Ingxenye yamasayithi , futhi inani labo liya likhula kancane kancane. Iphrothokholi inciphisa ubungozi bokuvinjwa kwethrafikhi, kodwa ayikuqedi ukuhlasela okuzanyiwe. Sizokhuluma ngezinye zazo - POODLE, BEAST, DROWN nezinye - nezindlela zokuvikela ezintweni zethu.
/flickr/ / CC BY-SA
I-POODLE
Okokuqala mayelana nokuhlasela yaziwa ngo-2014. Ukuba sengozini kuphrothokholi ye-SSL 3.0 kutholwe uchwepheshe wezokuphepha kolwazi u-Bodo MΓΆller kanye nozakwabo bakwa-Google.
Ingqikithi yayo imi kanje: isigebengu siphoqa iklayenti ukuthi lixhume nge-SSL 3.0, elingisa ukunqanyulwa. Bese isesha kokubethelwe -imodi yethrafikhi imiyalezo yethegi ekhethekile. Ngokusebenzisa uchungechunge lwezicelo zomgunyathi, umhlaseli uyakwazi ukwakha kabusha okuqukethwe kwedatha ayithandayo, njengamakhukhi.
I-SSL 3.0 iphrothokholi ephelelwe yisikhathi. Kodwa umbuzo wokuphepha kwakhe usabalulekile. Amaklayenti ayisebenzisela ukugwema izinkinga zokusebenzisana namaseva. Ngokusho kwedatha ethile, cishe i-7% yezindawo eziyizinkulungwane eziyi-100 ezithandwa kakhulu ... Futhi izinguquko ku-POODLE eziqondise i-TLS 1.0 yesimanjemanje kanye ne-TLS 1.1. Kulo nyaka ukuhlasela okusha kwe-Zombie POODLE kanye ne-GOLDENDOODLE okudlula ukuvikela kwe-TLS 1.2 (zisahlotshaniswa nokubethela kwe-CBC).
Indlela yokuzivikela. Esimeni se-POODLE yasekuqaleni, udinga ukukhubaza ukusekelwa kwe-SSL 3.0. Nokho, kulesi simo kukhona ingozi izinkinga ukuhambisana. Esinye isisombululo kungaba indlela ye-TLS_FALLBACK_SCSV - iqinisekisa ukuthi ukushintshaniswa kwedatha nge-SSL 3.0 kuzokwenziwa kuphela ngamasistimu amadala. Abahlaseli ngeke besakwazi ukuqalisa ukwehliswa kwephrothokholi. Indlela yokuvikela ngokumelene ne-Zombie POODLE kanye ne-GOLDENDOODLE ukukhubaza ukusekelwa kwe-CBC kuzinhlelo zokusebenza ezisekelwe ku-TLS 1.2. Isixazululo esiyinhloko kuzoba ukushintshela ku-TLS 1.3 - inguqulo entsha yephrothokholi ayisebenzisi ukubethela kwe-CBC. Esikhundleni salokho, kusetshenziswa i-AES ne-ChaCha20 ehlala isikhathi eside.
BEAST
Okunye kokuhlasela kokuqala kwe-SSL ne-TLS 1.0, okutholwe ngo-2011. Njengo-POODLE, ISILO izici zokubethela kwe-CBC. Abahlaseli bafaka i-ejenti ye-JavaScript noma i-applet ye-Java emshinini weklayenti, ethatha indawo yemilayezo lapho ithumela idatha nge-TLS noma nge-SSL. Njengoba abahlaseli bekwazi okuqukethwe kwamaphakethe e-"dummy", bangawasebenzisa ukususa ukubhala ngekhodi ivekhtha yokuqalisa futhi bafunde eminye imilayezo kuseva, njengamakhukhi wokuqinisekisa.
Kuze kube manje, ubungozi be-BEAST busekhona : Amaseva elibamba nezinhlelo zokusebenza zokuvikela amasango e-inthanethi yasendaweni.
Indlela yokuzivikela. Umhlaseli udinga ukuthumela izicelo ezijwayelekile ukuze asuse ukubethela kwedatha. Ku-VMware yehlisa ubude besikhathi se-SSLSessionCacheTimeout ukusuka emizuzwini emihlanu (isincomo esizenzakalelayo) ukuya kumasekhondi angama-30. Le ndlela izokwenza kube nzima kakhulu kubahlaseli ukusebenzisa izinhlelo zabo, nakuba izoba nomthelela omubi ekusebenzeni. Ngaphezu kwalokho, udinga ukuqonda ukuthi ukuba sengozini kwe-BEAST kungase kube yinto yesikhathi esedlule ngokwakho - kusukela ngo-2020, iziphequluli ezinkulu kunazo zonke. ukusekelwa kwe-TLS 1.0 kanye ne-1.1. Kunoma yikuphi, ngaphansi kuka-1,5% wabo bonke abasebenzisi besiphequluli abasebenza nalawa maphrothokholi.
MINZA
Lokhu ukuhlasela kwe-cross-protocol okusebenzisa iziphazamisi ekusetshenzisweni kwe-SSLv2 ngokhiye abangu-40-bit RSA. Umhlaseli ulalela amakhulukhulu ezixhumanisi ze-TLS zethagethi futhi athumele amaphakethe akhethekile kuseva ye-SSLv2 esebenzisa ukhiye ofanayo oyimfihlo. Ukusebenzisa , isigebengu singakwazi ukususa ukubhala ngemfihlo eyodwa kumaseshini e-TLS eklayenti angaba yinkulungwane.
I-DOWN iqale ukwaziwa ngo-2016 - kwase kwenzeka emhlabeni. Namuhla ayikalahlekelwa ukubaluleka kwayo. Ezingosini eziyizinkulungwane eziyi-150 ezidume kakhulu, i-2% isekhona I-SSLv2 nezindlela zokubethela ezisengozini.
Indlela yokuzivikela. Kuyadingeka ukufaka amapheshi ahlongozwe abathuthukisi bemitapo yolwazi yokufihla ulwazi ekhubaza usekelo lwe-SSLv2. Isibonelo, iziqephu ezimbili ezinjalo zethulwa i-OpenSSL (ngo-2016 1.0.1s kanye 1.0.2g). Futhi, izibuyekezo nemiyalo yokukhubaza iphrothokholi esengozini ishicilelwe kuyo , , .
"Insiza ingase ibe sengcupheni yokuhlaselwa yi-DROWN uma okhiye bayo besetshenziswa iseva yenkampani yangaphandle ene-SSLv2, njengeseva yemeyili," kuphawula inhloko yomnyango wezokuthuthukiswa. Sergei Belkin. - Lesi simo senzeka uma amaseva amaningana esebenzisa isitifiketi se-SSL esivamile. Kulokhu, udinga ukukhubaza ukwesekwa kwe-SSLv2 kuyo yonke imishini."
Ungahlola ukuthi ingabe isistimu yakho idinga ukubuyekezwa kusetshenziswa okukhethekile - ithuthukiswe ongoti bezokuphepha kolwazi abathole AMA-DROWN. Ungafunda kabanzi mayelana nezincomo ezihlobene nokuvikelwa kulolu hlobo lokuhlasela .
Kubuhlungu
Obunye bobungozi obukhulu ku-software . Itholwe ngo-2014 emtatsheni wezincwadi we-OpenSSL. Ngesikhathi sesimemezelo sesiphazamisi, inani lamawebhusayithi asengozini - lokhu cishe ku-17% wezinsiza ezivikelwe kunethiwekhi.
Ukuhlasela kwenziwa ngemojula yesandiso se-Heartbeat TLS encane. Iphrothokholi ye-TLS idinga ukuthi idatha idluliselwe ngokuqhubekayo. Esimeni sokuphumula isikhathi eside, ikhefu liyenzeka futhi ukuxhumana kufanele kumiswe kabusha. Ukuze ubhekane nenkinga, amaseva namakhasimende βbanomsindoβ wesiteshi (), ithumela iphakethe lobude obungahleliwe. Uma belilikhulu kunephakethe lonke, izinguqulo ezisengozini ye-OpenSSL zifundeka kalula ngale kwebhafa enikeziwe. Le ndawo ingaqukatha noma iyiphi idatha, okuhlanganisa okhiye bokubethela abayimfihlo kanye nolwazi olumayelana nokunye ukuxhumana.
Ukuba sengozini bekukhona kuzo zonke izinguqulo zelabhulali phakathi kuka-1.0.1 kanye ne-1.0.1f ehlanganisiwe, kanye nenani lezinhlelo zokusebenza - Ubuntu kufika ku-12.04.4, i-CentOS endala kuno-6.5, i-OpenBSD 5.3 nezinye. Kukhona uhlu oluphelele . Nakuba ama-patches amelene nalokhu kuba sengcupheni akhululwa cishe ngokushesha ngemva kokutholakala kwawo, inkinga isasebenza nanamuhla. Emuva ngo-2017 , ungenwa yi-Heartbleed.
Indlela yokuzivikela. Kuyadingeka kuze kufike kunguqulo engu-1.0.1g noma ngaphezulu. Ungakwazi futhi ukukhubaza izicelo ze-Heartbeat ngesandla usebenzisa inketho ye-DOPENSSL_NO_HEARTBEATS. Ngemuva kokuvuselelwa, ochwepheshe bezokuphepha bolwazi khipha kabusha izitifiketi ze-SSL. Kudingeka ukumiselela uma kwenzeka idatha ekukhiye wokubethela iphelela ezandleni zabaduni.
Ukushintshwa kwesitifiketi
I-node ephethwe enesitifiketi esisemthethweni se-SSL ifakiwe phakathi komsebenzisi neseva, ivimbela ithrafikhi. Le nodi izenza iseva esemthethweni ngokwethula isitifiketi esivumelekile, futhi kuba nokwenzeka ukwenza ukuhlasela kwe-MITM.
Ngokusho amaqembu avela ku-Mozilla, Google kanye nenani lamanyuvesi, cishe u-11% wokuxhumana okuphephile kunethiwekhi kuvalwe. Lona umphumela wokufaka izitifiketi zezimpande ezisolisayo kumakhompyutha abasebenzisi.
Indlela yokuzivikela. Sebenzisa izinsiza ezithembekile . Ungahlola "ikhwalithi" yezitifiketi usebenzisa isevisi (CT). Abahlinzeki bamafu bangasiza futhi ngokuthola ukulalela; ezinye izinkampani ezinkulu sezivele zinikeza amathuluzi akhethekile okuqapha ukuxhumana kwe-TLS.
Enye indlela yokuvikela kuzoba entsha I-ACME, eyenza ngokuzenzakalelayo ukwamukela izitifiketi ze-SSL. Ngesikhathi esifanayo, izongeza izindlela ezengeziwe zokuqinisekisa umnikazi wesayithi. Okuningi ngakho .
/flickr/ / CC BY
Amathemba e-HTTPS
Naphezu kobungozi obuningi, iziqhwaga ze-IT nochwepheshe bezokuphepha bolwazi bayazethemba ngekusasa lephrothokholi. Ngokusetshenziswa okusebenzayo kwe-HTTPS Umdali we-WWW u-Tim Berners-Lee. Ngokusho kwakhe, ngokuhamba kwesikhathi i-TLS izovikeleka kakhulu, okuzokwenza ngcono kakhulu ukuphepha kokuxhumana. UBerners-Lee waze wasikisela lokho izitifiketi zeklayenti zokuqinisekisa ubuwena. Bazosiza ukuthuthukisa ukuvikelwa kweseva kubahlaseli.
Kuphinde kuhlelwe ukuthuthukisa ubuchwepheshe be-SSL/TLS kusetshenziswa ukufunda ngomshini - ama-algorithms ahlakaniphile azoba nesibopho sokuhlunga ithrafikhi enonya. Ngoxhumo lwe-HTTPS, abalawuli abanayo indlela yokuthola okuqukethwe kwemilayezo ebethelwe, okuhlanganisa nokuthola izicelo ezivela kuhlelo olungayilungele ikhompuyutha. Kakade namuhla, amanethiwekhi e-neural ayakwazi ukuhlunga amaphakethe angaba yingozi ngokunemba okungu-90%. ().
okutholakele
Ukuhlaselwa okuningi ku-HTTPS akuhlobene nezinkinga zephrothokholi ngokwayo, kodwa kusekela izindlela zokubethela eziphelelwe yisikhathi. Imboni ye-IT isiqala ukushiya kancane kancane izivumelwano zesizukulwane sangaphambilini futhi inikeze amathuluzi amasha okusesha ubungozi. Ngokuzayo, lawa mathuluzi azohlakanipha kakhulu.
Izixhumanisi ezengeziwe esihlokweni:
Source: www.habr.com