Vhara shambadzo
News

iOS 7.0.6 uye SSL yekuvandudza ruzivo

Daniel Hruska
10

Mazuva mashoma apfuura, Apple yakaburitsa zana iOS 7.0.6 update, nezvekusunungurwa kwatakakuzivisa. Vakawanda vangave vakashamisika kuti update akasunungurwawo vakuru iOS 6 (vhezheni 6.1.6) uye Apple TV (vhezheni 6.0.2). Ichi chigamba chekuchengetedza, saka Apple yaisakwanisa kugadzirisa chete chikamu chemidziyo yayo. Uyezve, nyaya iyi inobatawo OS X. Maererano nemutauriri weApple Trudy Muller, OS X update ichabudiswa nokukurumidza sezvinobvira.

Nei paine hype yakawanda yakatenderedza iyi update? Kukanganisika mukodhi yekodhi inobvumira kuvimbiswa kwesevha kuti ipfuure pane yakachengeteka kutapurirana padanho rehukama reISO/OSI referensi modhi. Kunyanya, iko kukanganisa kwakaipa SSL kuitiswa muchikamu icho server setifiketi chinoitika. Ndisati ndaenda kune imwe tsananguro, ndinosarudza kutsanangura pfungwa huru.

SSL (Secure Socket Layer) iprotocol inoshandiswa pakutaurirana kwakachengeteka. Inowana kuchengetedzeka kuburikidza nekunyorera uye kutendeseka kwemapato anotaurirana. Authentication ndiyo tsinhiro yechitupa charatidzwa. Muhupenyu chaihwo, semuenzaniso, iwe unotaura zita rako (chitupa) uye ratidza chitupa chako kuitira kuti mumwe munhu azvionese (kusimbisa). Huchokwadi hunozokamurwa kuva chechokwadi, unongova muenzaniso une chitupa chenyika, kana kuti chiziviso, apo munhu ari kutaurwa anogona kuziva chiziviso chako pasina kuti iwe wamuzivisa pachine nguva mberi.

Iye zvino ndaizosvika muchidimbu kune server setifiketi. Muhupenyu chaihwo, chitupa chako chinogona kunge chiri, semuenzaniso, ID kadhi. Zvese zvakavakirwa paasymmetric cryptography, apo chidzidzo chega chega chine makiyi maviri - akavanzika uye eruzhinji. Runako rwese rwuri muchokwadi chekuti meseji inogona kuvharirwa nekiyi yeruzhinji uye kudhindwa nekiyi yakavanzika. Izvi zvinoreva kuti muridzi wekiyi yakavanzika chete ndiye anogona kubvisa meseji. Panguva imwecheteyo, hapana chikonzero chekunetseka nezvekuendesa kiyi yakavanzika kune ese ari maviri mapato anotaurirana. Chitupa chinobva chave kiyi yeruzhinji yenyaya inowedzerwa neruzivo rwayo uye yakasainwa nevakuru vetifiketi. MuCzech Republic, imwe yezviremera zvitupa ndeye, semuenzaniso, Česká Pošta. Nekuda kwechitupa, iyo iPhone inogona kuona kuti iri kunyatso kutaurirana neiyo yakapihwa sevha.

SSL inoshandisa asymmetric encryption paunenge uchigadzira chinongedzo, icho chinonzi SSL kubata maoko. Panguva ino, iPhone yako inosimbisa kuti iri kutaurirana nesevha yakapihwa, uye panguva imwe chete, nerubatsiro rweasymmetric encryption, kiyi yesymmetric inotangwa, iyo ichashandiswa kune ese anotevera kutaurirana. Symmetric encryption inokurumidza. Sezvatonyorwa kare, iko kukanganisa kunotoitika panguva yekusimbisa server. Ngatitarisei kodhi iyo inokonzeresa iyi system vulnerability.

static OSStatus
SSLVerifySignedServerKeyExchange(SSLContext *ctx, bool isRsa,
SSLBuffer signedParams, uint8_t *signature, UInt16 signatureLen)

{
   OSStatus err;
   …

   if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0)
       goto fail;
   if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
       goto fail;
       goto fail;
   if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)
       goto fail;
   …

fail:
   SSLFreeBuffer(&signedHashes);
   SSLFreeBuffer(&hashCtx);
   return err;
}

Muchimiro chechipiri if unogona kuona mirairo miviri pazasi goto fail;. Uye ndicho chigumbuso. Iyi kodhi inobva yaita kuti murairo wechipiri uitwe pachinhanho kana chitupa chinofanirwa kusimbiswa goto fail;. Izvi zvinokonzeresa kuti chetatu chitukwe if uye hapazovi nekusimbisa server zvachose.

Zvinorehwa ndezvekuti chero munhu ane ruzivo rwekusagadzikana uku anogona kupa iPhone yako chitupa chekunyepedzera. Iwe kana yako iPhone, iwe unozofunga kuti uri kutaurirana encrypted, nepo paine anorwisa pakati pako neserver. Kurwiswa kwakadaro kunonzi murume-pakati-kurwisa, iyo inoturikira muchiCzech kuti murume-pakati-kurwisa kana murume pakati. Kurwiswa uchishandisa iyi chaiyo kukanganisa muOS X uye iOS kunogona chete kuurayiwa kana anorwisa uye akabatwa ari pane imwechete network. Naizvozvo, zviri nani kudzivirira yeruzhinji Wi-Fi network kana usina kuvandudza iOS yako. Vashandisi veMac vanofanirwa kuramba vachingwarira kuti ndeapi manetwork avanobatana nawo uye kuti ndeapi masaiti avanoshanyira pamanetiweki iwayo.

Zvinopfuura kutenda kuti kukanganisa kwakaipisisa kwakadai kwaigona sei kuita mushanduro dzekupedzisira dze OS X uye iOS. Zvinogona kunge zvave zvisingaenderane kuyedzwa kwekodhi isina kunyorwa zvakanaka. Izvi zvinoreva kuti vese vanogadzira uye vanoedza vanokanganisa. Izvi zvingaite sezvisingaite kuApple, uye saka fungidziro dziri pamusoro pekuti iyi bug ichokwadi yekuseri, inodaidzwa. musuo weshure. Hazvisi zvenhando izvo zvavanotaura kuti iyo yakanakisa backdoors inoita senge zvikanganiso zvisingaoneki. Zvisinei, idzi dzinongova dzidziso dzisina kusimbiswa, saka tichafunga kuti mumwe munhu akanganisa.

Kana iwe usina chokwadi kana system yako kana browser haina hutachiona kune iyi bug, shanyira peji gotofail.com. Sezvauri kuona mumifananidzo iri pazasi, Safari 7.0.1 mu OS X Mavericks 10.9.1 ine tsikidzi, nepo muSafari mu iOS 7.0.6 zvese zvakanaka.

Zviwanikwa: iMore, Reuters
Source
Kukurukurirana
Misoro , , , , , , , , ,

Related



Vazhinji vanoverenga zvinyorwa

.