Ondrej Holzman Txawm hais tias cov yam ntxwv tshiab tau qhia hauv OS X Yosemite thiab iOS 8 coj ntau yam txiaj ntsig zoo rau cov neeg siv uas yooj yim rau kev siv ntau yam khoom siv, lawv tuaj yeem ua rau muaj kev hem thawj rau kev nyab xeeb. Piv txwv li, xa cov ntawv xa los ntawm iPhone mus rau Mac yooj yim heev hla kev pov thawj ob-kauj ruam thaum kos npe rau ntau yam kev pabcuam.
Cov txheej txheem txuas ntxiv ua haujlwm, nyob rau hauv uas Apple txuas cov khoos phis tawj nrog cov khoom siv hauv xov tooj ntawm tes hauv kev ua haujlwm tshiab, yog qhov nthuav heev, tshwj xeeb tshaj yog nyob rau hauv cov tes hauj lwm thiab cov tswv yim uas lawv siv los txuas iPhones thiab iPads rau Macs. Kev txuas ntxiv suav nrog kev muaj peev xwm hu xov tooj los ntawm Mac, xa cov ntaub ntawv ntawm AirDrop lossis sai sai tsim lub hotspot, tab sis tam sim no peb yuav tsom mus rau kev xa SMS mus rau khoos phis tawj.
Qhov no kuj tsis pom tseeb, tab sis muaj txiaj ntsig zoo heev tuaj yeem, qhov phem tshaj plaws, tig mus rau hauv qhov chaw ruaj ntseg uas tso cai rau tus neeg tawm tsam kom tau txais cov ntaub ntawv rau theem thib ob pov thawj thaum nkag rau hauv cov kev pabcuam xaiv. Peb tab tom tham ntawm no txog lub npe hu ua ob-theem nkag, uas, ntxiv rau cov tsev txhab nyiaj, twb tau qhia los ntawm ntau cov kev pabcuam hauv internet thiab muaj kev nyab xeeb ntau dua li yog tias koj muaj ib tus as khauj tiv thaiv los ntawm classic thiab ib lo lus zais xwb.
Kev pov thawj ob-theem tuaj yeem tshwm sim hauv ntau txoj hauv kev, tab sis thaum peb tham txog kev lag luam online thiab lwm yam kev pabcuam hauv internet, peb feem ntau ntsib kev xa tus lej pov thawj rau koj tus lej xov tooj, uas koj yuav tsum nkag mus rau tom ntej kom nkag mus rau koj tus password li niaj zaus. Yog li ntawd, yog tias ib tug neeg tau tuav koj tus password (lossis khoos phis tawj suav nrog tus password lossis daim ntawv pov thawj), feem ntau lawv yuav xav tau koj lub xov tooj ntawm tes, piv txwv li, nkag mus rau hauv internet banking, qhov twg SMS nrog tus password rau theem thib ob ntawm kev pov thawj yuav tuaj txog. .
Tab sis lub sij hawm koj muaj tag nrho koj cov ntawv xa los ntawm koj iPhone rau koj Mac thiab ib tug attacker yuav siv sij hawm koj Mac, lawv tsis xav tau koj iPhone. Txhawm rau xa cov lus SMS classic, tsis xav tau kev sib txuas ncaj qha ntawm iPhone thiab Mac - lawv tsis tas yuav nyob rau tib lub Wi-Fi network, Wi-Fi tsis tas yuav tsum tau qhib, ib yam li Bluetooth, thiab txhua yam uas xav tau yog los txuas ob qho khoom siv rau hauv internet. Cov kev pabcuam SMS Relay, raws li kev xa xov ntawm cov lus raug hu ua, sib txuas lus ntawm iMessage raws tu qauv.
Hauv kev xyaum, txoj kev nws ua haujlwm yog tias txawm hais tias cov lus tuaj txog rau koj li ib txwm SMS, Apple ua nws li iMessage thiab hloov nws hauv Is Taws Nem rau Mac (qhov no yog li cas nws ua haujlwm nrog iMessage ua ntej qhov tshwm sim ntawm SMS Relay) , qhov twg nws qhia nws li SMS, uas yog qhia los ntawm lub npuas ntsuab . iPhone thiab Mac tuaj yeem nyob hauv ib lub nroog sib txawv, tsuas yog ob qho khoom siv xav tau kev sib txuas hauv Is Taws Nem.
Koj tuaj yeem tau txais cov ntaub ntawv pov thawj tias SMS Relay tsis ua haujlwm dhau Wi-Fi lossis Bluetooth raws li hauv qab no: qhib lub dav hlau hom ntawm koj lub iPhone thiab sau thiab xa SMS ntawm Mac txuas nrog Is Taws Nem. Tom qab ntawd disconnect lub Mac los ntawm Is Taws Nem thiab, hloov pauv, txuas lub iPhone rau nws (lub xov tooj ntawm tes yog txaus). Cov SMS xa tuaj txawm tias ob lub cuab yeej tsis tau sib txuas lus ncaj qha rau ib leeg - txhua yam tau lees paub los ntawm iMessage raws tu qauv.
Yog li, thaum siv cov lus xa mus, nws yog ib qho tsim nyog yuav tsum nco ntsoov tias kev ruaj ntseg ntawm ob qhov kev lees paub tseeb raug cuam tshuam. Yog tias koj lub computer raug nyiag lawm, disabling messaging tam sim ntawd yog txoj kev ceev tshaj plaws thiab yooj yim tshaj los tiv thaiv kev nyiag nyiag ntawm koj cov nyiaj.
Nkag mus rau hauv Internet banking yog yooj yim dua yog tias koj tsis tas yuav rov sau cov ntawv pov thawj los ntawm lub xov tooj cov zaub, tab sis tsuas yog luam tawm los ntawm Cov Lus ntawm Mac, tab sis kev ruaj ntseg tseem ceeb dua qhov no, uas yog qhov tsis txaus vim SMS Relay. . Ib qho kev daws teeb meem rau qhov teeb meem no tuaj yeem yog, piv txwv li, muaj peev xwm tshem tawm cov lej tshwj xeeb los ntawm kev xa mus rau Mac, vim tias SMS cov lej feem ntau yog los ntawm tib tus lej.
Raws li tau hais nyob rau hauv kab lus kawg - lub peev xwm luam cov lej yog qhov yooj yim dua thiab zoo dua.
Tsis tas li ntawd - yog tias ib tug neeg nyiag kuv MacBook, thawj qhov kuv ua yog thaiv nws thiab tua tag nrho "forwarding" thiab txuas ntxiv ntawm iPhone - yog vim li cas tseem muaj qhov kev xaiv no hauv Chaw / Cov Lus. :)
Thiab yog hais tias ib tug neeg hooks rau koj, koj puas tseem nres nws?
Thiab vim li cas thiaj muaj kev tso cai ob-kauj ruam thaum koj tuaj yeem thaiv cov cuab yeej raug nyiag tam sim ntawd, huh?
Kev txheeb xyuas ob kauj ruam yog qhov kev pabcuam thib peb, yog li kuv tsis tuaj yeem siv nws lossis tsis quav ntsej nws, yam tsawg kawg ntawm cov tsev txhab nyiaj. Thiab kuv thaiv lossis rho tawm kuv Mac ntawm Nrhiav Kuv Mac. Cov txiaj ntsig ntawm SMS xa tawm ntau dua yog tias kuv tsis pom dab ntxwg nyoog qab txhua yam.
Tsis muaj leej twg mob siab txog tub sab nyiag, tag nrho disk encryption daws qhov ntawd. Tab sis koj yuav ua li cas nrog lub computer hacked? Tej zaum tsis muaj dab tsi, koj yuav tsis paub txog nws.
Zoo, ntawm chav kawm, qhov zoo yeej, tsis muaj leej twg pom dab ntxwg nyoog thiab cov neeg siv ib txwm ua lag luam kev ruaj ntseg rau tus npua dancing.
Los ntawm txoj kev, koj puas muaj kev xav tias cov tsev txhab nyiaj yuam kom koj xa SMS rau kev lom zem?
yog leej twg txhawj ces txhob siv. Kuv txaus siab heev rau nws
Thiab cov uas tsis muaj kev txhawj xeeb nrog 2FA tsis txawm siv nws, vim lawv pom tseeb tsis paub tias lawv ua dab tsi.
Thiab kuv yuav ua li cas cais tus lej tshwj xeeb ntawm Macbook thiab tso nws ntawm iPhone? Ua tsaug rau cov lus teb
AFAIK qhov kev xaiv zoo tshaj plaws yog "hloov tawm Cov Ntawv Xov Xwm xa mus hauv qab Cov Lus hauv Chaw (los ntawm koj lub iPhone).
Yog tias kuv tsis yuam kev, nws tsis tuaj yeem ua whitelist dab tsi yuav tsum tau xa mus, lossis blacklist dab tsi tsis yog.
Zoo, nws tsis yooj yim rau nyiag lub xov tooj ntawm tes dua li Mac? Yog lawm, koj tuaj yeem muaj tus password rau txawb, tab sis kuj rau MAC. Kuv tsis yog kws tshaj lij, tab sis tej zaum nws yuav tsis yooj yim rau Mac yog tias kuv tsis paub tus password (Kuv tsis tau txhais hais tias nyeem cov ntaub ntawv, tab sis nkag mus rau hauv kom SMS relay pib).
Tsis tas li ntawd, tsis txhob hnov qab tias peb tab tom tham txog kev ruaj ntseg ob npaug, qhov twg thawj theem yog qhov tseem ceeb - nkag mus rau lo lus zais kom hwm thiab yog tias koj tsis muaj nws sau rau ntawm MAC lossis hauv qee cov ntawv hauv, ces muaj. tsis muaj kev nkag mus rau lub txhab nyiaj (thiab koj tsis siv 1111 ua tus password :-))
Yog li, nyiag mac tej zaum yuav ua rau koj puas tsuaj loj tshaj plaws vim yog tus nqi tiag tiag ntawm mac.
2FA tsis daws thawj Mac lossis IP tub sab. Qhov kev daws teeb meem yog tias tus neeg tawm tsam yuav tsum tau txais kev tswj hwm ntawm Mac thiab lwm yam. Lub Mac yog txaus rau nws tam sim no. Coz negates tag nrho cov txiaj ntsig ntawm 2FA.
(Cov lus qhia yog los tiv thaiv "tus neeg tawm tsam ntawm Mac tsuas yog tswj hwm qhov browser" sib txawv, uas tej zaum tsis yog qhov xwm txheej tswj tau tag nrho.)
Nws tsuas yog tias yog tias koj xav txog Mac kom nyab xeeb tag nrho (haha), ces koj tsis tas yuav nrog 2FA. Thiab yog tias tsis yog, ces 2FA nres coj koj qhov kev ruaj ntseg ntxiv, xws li tsav.
Thiab ib zaug ntxiv, vividly - koj mus rau lub vev xaib "nicnebezpecneho.cz", uas yog txaus ntshai vim muaj xwm txheej tsis zoo. Qhov no tuaj yeem tshwm sim rau koj yooj yim heev - koj tsis tas yuav mus rau qhov chaw porn tam sim ntawd, nws txaus rau ib tus neeg tsis muaj kev nyab xeeb rau blog koj tuaj xyuas thiab cia cov javascript tsis raug tso rau hauv cov lus. Muaj qhov kev siv tej thaj chaw deb rau koj tus browser ntawm nplooj ntawv ntawd (qhov no tseem tuaj yeem tshwm sim rau koj, tsis muaj dab tsi txawv heev). Los yog ntes tau hauv social engineering ...
... tom qab ob peb teev koj mus xa nyiaj los ntawm lub txhab nyiaj (koj nkag rau hauv gmail, github...). Ua li no, koj nkag mus rau cov ntaub ntawv nkag mus rau hauv lub khoos phis tawj uas twb muaj lawm (lossis koj tsis tas yuav ua li ntawd yog tias koj muaj cov passwords khaws tseg) thiab luam thiab muab cov lej los ntawm SMS ib zaug.
..thiab hmo ntuj, koj lub computer nkag mus rau hauv lub txhab nyiaj (gmail...) ntawm nws tus kheej, tus password twb tau txais kev cawmdim los ntawm ib tug neeg uas muaj malware. Koj yuav tsis tau txais kev lees paub SMS ntawm koj lub xov tooj ntawm tes, tab sis ... nyob rau hauv lub computer compromised.
2FA daws cov xwm txheej no raws nraim. Txog thaum Apple tsoo nws.
Kuv xav tias 2FA txhais tau tias kuv yuav tsum ua pov thawj kuv tus kheej los ntawm 2 yam, piv txwv li:
- tus password
- nrog lub xov tooj uas lees txais SMS
Zoo, xa SMS rau Mac rau lub xov tooj kuj ntxiv rau Mac (lossis ntau dua Mac thiab iPad uas kuv tau ua khub) ua lwm txoj hauv kev, tab sis nws tseem yog 2FA. Los tsis?
Ib zaug ntxiv - nyob rau hauv ib txwm muaj xwm txheej, 2FA daws cov xwm txheej zoo li "kuv Mac raug nyiag thiab kuv tsis paub txog nws". Vim hais tias tom qab ntawd koj tuaj yeem xav tias Mac paub koj tus password rau qhov kev pabcuam (uas koj twb tau khaws cia lossis yuav mloog nws lub sijhawm tom ntej koj nkag rau hauv qhov kev pabcuam). Thiab tam sim no koj tuaj yeem cia siab tias nws tseem yuav paub SMS (lossis nws tuaj yeem thov nws txhua lub sijhawm thiab nws yuav tau txais).
Feem ntau cov kev pabcuam uas muaj ob qhov kev lees paub tseeb (Facebook, Dropbox, Google, Microsoft, ...) tso cai rau tus password ib zaug los tsim siv lub app (Kuv siv Google Authenticator). Daim ntawv thov tas li tsim cov lej txwv sijhawm rau cov kev pabcuam sau npe. Cov lej tuaj yeem luam tau tam sim ntawd thiab siv los nkag rau hauv. Koj tsis tas yuav tos kom SMS tuaj txog thiab, yog tias lawv xa mus rau Mac, daws qhov teeb meem tau piav qhia hauv tsab xov xwm.
Kev cuam tshuam macs muaj SMS lus thaum nkag rau hauv ...
Xav thov kom tau qhov ntawd. Yog tias kuv tau qhib ob-theem pov thawj nrog lub cim ntawm ib-lub sij hawm siv daim ntawv thov, ces qhov kev pab cuam yuav tsis xa SMS.
Yog tias qee yam tsis tau hloov pauv, ntau cov kev pabcuam xav tau lub xov tooj thiab sab laug SMS raws li qhov kev xaiv ua ntej. Yog li koj lub computer hacked rov qab.
Nrog ntau lub tsev txhab nyiaj, tsis muaj kev xaiv, tsuas yog SMS thiab qhov ntawd yog nws.
Kuv tsis to taub qhov no meej heev. Yog hais tias ib tug neeg nyiag kuv Mac, kuv tua SMS, remotely so lub Mac thiab hloov tus password ntawm lub txhab nyiaj. Los yog dab tsi yog qhov ntes?
Koj puas yuav ua li ntawd ua ntej nyeem tsab xov xwm no?
kiag li, kiag li.
Tab sis ob-theem authentication yog hais txog qhov tseeb tias tus neeg tawm tsam xav tau ob qhov kev lees paub: PASSWORD AND SMS. Qhov no txhais tau hais tias yog tias kuv ntshai tias ib tus neeg yuav coj kuv tus khub Mac, kuv tsis khaws tus password rau ntawd, thiab yog tias ib tus neeg nyiag kuv lub browser, lawv yuav tsis nkag rau hauv iMessage.
Qhov twg koj tau txais kev lees paub tias nws yuav tsis tawg tawm ntawm koj lub browser? Raws li cov txiaj ntsig tam sim no ntawm Pwn4Fun thiab Pwn2Own, nws zoo li muaj tsawg kawg ob hnub rau Safari:
"Ntawm Pwn4Fun, Google xa tawm qhov kev siv tau zoo heev tawm tsam Apple Safari launching Tshuab xam zauv li hauv paus rau Mac OS X"
"Los ntawm Liang Chen ntawm Keen Team:
Tawm tsam Apple Safari, ib qho kev hla dhau nrog rau lub sandbox bypass, ua rau kev ua txhaum cai. "
Nyias ntawv dawb rau ntawm keeb kwm ntsuab - tsis yog ib tug me nyuam kawm ntawv ntawm ib lub tsev kawm ntawv tshwj xeeb tuaj yeem hais tias nws zoo dua ...
Ib txoj hauv kev los txwv qhov no yog hloov cov cim cim ntawm lub dongle (piv txwv li qhov no: http://www.czc.cz/battlenet-authenticator/110449/produkt?gclid=Cj0KEQiAs6GjBRCy2My09an6uNIBEiQANfY4zKhlCIiwD9za5e_QYUAp_YEpqdA9frjVqnS9i8sgIgsaAh558P8HAQ ) nws muaj kev nyab xeeb thiab nws ua kom muaj kev ruaj ntseg dua, KB kuj yuav tsum ua qee yam zoo sib xws - daim ntawv pov thawj muab tso rau hauv USB disk, yam tsis muaj tus neeg tuaj yeem txuas rau Is Taws Nem banking, ntxiv rau qee lub sij hawm ib zaug xa tus password rau hauv xov tooj, thiab lwm yam. ... Muaj ntau txoj hauv kev, tab sis txhua tus muaj lawv tus kheej nws yuav tsum txiav txim siab tias kev ruaj ntseg tseem ceeb rau nws (yog tias nws muaj tus password lossis tsis? thiab lwm yam)
Unicredit muaj qhov zoo heev. Tus yuam sij ntse yeej tsis yog SMS classic, tab sis kuv tsim tus password ib zaug hauv daim ntawv thov mobile.
Kuv xav tau cov lus qhia vim li cas kuv mam li xa tsis tau mm luv video, uas tau mus txog rau tam sim no? Tsis muaj kev xaiv yooj yim ntxig ib qho video, nws tsis teb, nws tsis ntxig rau hauv cov lus
Ua tsaug