Abaphumelele kuma-Pwnie Awards 2021 bamenyezelwe. Lona umcimbi ovelele lapho abahlanganyeli beveza khona ubuthakathaka obukhulu kanye namaphutha angenangqondo emkhakheni wokuphepha kwamakhompyutha.
Ama-Pwnie Awards aqaphela kokubili ubuhle kanye nokungakwazi kahle emkhakheni wokuphepha kolwazi. Abawinile bakhethwa yikomidi lochwepheshe bemboni yezokuphepha kusukela ekuqokweni okuqoqwe emphakathini wokuphepha kolwazi.
Uhlu lwabaphumelele
Ubungozi Bokwanda Kwamalungelo Angcono Kakhulu : Lo mklomelo unikezwe uQualys ngokuhlonza ubungozi be-CVE-2021-3156 kuhlelo lokusebenza lwe-`sudo` , oluvumela abasebenzisi ukuthi bathole amalungelo ezimpande. Ubungozi bube khona kukhodi cishe iminyaka eyi-10 futhi kuyaphawuleka ngoba ukutholakala kwayo kudinga ukuhlaziywa okujulile kwe-logic yalo hlelo lokusebenza.
Ubungozi Beseva Ebuhle Kakhulu: Lo mklomelo unikezwe ngokuhlonza nokusebenzisa ubuthakathaka obuyinkimbinkimbi kakhulu futhi obuthakazelisayo kakhulu kusevisi yenethiwekhi. Ukuwina kunikezwe ngokuhlonza i-vector entsha yokuhlasela ngokumelene ne-Microsoft Exchange . Ulwazi ngazo zonke ubuthakathaka balolu hlobo alukashicilelwa, kodwa ulwazi seluvele ludaluliwe mayelana ne-CVE-2021-26855 (ProxyLogon), ekuvumela ukuthi uthole idatha kumsebenzisi ozimele ngaphandle kokuqinisekiswa, kanye ne-CVE-2021-27065, ekuvumela ukuthi usebenzise ikhodi yakho kuseva enamalungelo okuphatha.
Ukuhlaselwa Okuhle Kakhulu Kwe-Cryptographic: Kunikezwe i-Microsoft ngokubona amaphutha abaluleke kakhulu ezinhlelweni zokubethela zangempela, amaphrothokholi, kanye nama-algorithms. Lo mklomelo unikezwe i-Microsoft ngenxa yobuthakathaka (i-CVE-2020-0601) ekusebenziseni amasignesha edijithali e-elliptic curve avumela ukukhiqizwa kwamakhiye ayimfihlo asekelwe kumakhiye omphakathi. Leli phutha lenze kwaba nokwenzeka ukudalwa kwezitifiketi ze-TLS ezingamanga ze-HTTPS kanye namasignesha edijithali angamanga, i-Windows ewaqinisekisile ukuthi athembekile.
Ucwaningo olusha kakhulu: Lo mklomelo unikezwe abacwaningi abaphakamise indlela ye-BlindSide yokugwema i-Address Randomization Safety (ASLR) besebenzisa ukuvuza kwesiteshi esiseceleni okuvela ekusetshenzisweni kwemiyalelo yokuqagela yeprosesa.
Umklomelo we-Epic FAIL wanikezwa iMicrosoft nge-patch yokukhishwa okuningi ehlulekile ukulungisa ubungozi be-PrintNightmare (CVE-2021-34527) ohlelweni lokukhipha ukuphrinta lwe-Windows, oluvumele ukwenziwa kwekhodi. IMicrosoft yaqala yaphawula inkinga njengeyendawo, kodwa kamuva kwavela ukuthi ukuhlaselwa kungenziwa kude. IMicrosoft yabe isikhipha izibuyekezo izikhathi ezine, kodwa isikhathi ngasinye ukulungiswa kwabhekana nesenzakalo esithile kuphela, futhi abacwaningi bathola indlela entsha yokwenza ukuhlaselwa.
Iphutha elihle kakhulu kwisofthiwe yamakhasimende : Lo mklomelo unikezwe umcwaningi othole ubuthakathaka be-CVE-2020-28341 ku-cryptography evikelekile ye-Samsung futhi wathola isitifiketi sokuphepha se-CC EAL 5+. Ubuthakathaka benze kwaba nokwenzeka ukudlula ngokuphelele ukuvikelwa nokufinyelela ikhodi esebenza ku-chip kanye nedatha egcinwe ku-enclave, ukudlula i-screen saver lock, kanye nokwenza izinguquko ku-firmware ukuze kudalwe umnyango wangemuva ofihliwe.
Ubuthakathaka obungabukelwa phansi kakhulu : Umklomelo wanikezwa uQualys ngokuhlonza inani lobuthakathaka be-21Nails kuseva yemeyili ye-Exim, eziyi-10 zazo ezingasetshenziswa kude. Abathuthukisi be-Exim babenokungabaza ngokusebenzisa kabi izinkinga futhi bachitha izinyanga ezingaphezu kweziyisithupha bethuthukisa ukulungisa.
Impendulo yomkhiqizi obuthakathaka kakhulu: Lokhu ukuphakanyiswa kwempendulo enganele kakhulu embikweni wobuthakathaka emkhiqizweni wabo . Owinile kwaba yi-Cellebrite, isicelo sokuhlola nokuhlola idatha sabezomthetho. I-Cellebrite yehlulekile ukuphendula ngokwanele embikweni wobuthakathaka owashicilelwa nguMoxie Marlinspike, umbhali wephrothokholi ye-Signal. I-Moxie yaba nesithakazelo ku-Cellebrite ngemuva kokushicilela umbiko wabezindaba mayelana nokudalwa kobuchwepheshe bokuphula imiyalezo ye-Signal ebethelwe, kamuva okwatholakala ukuthi ingamanga, ngenxa yokuchazwa kabi kolwazi olukulesi sihloko kuwebhusayithi ye-Cellebrite, eyasuswa kamuva ("ukuhlasela" kwakudinga ukufinyelela ngokomzimba ocingweni kanye nekhono lokuvula isikrini; okungukuthi, kwaqala ukubuka imiyalezo kusithunywa, kodwa hhayi ngesandla, kunalokho kusetshenziswa uhlelo lokusebenza olukhethekile olulingisa izenzo zomsebenzisi).
UMoxie uhlolisise izicelo zeCellebrite futhi wathola ubungozi obubucayi obuvumela ukuthi kusetshenziswe ikhodi engafanele lapho kuzanywa ukuskena idatha eyenziwe ngobuciko. Uhlelo lokusebenza lweCellebrite luphinde lwembula iqiniso lokuthi lisebenzisa umtapo wolwazi we-ffmpeg osuphelelwe yisikhathi ongakavuselelwa iminyaka eyi-9 futhi uqukethe inani elikhulu lobungozi obungafakwanga. Esikhundleni sokuvuma izingqinamba nokuzilungisa, uCellebrite wakhipha isitatimende sokuthi ukhathalela ubuqotho bemininingwane yomsebenzisi, kugcina ukuphepha kwemikhiqizo yayo kusezingeni elifanele.
Ekugcineni, impumelelo enkulu kunazo zonke: yanikezwa u-Ilfak Gilfanov, umbhali we-IDA disassembler kanye ne-Hex-Rays decompiler , ngegalelo lakhe ekuthuthukiseni amathuluzi abacwaningi bezokuphepha kanye nekhono lakhe lokugcina umkhiqizo uvuselelwe iminyaka engama-30.
Umthombo: https://pwnies.com