{"id":855,"date":"2023-07-17T15:18:49","date_gmt":"2023-07-17T15:18:49","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/wordpress-dodatak-aios-je-pohranjivao-lozinke-u-nekriptiranom-obliku\/"},"modified":"2026-11-04T08:52:51","modified_gmt":"2026-11-04T08:52:51","slug":"wordpress-dodatak-aios-je-pohranjivao-lozinke-u-nekriptiranom-obliku","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/wordpress-dodatak-aios-je-pohranjivao-lozinke-u-nekriptiranom-obliku\/","title":{"rendered":"WordPress dodatak AIOS je pohranjivao lozinke u nekriptiranom obliku"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>AIOS (The All-In-One Security) dodatak je rje\u0161enje koje korisnicima nudi vatrozid za web aplikacije, za\u0161titu sadr\u017eaja i sigurnosni alat za prijavu u WordPress stranice.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Otkriveno je da AIOS v5.1.9 <\/strong>bilje\u017ei prijave, odjave te neuspje\u0161ne prijave korisnika, ali ujedno sprema i unesene lozinke. Ono \u0161to je nevjerojatno, je to da je <strong>lozinke pohranjivao u tzv.<em> plain text<\/em> (nekriptiranom) obliku.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Svaki servis koji brine o sigurnosti svojih korisnika, lozinke treba spremati u kriptiranom obliku, tj. u obliku <em>hash-<\/em>a. U tom slu\u010daju ni vlasnik servisa ne zna lozinke korisnika, a u slu\u010daju curenja podataka lozinke napada\u010du nisu korisne prije dekripcije.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a0680e373&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a0680e373\" class=\"aligncenter size-large is-resized wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/07\/image-3.png\" alt=\"\" class=\"wp-image-110985\" width=\"504\" height=\"51\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>Primjer: kako izgleda kriptirana lozinka (hash)<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/wordpress-aios-plugin-used-by-1m-sites-logged-plaintext-passwords\/\" target=\"_blank\" rel=\"noreferrer noopener\">BleepingComputer <\/a>navodi kako je izdano rje\u0161enje<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>AIOS je izdao verziju 5.2.0 koja ispravlja ovu gre\u0161ku i bri\u0161e dosad spremljene lozinke.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ovaj propust je mogao biti koban za korisnike u slu\u010daju kad bi administratori stranica koje koriste ovaj dodatak poku\u0161ali iskoristiti prikupljene lozinke za prijavu u druge sustave ili u slu\u010daju kad bi stranicu kompromitirao zlonamjerni akter.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ako administrirate stranicu koja koristi AIOS dodatak, a\u017eurirajte ga na najnoviju verziju kako bi za\u0161titili sebe i svoje korisnike.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">#SurfajSigurnije<\/p>","protected":false},"excerpt":{"rendered":"<p>AIOS (The All-In-One Security) dodatak je rje\u0161enje koje korisnicima nudi vatrozid za web aplikacije, za\u0161titu sadr\u017eaja i sigurnosni alat za prijavu u WordPress stranice. Otkriveno je da AIOS v5.1.9 bilje\u017ei prijave, odjave te neuspje\u0161ne prijave korisnika, ali ujedno sprema i unesene lozinke. Ono \u0161to je nevjerojatno, je to da je lozinke pohranjivao u tzv. plain [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1354,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-855","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/855","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=855"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/855\/revisions"}],"predecessor-version":[{"id":1360,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/855\/revisions\/1360"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1354"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=855"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=855"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=855"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}