Izingcingo zaseMelika zizoqhudelana nogaxekile ocingweni

E-US, ubuchwepheshe bokuqinisekisa ababhalisile buyathuthuka - iphrothokholi ye-SHAKEN / STIR. Ake sikhulume ngezimiso zokusebenza kwayo kanye nobunzima obungase busetshenziswe.

/flickr/ UMark Fischer / CC BY-SA

Inkinga ngezingcingo

Izingcingo zerobo ezingaceliwe ziyisizathu esivame kakhulu sezikhalazo zabathengi ku-US Federal Trade Commission. Ngo-2016 inhlangano iqophe amahithi ayizigidi ezinhlanu, ngemva konyaka leli nani ladlula izigidi eziyisikhombisa.

Lezi zingcingo zogaxekile azigcini nje ngokuthatha isikhathi sabantu. Izinsiza zezingcingo ezizenzakalelayo zisetshenziselwa ukuqola imali. Ngokusho kwe-YouMail, ngoSepthemba wonyaka odlule, ama-40% ezingcingo eziyizigidi eziyizinkulungwane ezine zenziwe ngabakhwabanisi. Ehlobo lika-2018, abantu baseNew York balahlekelwe cishe amaRandi ayizigidi ezi-XNUMX ekudluliseleni ezigebengwini ezibabizele iziphathimandla futhi zaqola imali.

Inkinga yalethwa ekunakekeleni kwe-US Federal Communications Commission (FCC). Abamele inhlangano ukhiphe isitatimende, okwakudinga ukuthi izinkampani zokuxhumana zisebenzise isisombululo sokulwa nogaxekile ocingweni. Lesi sixazululo bekuyiphrothokholi ethi SHAKEN/STIR. Ngo-March, ukuhlolwa ngokuhlanganyela ebanjiwe I-AT&T ne-Comcast.

Isebenza kanjani iphrothokholi ethi SHAKEN/STIR

Ama-opharetha e-Telecom azosebenza nezitifiketi zedijithali (zakhelwe phezu kwesisekelo se-cryptography yokhiye womphakathi) ezovumela ukuqinisekiswa kwabafonayo.

Inqubo yokuqinisekisa izoqhubeka kanje. Okokuqala, u-opharetha womuntu oshaya ucingo uthola isicelo I-SIP MEMA ukuze usungule uxhumano. Isevisi yokuqinisekisa yomhlinzeki iqinisekisa ulwazi mayelana nekholi - indawo, inhlangano, imininingwane mayelana nedivayisi yofonayo. Ngokusekelwe emiphumeleni yesheke, ucingo lunikezwa esinye sezigaba ezintathu: A - lonke ulwazi mayelana nomshayi ucingo luyaziwa, B - inhlangano nendawo eyaziwayo, no-C - kuphela indawo yokubhalisa eyaziwayo.

Ngemva kwalokho, u-opharetha wengeza umlayezo onesitembu sesikhathi, isigaba socingo kanye nesixhumanisi sesitifiketi sika-elekthronikhi esihlokweni sesicelo se-INVITE. Nasi isibonelo somlayezo onjalo kusuka endaweni yokugcina ye-GitHub enye yezingcingo zaseMelika:

{
	"alg": "ES256",
        "ppt": "shaken",
        "typ": "passport",
        "x5u": "https://cert-auth.poc.sys.net/example.cer"
}

{
        "attest": "A",
        "dest": {
          "tn": [
            "1215345567"
          ]
        },
        "iat": 1504282247,
        "orig": {
          "tn": "12154567894"
        },
        "origid": "1db966a6-8f30-11e7-bc77-fa163e70349d"
}

Ngaphezu kwalokho, isicelo siya kumhlinzeki wobhalisile obiziwe. U-opharetha wesibili ususa ukubethela umlayezo esebenzisa ukhiye osesidlangalaleni, aqhathanise okuqukethwe ne-SIP INVITE, futhi aqinisekise ubuqiniso besitifiketi. Kungemva kwalokho kuphela ukuxhumana phakathi kwababhalisile, futhi iqembu "elitholayo" lithola isaziso mayelana nokuthi ubani omshayelayo.

Yonke inqubo yokuqinisekisa ingamelwa ngomdwebo:

Ngokusho kochwepheshe, ukuqinisekiswa kofonayo uzothatha akukho ngaphezu kwe-100 millisecond.

Okuthunyelwe

Indlela kuphawuliwe kunhlangano ye-USTelecom, i-SHAKEN/STIR izonikeza abantu ukulawula okwengeziwe kumakholi abawatholayo, okwenza kube lula kubo ukunquma ukuthi bayalubamba yini ucingo noma cha.

Funda kubhulogi yethu:

• I-Botnet "i-spams" ngokusebenzisa imizila: okudingeka ukwazi
• I-DDOS ne-5G: "ipayipi" elikhudlwana - izinkinga eziningi

Kodwa kunombono embonini wokuthi iphrothokholi ngeke ibe "inhlamvu yesiliva". Ochwepheshe bathi abakhwabanisi bazovele basebenzise ama-workaround. Abathumela ogaxekile bazokwazi ukubhalisa i-PBX ethi "dummy" kunethiwekhi yomsebenzisi egameni lenhlangano futhi benze zonke izingcingo ngayo. Esimeni sokuvinjwa kwe-PBX, kuzokwenzeka ukuthi umane ubhalise kabusha.

Ngu ngokusho omele enye ye-telecoms, ukuqinisekiswa okulula kobhalisile usebenzisa izitifiketi akwanele. Ukumisa abakhohlisi nabathumela ogaxekile, udinga ukuvumela ama-ISP ukuthi avimbe ngokuzenzakalelayo izingcingo ezinjalo. Kodwa ngenxa yalokhu, Ikhomishana Yezokuxhumana kuyodingeka yakhe isethi entsha yemithetho ezolawula le nqubo. Futhi i-FCC ingabhekana nalolu daba esikhathini esizayo esiseduze.

Kusukela ekuqaleni konyaka, congressmen bayacabangela umthethosivivinywa omusha ozophoqa iKhomishana ukuthi yakhe izindlela zokuvikela izakhamizi ekushayeni ucingo futhi iqaphe ukuqaliswa kwezinga le-SHAKEN/STIR.

/flickr/ Jack Sem / CC BY

Kufanele kuqashelwe ukuthi SHAKEN/STIR kwenziwe ku-T-Mobile - kwamanye amamodeli we-smartphone futhi uhlele ukwandisa ububanzi bamadivayisi asekelwe - kanye Verizon - amakhasimende opharetha wayo angalanda uhlelo lokusebenza olukhethekile oluzoxwayisa mayelana nezingcingo ezivela ezinombolweni ezisolisayo. Abanye abathwali baseMelika basahlola ubuchwepheshe. Kulindeleke ukuthi baqede ukuhlola ekupheleni kuka-2019.

Yini enye ongayifunda kubhulogi yethu ku-Habré:

• Impi yokungathathi hlangothi inetha iyithuba lokubuya
• Isimo: I-Japan ingase ikhawulele ukulanda okuqukethwe kunethiwekhi - siyasiqonda futhi siyaxoxa
• Izinga elisha elisekelwe ku-PCIe 5.0 "lizoxhuma" i-CPU ne-GPU - yini eyaziwa ngayo

Source: www.habr.com