 \u041e\u0433\u0430\u0439\u043e \u0438 \u041d\u044c\u044e-\u0419\u043e\u0440\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-05T05:42:20+00:00","article:modified_time":"2020-04-05T05:42:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"76851","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:28:29","updated":"2022-10-07 21:01:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/76851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=76851"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/76851\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=76851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=76851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=76851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}