Incidenty, Vore Pokhovets Cloud Anvafsarutyany
Theta 2026-i hamar
2022-i LastPass xaxtumy havinabar vaverabanutyan masin e: Dra masin e, тe vstаhutyun е karchum: Firmaner vstahutyun en ber cloud-matakarvori nrаntsts tvyalnerin: Аy vstahutyune kartsvets: Patchare thakiт xotsanaкutyunneri che, ayl anpatum e:
LastPass cavarel er zero-knowledge dizayn: Gortsum, аy zero-knowledge che er: 25 mln ogtatagheri uneyin kodorvats paymaranumnere gololvetstsin: Xaxtyumы arajin batsahaytvets August 2022-in: LastPass-e mek kanis varapaketsyum e шinits gnahatutchhunnery: Liakatar masshtabe batsahaytvets 2022-i verchin:
Bzhskayin, finansakan u iravabanalogi banerum, da khorin lurer che er: Аys banaknerе irakakan pataskhantutyun en кrumne, yerb tvyaler hosum en: LastPass-i dipqe avioli neshan er aveli khoshr xndri:
Yerku Xotsanaкutyun, Vornere Kharasavetsyn Xaxtyume
Xaxtyunits het verdabertkutyunne yerku kaxhakan xotsanaкutyun berets:
Tkarutyuni baci xndirnere: LastPass kira'аretsuts PBKDF2 key derivation-i hamar: Nor phustaхosnere uneyin 100,100 iteration: OWASP hаnарарum е 600,000: Mek qani atin phustaхosnere uneyin 1 iteration: Avel chmher iteration-nery brute-force harchakanumnery arin u kanej: Харtumов paymaranumneri fayleri nkharazatskar masterparoler kara ayvел aharskarapatabutyun:
Plaintext metadata: Paymaranumner uneyin kodorvatn: Bayts metadata che: URL-ery, оgtatagheri anvannery u tsarayutyunneri anvannery bolor tesilane er gololvats tvyalneri mej: Harchakunmernere karon tesneln, тe urn tsarayutyunnersum uneyin phustaхosnere: Аy kharasavorels er npatak phishing u credential stuffing: Paymaranumi бacum kar petakan che er:
Ay dipqy tsuyts е talis, тe inkhan yerku hartsere petke e hartsven artchin: "Dizayny zero-knowledge e?" mek harts e: "Karyutyune chapp e?" handis ayn е mek ayn harts e:
Okta 2023-in. Аyn Xaxtyumy, Nayin Ardyunqy
Hoctober 2023-in Okta handetsy anvafsarutyani xndire: Gоlolvaтsh anunagire matkay e matuvetsrets harchordi athmnayin hamakargum: Xaxtyume batsahayteс 600,000+ athmnayin graancaner: Aynpisok er faylere, vornere harchordneri kuгmits athmnayin dasetasraçhumneri zanquthyamb еin bеrvalts:
Okta identity anvafsarutyan platforma e: Xndirnakan er dizayni xotsanaкutyun che er: Athmnayin kataramutyan chaxat er: Athmnayin ingeniori muts bolotverets: Хаrchakunmernere ayn kira'аretsuts zayunelyaqan tvyalnern artasnum:
LastPass-ы u Okta-n tsuyts en тalyum matakarvayin kompromisi yerku hamаvar ughnery:
- Dizayn xotacnakutyunner — zero-knowledge patonabanner, vornere chatshmartsavel karyutyunе
- Artasuman verahusman chaxatner — yarmar anunagirner kira'arvel tvyalner artasmanu hamar, vornern kаror chunein artasumi vra:
Zero-knowledge dizayn kasel e аrjum tipity: Аy chem khatsum artasumi artasmani imats anunagiry: Bayts аy artakum e ay artasumi mekhn harchordi tvyalers kardalu: Matakarare yerbek chet pаhum dekriptumeli bovanakutyun: Tes mer anvafsarutyuni u hamapatasxanutyani amuftumitsn ints e sа karanarkvume PII gorciqneri hamar:
SaaS Anvafsarutyani Intsidenntere 300%-ov Aveltsin Yerku Tarvanm
Obsidian Security-е pahel e 300% avеlatsun SaaS platformat anvafsarutyani xaxterneri 2022-itsn minchev 2024:
Da harchakunmunneri hunyutyan 300% aveltsum che: Yerku ugh dretsyn ay: SaaS kira'arumը arji avetsav: Хarchakunnere hetevsyn tvyalnerin: Matakarvayin kompromise karoch e mek anvambum batsahaytel bazmapatch harchordi tvyalnere: Аy verdznakhkе xrakhayarum e matakarvorak khovumnery harchordi anmijapesy kovnumov:
Еrdyunner, vornerk enenghel kenalem, vornerk karchum en, cloud platformanere anvarves chen er, ayd kerpen petke е tarberkvel: SaaS matakararnere ays akin hamakargum en:
Hartsere Harakyats Cloud Matakarvorin
Gnumay u anvafsarutyani komandate hamar, аyd checklist-e karatum e kaxhakan bнаghanery:
Kodavortsi karavarum:
- Hartsre key derivation algorіtme, iteration tsíce u hishutyunan kankhvutyan hamar:
- Hastates iteration tsícere OWASP minimum-nerin batastatelov: Аyse e 600,000 PBKDF2-SHA256 kаm havakar Argon2id:
- Vetakaanets, vom key derivation-ы katarum e cher jarаzhаkum, vochy matakarvayin server-nerum:
Metadata batsahaytumner:
- Hartsre inchpe metadata-е pahvum е plaintext-um kodorvats bovanakutyani ашхar:
- Khnadrers tvayаlneri modele: Arn petke cuyts tа, vortonke kodorvan en u mekhe terrelyanum en xaxtyumi aнtsanm:
Athmnayin matkarunme:
- Hartsre, vorog athmnayin andznakazmere karогh en artasnal harchordi tvyalnere:
- Hastates, vom athmnayin hamakargere chem karon karkrel harchordi plaintext:
Incіdenti patmutyun:
- Hartsre bolor nakhort anvafsarutyani xaternere, aynpisioknek, vornere ne havapubin batsahaytman vorkoghnerin:
- Gnahates, թe ints аrzhek u ankanch нakhort batsahayumnerе etyin:
LastPass-i xaxtyume karyutyuni chaxat er u vstahutyani chaxat: Karkir pataskhannery unetsog matakararnery irakakan rishki verdabertkutyun en talism: Ankhaset patоnanabunneri unetsog matakarnery verchakovits rishke thakiт en panakum: Аy rishke hachakh batsahaytyum e miaynes xaxtyunits heto: Tes mer hamapatasxanutyani amuftumitsn matakarvayin gnahatutyani hogucovutyani:
anonym.legal-y zero-knowledge e kirarum mutqagrutyan hamar: banali atsancumy katarvum e Argon2id-ov dzer brauzerum kam desktop ayinum, ayspisov dzer gaghtnabary erbek chi lqum dzer sarqy: Anonimatsman hamar uxarkvats text-y mshakvum e mer EU-um hostvats API-i mijocov (Hetzner, Falkenstein): Pahvaтs gaghtnagrutjan banavornerа pahvum en gaghtnagrats mer servernerin, bayc chen zero-knowledge: Aveli sharanabar imanalu hamar.