Cov yeej ntawm Pwnie Awards 2021 twb tau tshaj tawm lawm

Cov kev yeej ntawm Pwnie Awards txhua xyoo 2021 tau tshaj tawm, uas yog qhov kev tshwm sim muaj txiaj ntsig, nyob rau hauv uas cov neeg koom qhia qhov tseem ceeb tshaj plaws qhov muaj peev xwm thiab qhov ua tsis tau zoo nyob rau hauv kev ua haujlwm ntawm kev ruaj ntseg khoos phis tawm.

Pwnie Txiaj Ntsim paub txog ob qho kev ua tau zoo tshaj thiab kev tsis muaj peev xwm hauv lub teb cov ntaub ntawv kev ruaj ntseg. Cov yeej yog xaiv los ntawm pawg neeg saib xyuas kev lag luam kev nyab xeeb raws li kev xaiv tsa sau los ntawm cov ntaub ntawv kev ruaj ntseg hauv zej zog.

Cov npe yeej

Txoj cai tshwj xeeb zoo tshaj qhov tsis zoo: Qhov khoom plig no Muab khoom plig rau lub tuam txhab Qualys txhawm rau txheeb xyuas qhov tsis txaus ntseeg CVE-2021-3156 hauv sudo tus nqi hluav taws xob, uas tso cai rau koj kom tau txais txiaj ntsig hauv paus. Qhov tsis muaj zog tau tshwm sim hauv cov cai tau hais txog 10 xyoo thiab tseem ceeb rau qhov tseeb tias nws qhov kev kuaj pom xav tau kev tshuaj xyuas tas li ntawm cov cuab yeej siv lub tswv yim.

Qhov zoo tshaj plaws server yuam kev: Qhov no Muab khoom plig rau kev txheeb xyuas thiab siv cov cuab yeej nyuaj tshaj plaws thiab nthuav hauv kev pabcuam network. Yeej tau txais txiaj ntsig los txheeb xyuas tus vector tshiab ntawm kev tawm tsam tiv thaiv Microsoft Txauv. Cov ntaub ntawv ntawm txhua qhov tsis txaus ntseeg hauv chav kawm no tsis tau tshaj tawm, tab sis cov ntaub ntawv twb tau tshaj tawm txog qhov tsis txaus ntseeg CVE-2021-26855 (ProxyLogon), uas tso cai rau koj khaws cov ntaub ntawv los ntawm tus neeg siv yam tsis muaj kev lees paub, thiab CVE-2021-27065, uas tso cai rau koj los khiav koj cov cai ntawm server nrog cov cai tswj hwm.

Qhov zoo tshaj plaws crypto nres: tau tso cai txhawm rau txheeb xyuas qhov ua tsis tiav tseem ceeb tshaj plaws hauv cov kab ke, cov txheej txheem thiab qhov tseeb encryption algorithms. Qhov khoom plig fNws tau tshaj tawm rau Microsoft rau qhov tsis zoo (CVE-2020-0601) nyob rau hauv kev siv ntawm elliptic nkhaus digital kos npe uas tso cai rau tiam ntawm tus yuam sij ntiag tug raws li cov yuam sij pej xeem. Qhov teeb meem tau tso cai tsim cov ntawv pov thawj TLS rau HTTPS thiab kos npe digital tsis raug, uas Windows lees paub tias ntseeg tau.

Kev tshawb fawb tshiab tshaj plaws: Qhov nqi zog muab khoom plig rau cov kws tshawb fawb uas tau thov BlindSide txoj kev kom tsis txhob muaj kev nyab xeeb ntawm chaw nyob randomization (ASLR) siv sab channel xau uas tshwm sim los ntawm kev kwv yees ua tiav cov lus qhia los ntawm tus txheej txheem.

Feem ntau Epic FAIL yuam kev: muab khoom plig rau Microsoft rau ntau qhov kev tso tawm thaj uas tsis ua haujlwm rau PrintNightmare qhov tsis zoo (CVE-2021-34527) hauv Windows luam tawm qhov system uas tso cai rau koj cov cai kom ua haujlwm. Microsoft xub chij qhov teeb meem raws li hauv zos, tab sis tom qab ntawd nws muab tawm tias qhov kev tawm tsam tuaj yeem ua tiav nyob deb. Microsoft tom qab ntawd tshaj tawm plaub zaug, tab sis txhua lub sijhawm kev daws teeb meem tsuas yog npog ib rooj plaub tshwj xeeb, thiab cov kws tshawb fawb pom txoj hauv kev tshiab los tawm tsam qhov kev tawm tsam.

Cov kab uas zoo tshaj hauv software software: Qhov khoom plig ntawd yog muab khoom plig rau tus kws tshawb fawb uas nrhiav pom CVE-2020-28341 qhov tsis zoo hauv Samsung kev nyab xeeb cryptography, tau txais daim ntawv pov thawj kev nyab xeeb CC EAL 5+. Qhov tsis muaj zog ua rau nws muaj peev xwm hla dhau kev tiv thaiv thiab nkag mus rau cov cai uas ua haujlwm ntawm cov nti thiab cov ntaub ntawv khaws cia hauv ib puag ncig, hla dhau lub ntsuas phoo xauv lub vijtsam, thiab tseem hloov pauv mus rau lub khoos phis tawj kom qhib lub qhov rooj tom qab.

Qhov tsis txaus ntseeg tshaj plaws tsis txaus ntseeg: qhov puav pheej yog muab khoom plig rau Qualys rau kev txheeb xyuas tus lej 21Nails qhov tsis zoo nyob hauv Exim mail server, 10 ntawm qhov uas tuaj yeem siv tau nyob deb. Tus tsim tawm Exim tau tsis ntseeg txog kev siv cov teeb meem thiab siv sijhawm ntau dua 6 lub hlis los tsim cov kev daws teeb meem.

Cov lus teb tsis muaj zog tshaj plaws los ntawm cov chaw tsim khoom: qhov no yog kev xaiv tsa rau qhov tsis tsim nyog tshaj plaws rau cov lus ceeb toom tsis zoo hauv koj tus kheej cov khoom. Tus yeej yog Cellebrite, tus kws lij choj thiab cov ntaub ntawv thov kev thov rau tub ceev xwm. Cellebrite tsis tau teb txaus rau qhov tsis txaus ntseeg tshaj tawm los ntawm Moxie Marlinspike, tus sau ntawm Cov Txheej Txheem Teeb Meem. Moxie tau pib txaus siab rau Cellebrite tom qab tshaj tawm xov xwm dab neeg txog kev tsim thev naus laus zis txhawm rau txhawm rau zais cov teeb liab cov lus, uas tom qab ntawd dhau los ua qhov tsis raug, vim kev txhais lus tsis raug ntawm cov ntaub ntawv hauv kab lus hauv Cellebrite lub vev xaib., Uas tom qab ntawd raug tshem tawm ( "tawm tsam" xav tau lub cev siv lub xov tooj thiab lub peev xwm los qhib lub vijtsam, uas yog, nws tau raug txo kom saib cov lus hauv tus neeg xa xov, tab sis tsis yog tus kheej, tab sis siv daim ntawv thov tshwj xeeb uas simulates cov neeg siv ua).

Moxie tau tshuaj xyuas Cellebrite daim ntawv thov thiab pom qhov tsis txaus ntseeg uas tso cai rau txoj cai tsis raug cai thaum sim tshuaj xyuas cov ntaub ntawv tshwj xeeb. Cellebrite app kuj tau tshaj tawm siv ffmpeg lub tsev qiv ntawv qub uas tsis tau hloov kho rau 9 xyoo thiab muaj ntau qhov tsis tuaj yeem tiv thaiv qhov tsis zoo. Ntau dua li lees paub qhov teeb meem thiab kho lawv, Cellebrite tau tshaj tawm tsab ntawv tshaj tawm tias nws mob siab txog kev ncaj ncees ntawm cov neeg siv cov ntaub ntawv, ua kom muaj kev nyab xeeb ntawm nws cov khoom ntawm qib tsim nyog.

Thaum kawg Qhov Ua Tau Zoo Tshaj Plaws - Muab khoom plig rau Ilfak Gilfanov, tus sau ntawm IDA disassembler thiab Hex -Rays decompiler, rau nws txoj kev koom tes txhim kho cov cuab yeej rau cov kws tshawb fawb kev nyab xeeb thiab nws lub peev xwm los khaws cov khoom lag luam hloov tshiab rau 30 xyoo.

Source: https://pwnies.com


Cov ntsiab lus ntawm tsab xov xwm ua raws li peb cov ntsiab cai ntawm kev tswj hwm kev ncaj nceesCov. Tshaj tawm ib qho yuam kev nyem no.

Yog thawj tus tuaj tawm tswv yim

Tso koj saib

Koj email chaw nyob yuav tsis tsum luam tawm. Yuav tsum tau teb cov cim nrog *

*

*

  1. Lub luag haujlwm rau cov ntaub ntawv: Miguel Ángel Gatón
  2. Lub hom phiaj ntawm cov ntaub ntawv: Tswj SPAM, kev tswj xyuas tawm tswv yim.
  3. Sau raws cai: Koj kev tso cai
  4. Kev sib txuas lus ntawm cov ntaub ntawv: Cov ntaub ntawv yuav tsis raug xa mus rau lwm tus neeg thib peb tsuas yog los ntawm kev txiav txim siab raug cai.
  5. Cov ntaub ntawv khaws cia: Cov Ntaub Ntawv khaws tseg los ntawm Occentus Networks (EU)
  6. Txoj Cai: Txhua lub sijhawm koj tuaj yeem txwv, rov qab thiab tshem tawm koj cov ntaub ntawv.