Guest
Guest
Sep 12, 2026
11:09 AM
|
Bao mat WIN55: Nhung lop phong ve that su dung sau tai khoan cua ban
Mot nguoi choi o da Nang nap 5 trieu dong vao tai khoan ca cuoc luc 11 gio dem, va cau hoi dau tien anh ta dat ra khong phai la ty le keo ma la so tien do dang nam o dau, ai giu, va neu co su co thi mat bao lau de lay lai. do cung la cau hoi ma phan lon nguoi dung nen tang ca cuoc truc tuyen nen hoi truoc khi bam nut nap tien dau tien. Bao mat WIN55 vi the khong phai mot dong quang cao in tren trang chu, ma la tap hop cua nhieu lop ky thuat chong len nhau, tu duong truyen, may chu, cho toi thoi quen cua chinh nguoi dung.
Khi noi ve an toan du lieu tren mot nen tang giai tri co giao dich tien that, thu dau tien can nhin la duong truyen. Toan bo ket noi giua thiet bi cua nguoi choi va he thong WIN55 chay qua giao thuc TLS 1.3 voi chung chi Extended Validation. Noi cach de hieu: du lieu duoc boc lai truoc khi roi khoi may ban, va chi mo ra khi toi dung may chu dich. Neu ai do ngoi cung quan ca phe va bat goi tin wifi, ho chi thay mot chuoi ky tu vo nghia. Giao thuc TLS 1.3 rut ngan bat tay xuong con mot vong, dong thoi loai bo cac thuat toan ma hoa cu nhu RSA key exchange hay CBC mode von tung dinh lo hong nghiem trong trong nhieu nam.
Phia may chu, du lieu tinh duoc ma hoa bang AES-256, chuan ma chinh phu My dung cho tai lieu toi mat. Khoa ma hoa duoc luan chuyen dinh ky va luu trong module phan cung HSM tach biet voi may chu ung dung. Nghia la ke ca truong hop ke tan cong choc duoc vao mot may chu web, ho van khong cam duoc chia khoa de doc co so du lieu. Cach bo tri nay giong mo hinh ma cac ngan hang so o dong Nam a dang ap dung tu nam 2021 tro di.
Mat khau la mat xich yeu nhat trong gan nhu moi vu ro ri tai khoan, va day la cho nhieu nguoi choi hieu sai. WIN55 khong luu mat khau dang van ban, cung khong luu dang MD5 hay SHA-1. Mat khau duoc bam bang bcrypt voi he so cong viec (cost factor) dat o muc 12, kem salt rieng cho tung tai khoan. Voi cau hinh do, mot may tram dung 8 card do hoa cao cap chi thu duoc khoang vai nghin to hop moi giay, trong khi bcrypt cost 12 chi cho phep vai tram phep thu moi giay. Chenh lech do bien viec do mat khau hang loat tu vai gio thanh vai thap ky.
Xac thuc hai lop nen la mac dinh, khong phai tuy chon. WIN55 ho tro 2FA qua ung dung TOTP nhu Google Authenticator hoac Authy, voi ma 6 so doi moi 30 giay. Khi bat 2FA, ke co duoc mat khau van khong vao duoc tai khoan. diem dang chu y la he thong phat hien dang nhap bat thuong dua tren ba yeu to: dia chi IP, dau van tay thiet bi (device fingerprint gom thong so man hinh, phien ban trinh duyet, danh sach font chu), va hanh vi duyet web. Mot tai khoan thuong dang nhap tu Ha Noi bong xuat hien tu mot IP o dong au luc 3 gio sang se bi chan tam thoi va yeu cau xac minh qua email da dang ky.
Quy trinh xac minh danh tinh, hay KYC, la phan khien nhieu nguoi choi kho chiu nhung lai la la chan quan trong nhat chong chiem doat tai khoan. Khi rut tien lan dau, nguoi dung can gui anh can cuoc cong dan hoac ho chieu kem anh chan dung tu chup theo goc yeu cau. Hinh anh duoc doi chieu tu dong bang thuat toan nhan dien khuon mat, sau do chuyen cho nhan vien kiem tra thu cong trong truong hop co sai lech. Tai lieu KYC duoc ma hoa va luu trong vung luu tru rieng, chi nhom nhan su tuan thu duoc cap quyen truy cap, va moi lan truy cap deu ghi log kem ma nhan vien cung dau thoi gian. Thoi gian xu ly trung binh cho mot ho so dat chuan roi vao khoang 15 den 45 phut.
Chuyen tien bac can noi rieng. WIN55 ap dung nguyen tac khong luu so the ngan hang duoi bat ky hinh thuc nao. Khi ban nhap so the, du lieu duoc chuyen thang toi cong thanh toan doi tac dat chuan PCI DSS Level 1, va he thong chi nhan lai mot token cung bon so cuoi de hien thi trong lich su giao dich. Neu co so du lieu cua nen tang bi xam nhap, ke tan cong cung chi co duoc nhung token vo dung ngoai he thong thanh toan goc. Voi vi dien tu nhu Momo hay ZaloPay, luong tien di qua API co chu ky so, moi yeu cau kem mot nonce dung mot lan de chan kieu tan cong phat lai (replay attack).
He thong chong gian lan van hanh song song va lien tuc. Moi tai khoan co mot diem rui ro duoc tinh lai theo thoi gian thuc, dua tren hang chuc tin hieu: toc do dat cuoc, so tai khoan dung chung mot IP, mau nap tien bat thuong, hay viec nhieu tai khoan cung dang nhap tu mot thiet bi. Mot nhom tai khoan dung chung may, choi cung mot tro trong khung gio co dinh, se bi danh dau trong vong vai gio. Bo phan rui ro sau do co the tam khoa de dieu tra thay vi de tien chay ra ngoai. Trong nam 2023, cac nen tang ca cuoc khu vuc dong Nam a ghi nhan ty le gian lan tai khoan chiem khoang 1,2% tong so tai khoan hoat dong, va phan lon trong do lien quan toi tai khoan trung lap hoac mua ban tai khoan.
Tinh cong bang cua tro choi cung la mot phan cua bao mat, theo nghia rong hon. Voi cac tro co yeu to ngau nhien, WIN55 dung bo sinh so ngau nhien RNG duoc kiem dinh boi don vi doc lap nhu iTech Labs hoac BMM Testlabs. Moi van choi deu co the truy vet nho ma hash gan voi seed cua phien. Nguoi choi muon kiem tra co the xem lai log cua minh, doi chieu voi ma cong bo truoc khi van bat dau. Co che commit-reveal nay khien nen tang khong the sua ket qua sau khi nguoi choi da dat cuoc, vi lam vay hash se khong khop.
Phia nguoi dung van la mat xich quyet dinh, va day la cho toi thay nhieu nguoi choi tu ha thap la chan cua minh. Ba sai lam pho bien nhat: dung lai mat khau da dung o noi khac, tat 2FA vi thay phien, va dang nhap vao duong link gia mao gui qua tin nhan. Chieu lua dao pho bien hien nay la tin nhan mao danh thong bao trung thuong kem link yeu cau dang nhap, thuc chat la trang web sao chep giao dien. Cach phan biet duy nhat dang tin la kiem tra ten mien va khong bao gio dang nhap tu link trong tin nhan. Voi mat khau, mot chuoi 16 ky tu ngau nhien luu trong trinh quan ly mat khau an toan hon nhieu so voi mat khau 8 ky tu "de nho" ma ban dung o muoi noi khac nhau.
Nen tang cung nen co kenh bao loi bao mat. WIN55 duy tri chuong trinh bug bounty tra thuong theo muc do nghiem trong: lo hong cho phep chiem tai khoan nguoi khac nam o khung cao nhat, loi ro ri thong tin it nghiem trong hon nam o khung thap hon. Cach lam nay bien nhung nguoi tan cong co dao duc thanh mot phan cua he thong phong thu, thay vi de ho ban lo hong cho ke xau. Ben canh do, doi ngu an ninh thuc hien kiem thu xam nhap dinh ky moi quy, kem danh gia lo hong tu dong hang tuan tren toan bo he thong.
Mot diem it duoc noi toi la quy trinh xu ly su co. Khi co su kien bao mat, toc do phan ung quan trong hon moi loi hua. He thong giam sat hoat dong 24/7 voi canh bao tu dong gui toi doi truc khi phat hien dau hieu bat thuong nhu so lan dang nhap that bai tang vot, hay luu luong truy van co so du lieu vuot nguong cho phep. Muc tieu dat ra la phat hien trong vong 15 phut va co lap su co trong vong mot gio. Trong truong hop du lieu nguoi dung bi anh huong, nen tang co nghia vu thong bao cho nguoi dung bi tac dong va huong dan doi mat khau, thu hoi phien dang nhap.
Nhin tong the, bao mat tren mot nen tang ca cuoc truc tuyen giong nhu mot can nha co nhieu cua. Khoa cua chinh la mat khau, camera la he thong giam sat, ket sat la ma hoa du lieu, va bao hiem la quy trinh xu ly su co. Khong lop nao du mot minh. Nhung diem khac biet giua mot nen tang lam nghiem tuc va mot nen tang lam cho co nam o cho ho co chiu cong khai cach minh bao ve nguoi dung hay khong, co cho phep kiem dinh doc lap hay khong, va co tra tien cho nguoi phat hien loi cua minh hay khong.
Nguoi choi khong can tro thanh chuyen gia an ninh mang de tu bao ve minh. Bat 2FA, dung mat khau rieng cho tung tai khoan, kiem tra ten mien truoc khi dang nhap, khong chia se ma OTP cho bat ky ai ke ca nguoi tu xung la nhan vien ho tro. Bon viec do xu ly duoc phan lon rui ro ma ban co the gap. Phan con lai la trach nhiem cua nen tang, va do la phan can duoc danh gia bang hanh dong cu the chu khong phai bang nhung dong cam ket in tren trang chu. Mot he thong bao mat tot la he thong im lang — ban chi nhan ra no ton tai khi co chuyen xay ra, va dieu dang mong nhat la no khong bao gio phai len tieng.
|
To enhance your user experience on our website, this site uses cookies.
If you continue to browse, you accept the use of cookies on our site.
See our Privacy Policy
for more information.
