Vimba umbhalo ocacile ezinhlelweni ze-Android ngaphandle kokuthembela ku-VPN

Izinto ezimbili ezihluke ngokuphelele zibizwa ngokuthi ukuvimba umbhalo ocacile ku-Android. Enye inqubomgomo engaphakathi kohlelo lokusebenza eyala isiteki sayo senethiwekhi ukuthi senqabe i-HTTP elula. Enye ilungiselelo lezinga ledivayisi elizama ukuvikela konke ocingweni ngesikhathi esisodwa, ngokuvamile ngokudlulisa ithrafikhi nge-VPN. Zixazulula izinkinga ezihlukene, futhi eyesibili ayikwazi ukulungisa eyokuqala: ithumbu livikela ingxenye ephakathi kocingo nokuphuma, kuyilapho uhlelo lokusebenza olukhuluma i-HTTP lusakhuluma i-HTTP nakho konke okungale kwayo ngale kokuphuma.

Izinkinga ezimbili ngaphansi kwegama elilodwa

Inkinga yokuqala umthwalo: uhlelo lokusebenza lubhala ubufakazi noma amathokheni esicelweni esingashifriwe kusukela ekuqaleni kuze kube sekupheleni, ngakho konke ukweqa okungayibona kungakwazi ukuyifunda. Eyesibili indlela: uhlelo lokusebenza lungase lulunge ngokuphelele, futhi usafuna ukuthi umqhubi we-Wi-Fi wendawo angafundi lutho ngokuthi luxhumana kuphi. I-VPN ibhekana neyesibili futhi neyesibili kuphela.

Lowo mehluko unquma ukuthi ubani ungumnikazi wesilungiso. Umthwalo ungowalowo oletha uhlelo lokusebenza, ngoba yilowo khodi kuphela onquma ukuthi iyiphi i-URL eshiwo nokuthi isitifiketi siqinisekiswa yini. Indlela ingeyedivayisi noma ingeyenethiwekhi, ngoba umbuzo uwukuthi amaphakethe aya kuphi, hhayi ukuthi aqukethe ini.

Indlela yokuqala: uhlelo lokusebenza olulawulayo

Uma uwukuphela oletha uhlelo lokusebenza, isilungiso yisinqumo sokuthutha kanye nenqubomgomo eyisiphakamisayo. Khomba yonke indawo yokugcina ku-HTTPS, gcina ukuqinisekiswa kwegama lomsingathi nesitifiketi kuvuliwe, futhi susa indlela yokubuyela ku-HTTP elula esikhundleni sokuyishiya ibanga lefulegi elilodwa lokucushwa. Ukudlulisela kwesinye isikhathi akusizi lapha: isicelo se-HTTP esithola u-301 sesivele sithumele izihloko nomzimba waso obala, ngakho ubufakazi abumele buhambe ngokucabanga ukuthi ukudlulisela kuzobuvikela.

Kusukela ku-Android 7.0, i-Network Security Configuration iveza inqubomgomo. Ifayela elingezansi iyinguqulo encane esebenzayo: lenqaba umbhalo ocacile yonke indawo ngaphandle uma okuhlukile okuthile kwesizinda kusho okunye.

<network-security-config>
    <base-config cleartextTrafficPermitted="false" />
</network-security-config>

Khombisa leyo nsiza kusuka kumfanekiso, bese ufunda okuhlukile okukhona kakade ngaphambi kokuletha. Isizinda sakudala sokulungisa noma ukufakwa kwe-SDK yomhlinzeki wokukhokha kungase kuvumele futhi buthule umbhalo ocacile kumsingathi obuwuzama ukuvikela.

Imininingwane emibili yenguqulo kufanele yaziwe. Izinhlelo ezihlose i-API 28 noma entsha kakhulu sezivele zenqaba umbhalo ocacile ngokuzenzakalela, ngakho uhlelo olusakhuluma i-HTTP elula luhlosa izinga le-API elidala noma lunokuhlukile kwenye indawo. Futhi lapho kukhona ukucushwa kokuphepha kwenethiwekhi, isimo somfanekiso esidala android:usesCleartextTraffic asisanqumi lowo mbuzo, yingakho ukushintsha lelo fulegi kube sengathi akwenzi lutho.

Indlela yesibili: uhlelo lokusebenza ongalulawuli

Kuhlelo lokusebenza lomuntu wesithathu olufakiwe awukwazi ukubhala kabusha ukucushwa kwalo kokuphepha ngelungiselelo lomsebenzisi. Izinketho ezingokoqobo umlawuli womkhiqizo uqobo wokuxhumana okuphephile, enye indlela enakekelwayo esivele isebenzisa i-TLS, noma inqubomgomo yedivayisi elawulwayo evimbela lokho idivayisi engakwenza. Lezi yizibopho ezihlukene, futhi eyesithathu kuphela ekwanda kuyo yonke imikhakha yedivayisi.

Imithetho yenethiwekhi iyizinto ezingena esikhundleni ezibuthakathaka kunalokho ezibonakala. Ukuvumela kuphela imbobo 443 akukuphoqeleli i-TLS eqinisekisiwe, ngoba izivumelwano eziningi zombhalo ocacile zingadluliselwa kuleyo mbobo, futhi ukuvimba imbobo 80 akumbozi umbhalo ocacile kwezinye izimbobo. Indlela ye-HTTPS kuphela yesiphequluli nayo ikhawulelwe kuleso siphequluli, hhayi kuhlelo lwe-imeyili noma lwengxoxo oluhlukile ocingweni olufanayo.

Ukufaka isitifiketi sokungena ukuze ithrafikhi ibonakale ishifriwe ukushintsha kokwethembela, hhayi isilungiso. Kufaka esikhundleni sokuqinisekiswa kweseva kohlelo lokusebenza okwakho, futhi uhlelo olungazange luqinisekise izitifiketi kusukela ekuqaleni alulungiswa yilokho; ushaqisa nje ukuthi ubani ongafunda umfudlana.

I-VPN isiza kuphi futhi ayisizi kuphi

Ithumbu iyithuluzi elifanele lapho isidingo siwukuthi inethiwekhi yendawo ingafundi lutho ngokuxhumana, noma uhlelo lokusebenza lufinyelele isevisi eyimfihlo olungeke luyifinyelele ngenye indlela. Liyithuluzi elingalungile lokwenza iklayenti le-HTTP likhulume i-HTTPS, ngoba isicelo siphuma ethumbini ngendlela efanayo nokungena kwaso.

I-Android yengeza umkhawulo ongokoqobo: inkundla isebenzisa isevisi eyodwa ye-VPN ngesikhathi esisodwa. Uhlelo lokusebenza lokuhlunga lwendawo oluthatha leso sikhala luncintisana nethumbu elikude oludinga ngempela, futhi ukushintshela phakathi kwazo kuyisenzo sezinga ledivayisi hhayi sezinga lohlelo lokusebenza. Leso sikhala esisodwa siyisizathu esihle sokugcina inqubomgomo yomthwalo kuhlelo lokusebenza nokugcina ithumbu endleleni.

Icala kuphela lapho zombili zihlangana khona iseva eyimfihlo oyisebenzisayo nawe. Lapho ithumbu lingenza indlela ibe yimfihlo nakuba iphrothokholi isengumbhalo ocacile, okunciphisa ukuchayeka kodwa akushintshi ukuthi umthwalo uyini. Kubheka njengokunciphisa ingozi, hhayi njengokushifra idatha.

Yini okufanele ihlolwe ngaphambi kokuyibiza ngokuthi ivinjiwe

Qala ngokuzenzakalela okumangaza abantu: uhlelo lokusebenza oluhlose i-API 28 noma entsha kakhulu kufanele lube selunqabile umbhalo ocacile, ngakho hlola izinga elihlosiwe ngaphambi kokwengeza ukucushwa okuphindaphinda okuzenzakalelayo. Bese uhlola icala lokwehluleka ngamabomu: isicelo kumsingathi we-HTTP elula kufanele sehluleke, hhayi ukuphumelela buthule ngendlela yokubuyela emuva.

adb shell dumpsys package com.example.app | grep -E 'targetSdk|versionName'
adb logcat | grep -i cleartext

Ecaleni lokuphumelela, qinisekisa ukuthi ukushaya kwe-HTTPS kuqinisekisa uchungechunge lwezitifiketi lwangempela nokuthi ummeleli onesitifiketi esingathembekile uyenqatshwa kunokuba abekezelelwe. Ukuxhawulana okuphumelela kunoma yisiphi isitifiketi akufakazanga lutho ngokuphepha kokuthutha.

Kuhlelo lokusebenza lomuntu wesithathu, bhala umkhawulo ongawuphoqelela ngempela, kungaba inqubomgomo yedivayisi elawulwayo, umthetho wenethiwekhi noma lutho, futhi ukusho emikhakheni yokwamukela. umhlahlandlela wokucushwa kokuphepha kwe-Android ubala okuzenzakalelayo kwenkundla nokuthi yiziphi izingxenye ezihlonipha inqubomgomo, futhi yingxenye yiloyo enquma ukuthi ukucushwa kwakho kukhona yini okukwenzayo.