{"id":100142,"date":"2021-05-12T10:22:35","date_gmt":"2021-05-12T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/fragattacks-seriya-uyazvimostej-standartah-i-realizacziyah-wi-fi"},"modified":"2021-05-12T10:22:35","modified_gmt":"2021-05-12T08:22:39","slug":"fragattacks-seriya-uyazvimostej-standartah-i-realizacziyah-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/fragattacks-seriya-uyazvimostej-standartah-i-realizacziyah-wi-fi","title":{"rendered":"FragAttacks \u2014 s\u00e9rie zranitelnost\u00ed ve standardech a implementac\u00edch Wi-Fi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Mathy Vanhoef, autor \u00fatoku KRACK na bezdr\u00e1tov\u00e9 s\u00edt\u011b, zve\u0159ejnil informace o 12 zranitelnostech, kter\u00e9 se t\u00fdkaj\u00ed r\u016fzn\u00fdch bezdr\u00e1tov\u00fdch za\u0159\u00edzen\u00ed. Zji\u0161t\u011bn\u00e9 probl\u00e9my jsou ozna\u010dov\u00e1ny n\u00e1zvem FragAttacks a pokr\u00fdvaj\u00ed prakticky v\u0161echny b\u011b\u017en\u011b pou\u017e\u00edvan\u00e9 bezdr\u00e1tov\u00e9 karty a p\u0159\u00edstupov\u00e9 body \u2014 ze 75 testovan\u00fdch za\u0159\u00edzen\u00ed bylo ka\u017ed\u00e9 vystaveno alespo\u0148 jednomu z uveden\u00fdch metod \u00fatoku. <\/p>\n
Probl\u00e9my jsou rozd\u011bleny do dvou kategori\u00ed: 3 zranitelnosti byly odhaleny p\u0159\u00edmo ve standardech Wi-Fi a pokr\u00fdvaj\u00ed v\u0161echna za\u0159\u00edzen\u00ed podporuj\u00edc\u00ed aktu\u00e1ln\u00ed standardy IEEE 802.11 (probl\u00e9my trvaj\u00ed od roku 1997). 9 zranitelnost\u00ed se t\u00fdk\u00e1 chyb a nedostatk\u016f v konkr\u00e9tn\u00edch realizac\u00edch bezdr\u00e1tov\u00fdch protokol\u016f. Hlavn\u00ed nebezpe\u010d\u00ed p\u0159edstavuje druh\u00e1 kategorie, proto\u017ee organizace \u00fatok\u016f na nedostatky standard\u016f vy\u017eaduje specifick\u00e1 nastaven\u00ed nebo proveden\u00ed ur\u010dit\u00fdch akc\u00ed ob\u011bt\u00ed. V\u0161echny zranitelnosti se projevuj\u00ed nez\u00e1visle na pou\u017e\u00edv\u00e1n\u00ed protokol\u016f pro zabezpe\u010den\u00ed Wi-Fi, v\u010detn\u011b WPA3. <\/p>\n
V\u011bt\u0161ina zji\u0161t\u011bn\u00fdch metod \u00fatok\u016f umo\u017e\u0148uje \u00fato\u010dn\u00edkovi prov\u00e9st substituci r\u00e1mc\u016f L2 v zabezpe\u010den\u00e9 s\u00edti, co\u017e d\u00e1v\u00e1 mo\u017enost zas\u00e1hnout do provozu ob\u011bti. Jako nejrealisti\u010dt\u011bj\u0161\u00ed sc\u00e9n\u00e1\u0159 \u00fatoku se zmi\u0148uje z\u00e1m\u011bna odpov\u011bd\u00ed DNS k nasm\u011brov\u00e1n\u00ed u\u017eivatele na hostitele \u00fato\u010dn\u00edka. Tak\u00e9 se uv\u00e1d\u00ed p\u0159\u00edklad vyu\u017eit\u00ed zranitelnost\u00ed k obch\u00e1zen\u00ed p\u0159ekladatele adres na bezdr\u00e1tov\u00e9m routeru a zaji\u0161t\u011bn\u00ed p\u0159\u00edm\u00e9ho p\u0159\u00edstupu k za\u0159\u00edzen\u00ed v lok\u00e1ln\u00ed s\u00edti nebo ignorov\u00e1n\u00ed omezen\u00ed firewallu. Druh\u00e1 \u010d\u00e1st zranitelnost\u00ed, kter\u00e1 souvis\u00ed s zpracov\u00e1n\u00edm fragmentovan\u00fdch r\u00e1mc\u016f, umo\u017e\u0148uje extrakci dat o provozu v bezdr\u00e1tov\u00e9 s\u00edti a zachycen\u00ed \u00fadaj\u016f u\u017eivatele p\u0159en\u00e1\u0161en\u00fdch bez \u0161ifrov\u00e1n\u00ed. <\/p>\n
V\u00fdzkumn\u00edk p\u0159ipravil demonstraci, kter\u00e1 ukazuje, jak lze vyu\u017e\u00edt zranitelnosti k odcizen\u00ed hesla p\u0159en\u00e1\u0161en\u00e9ho p\u0159i p\u0159\u00edstupu na web pomoc\u00ed protokolu HTTP bez \u0161ifrov\u00e1n\u00ed. Tak\u00e9 je uk\u00e1z\u00e1no, jak za\u00fato\u010dit na chytrou z\u00e1suvku \u0159\u00edzenou p\u0159es Wi-Fi a vyu\u017e\u00edt ji jako z\u00e1kladnu pro pokra\u010dov\u00e1n\u00ed \u00fatoku na neaktualizovan\u00e1 za\u0159\u00edzen\u00ed v m\u00edstn\u00ed s\u00edti, kter\u00e1 maj\u00ed neopraven\u00e9 zranitelnosti (nap\u0159\u00edklad se poda\u0159ilo, pomoc\u00ed obch\u00e1zen\u00ed NAT, za\u00fato\u010dit na neaktualizovan\u00fd po\u010d\u00edta\u010d s Windows 7 v intern\u00ed s\u00edti).
\r\n \r\n
<\/div>\r\n <\/div><\/center> <\/p>\n
Aby \u00fato\u010dn\u00edk mohl zranitelnosti vyu\u017e\u00edt, mus\u00ed se nach\u00e1zet v dosahu c\u00edlov\u00e9ho bezdr\u00e1tov\u00e9ho za\u0159\u00edzen\u00ed, aby mohl ob\u011bti zaslat specificky upravenou sadu paket\u016f. Probl\u00e9my se t\u00fdkaj\u00ed jak klientsk\u00fdch za\u0159\u00edzen\u00ed a bezdr\u00e1tov\u00fdch karet, tak p\u0159\u00edstupov\u00fdch bod\u016f a Wi-Fi router\u016f. Obecn\u011b jako ochrann\u00e1 opat\u0159en\u00ed sta\u010d\u00ed pou\u017eit\u00ed HTTPS v kombinaci s \u0161ifrov\u00e1n\u00edm DNS provozu pomoc\u00ed DNS over TLS nebo DNS over HTTPS. Pro ochranu je tak\u00e9 vhodn\u00e1 aplikace VPN<\/a>. <\/p>\n
![\"P\u0159ehr\u00e1t](\"https:\/\/img.youtube.com\/vi\/88YZ4061tYw\/hqdefault.jpg\")
\r\n ![\"FragAttacks](\"\/wp-content\/uploads\/2021\/05\/bf3fed5fd117b86ac96dc8f23e8cd879.png\")
<\/center>\n![\"FragAttacks](\"\/wp-content\/uploads\/2021\/05\/e7acd01c5864ae3371f16440c3e47c2c.png\")
<\/center>\n![\"FragAttacks](\"\/wp-content\/uploads\/2021\/05\/ef87a0afaee47e83071d8d2a55815a2e.png\")
<\/center> <\/ul>\n![\"FragAttacks](\"\/wp-content\/uploads\/2021\/05\/d255c5ffdb38c2a61a8da50a889167cd.png\")
<\/center> <\/p>\n![\"FragAttacks](\"\/wp-content\/uploads\/2021\/05\/06dd228788a85d2275ea19fd698202e0.png\")
<\/center> <\/p>\n![\"FragAttacks](\"\/wp-content\/uploads\/2021\/05\/d3f3aa83a669cdc60710baff04493a92.png\")
<\/center> <\/p>\n