Matrix ndeye yakavhurika ipapo meseji protocol. Yakagadzirirwa kubvumira vashandisi kutaurirana kuburikidza ne online chat, izwi pamusoro peIP, uye vhidhiyo chat.
Munguva pfupi yapfuura iyo vagadziri vepuratifomu decentralized communicationss «Matrix» yakaburitsa yambiro pamusoro pehutera hwakasiyana izvo zvakaonekwa uye vanotsoropodza mune matrix-js-sdk, matrix-ios-sdk, uye matrix-android-sdk2 maraibhurari anobvumira vatariri veseva kutevedzera vamwe vashandisi uye kuverenga mameseji kubva kumagumo-kusvika-kumagumo encrypted chats (E2EE).
Izvo zvinotaurwa kuti kuti ubudirire kupedzisa kurwisa, sevha yepamba inodzorwa nevanorwisa inofanira kuwanikwa (Sevha yekumba: sevha yekuchengetedza nhoroondo yemutengi uye maakaundi). Iko kushandiswa kwekupedzisira-kusvika-kumagumo encryption kudivi remutengi hakutenderi sevha administrator kupindira mukutumira mameseji, asi kusakwana kwakaonekwa kunobvumira kuchengetedzwa uku kutenderedzwa.
Nyaya dzinokanganisa iyo huru Element Matrix mutengi (yaimbova Riot) yewebhu, desktop, iOS, uye Android, pamwe neyechitatu-bato mutengi maapplication seCinny, Beeper, SchildiChat, Circuli, uye Synod.im.
Izvo zvinokanganisa hazvioneke mumaraibhurari matrix-rust-sdk, hydrogen-sdk, Matrix Dart SDK, mautrix-python, mautrix-go, uye matrix-nio, pamwe neHydrogen, ElementX, Nheko, FluffyChat, Siphon, Timmy, Gomuks, uye Pantalaimon zvikumbiro.
Ziva kuti nyaya dzakaomarara inyaya dzekuita mumatrix-js-sdk uye zvinobva, uye haisi nyaya dzeprotocol muMatrix. Iyo yazvino vhezheni yebepa revanotsvagisa yatakaona inoratidzira zvisizvo Element se "benchmark Matrix mutengi" uye inovhiringa zvikanganiso zvehukukutu hwekuita nekushoropodzwa kwakadzika kweprotocol.
Pane zviitiko zvitatu main attack:
- Iyo Matrix server administrator inogona kutyora emoji-based verification (SAS, Short Authentication Chains) nekushandisa masiginecha uye kutevedzera mumwe mushandisi. Iyo nyaya inokonzerwa nekusagadzikana (CVE-2022-39250) mune matrix-js-sdk kodhi ine chekuita nekubatanidzwa kwechishandiso ID kubata uye makiyi ekusaina.
- Anorwisa anodzora sevha anogona kuedzesera munhu anovimbwa naye uye opfuudza kiyi yekunyepera kubata mameseji kubva kune vamwe vashandisi. Nyaya iyi imhaka yekusagadzikana mune matrix-js-sdk (CVE-2022-39251), matrix-ios-sdk (CVE-2022-39255), uye matrix-android-sdk2 (CVE-2022-39248), izvo zvakakonzera. Mutengi anogashira zvisizvo mameseji akanyorerwa kumidziyo yakavharidzirwa uchishandisa Megolm protocol panzvimbo yeOlm, ichipa mameseji kune anotumira Megolm pachinzvimbo cheanotumira chaiye.
- Nekushandisa kusasimba kwataurwa mundima yapfuura, sevha maneja anogona zvakare kuwedzera dummy spare kiyi kuaccount yemushandisi kubvisa makiyi anoshandiswa encrypt meseji.
Vatsvakurudzi vakaona kusagadzikana yakaratidzawo kurwiswa kunowedzera wechitatu-bato mushandisi kune chat kana kubatanidza mudziyo wechitatu kumushandisi. Kurwiswa kwacho kwakavakirwa pachokwadi chekuti mameseji ebasa anoshandiswa kuwedzera vashandisi kune chat haana hukama nemakiyi emugadziri wekutaura uye anogona kugadzirwa neserver server.
Vagadziri vechirongwa cheMatrix vakaronga kusagadzikana uku sehudiki, sezvo manipulations akadaro asiri emuzvarirwo kuMatrix uye anongobata vatengi zvichienderana neprotocol, asi izvi hazvireve kuti havazoendi vasina kucherechedzwa: kana mushandisi akatsiviwa, icharatidzwa mune rondedzero yevashandisi vekutaura, uye kana yawedzerwa. mudziyo, yambiro icharatidzwa uye mudziyo uchamakwa seusina kusimbiswa (munyaya iyi, pakarepo mushure mekuwedzera chishandiso chisina kubvumidzwa, chinotanga kugamuchira makiyi eruzhinji anodiwa kuti anyore mameseji.
Iwe unozoona kuti matrix-rust-sdk, hydrogen-sdk, uye mamwe XNUMXnd uye XNUMXrd chizvarwa SDKs haana kukanganiswa netsikidzi mune mudzi wenyaya dzakakomba pano. Izvi ndosaka tanga tichishanda kutsiva maSDK echizvarwa chekutanga nekuchenesa, kunyorwa kwakanyatso kunyorwa kweRust muchimiro che matrix-rust-sdk, izere nekuenderera mberi kwakazvimirira kweruzhinji ongororo.
Kusagadzikana kunokonzerwa nebugs mukuita kwega yeMatrix protocol uye haasi matambudziko eprotocol pachayo. Parizvino, chirongwa ichi chakaburitsa zvigadziriso zveanetsa maSDK uye mamwe evatengi maapplication akavakirwa pamusoro pavo.
Pakupedzisira hongu iwe unofarira kukwanisa kuziva zvakawanda nezvazvo, unogona kutarisa ruzivo mu inotevera chinongedzo.