{"id":107780,"date":"2023-04-08T12:48:10","date_gmt":"2023-04-08T10:48:12","guid":{"rendered":"https:\/\/prohoster.info\/?p=107780"},"modified":"2023-04-10T11:12:07","modified_gmt":"2023-04-10T09:12:07","slug":"uyazvimost-v-besprovodnyh-tochkah-dostupa-pozvolyayushhaya-organizovat-perehvat-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-besprovodnyh-tochkah-dostupa-pozvolyayushhaya-organizovat-perehvat-trafika","title":{"rendered":"Zranitelnost v bezdr\u00e1tov\u00fdch p\u0159\u00edstupov\u00fdch bodech umo\u017e\u0148uj\u00edc\u00ed zachyt\u00e1v\u00e1n\u00ed provozu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f z univerzit Tsinghua (\u010c\u00edna) a George Mason (USA) odhalila zranitelnost (CVE-2022-25667) v bezdr\u00e1tov\u00fdch p\u0159\u00edstupov\u00fdch bodech, kter\u00e1 umo\u017e\u0148uje prov\u00e1d\u011bt odposlech provozu (MITM) v bezdr\u00e1tov\u00fdch s\u00edt\u00edch zabezpe\u010den\u00fdch pou\u017eit\u00edm protokol\u016f WPA, WPA2 a WPA3. \u00dato\u010dn\u00edk m\u016f\u017ee manipulac\u00ed s ICMP paketem s flagem \u201eredirect\u201c dos\u00e1hnout p\u0159esm\u011brov\u00e1n\u00ed provozu ob\u011bti uvnit\u0159 bezdr\u00e1tov\u00e9 s\u00edt\u011b p\u0159es sv\u016fj syst\u00e9m, co\u017e m\u016f\u017ee b\u00fdt pou\u017eito k odposlechu a podvr\u017een\u00ed nezabezpe\u010den\u00fdch relac\u00ed (nap\u0159\u00edklad \u017e\u00e1dost\u00ed na weby bez HTTPS). <\/p>\n

Zranitelnost je zp\u016fsobena nedostatkem \u0159\u00e1dn\u00e9ho filtrov\u00e1n\u00ed podvr\u017een\u00fdch ICMP zpr\u00e1v s pozm\u011bn\u011bnou adresou odes\u00edlatele (spoofing) v s\u00ed\u0165ov\u00fdch procesorech (NPU, Network Processing Unit), kter\u00e9 zaji\u0161\u0165uj\u00ed n\u00edzko\u00farov\u0148ov\u00e9 zpracov\u00e1n\u00ed paket\u016f v bezdr\u00e1tov\u00e9 s\u00edti. Mezi jin\u00fdm NPU p\u0159esm\u011brov\u00e1valy bez kontroly podvr\u017een\u00e9 ICMP pakety s flagem \u201eredirect\u201c, kter\u00e9 lze pou\u017e\u00edt ke zm\u011bn\u011b parametr\u016f sm\u011brovac\u00edch tabulek na stran\u011b ob\u011bti. \u00datok spo\u010d\u00edv\u00e1 v odesl\u00e1n\u00ed ICMP paketu jm\u00e9nem p\u0159\u00edstupov\u00e9ho bodu s flagem \u201eredirect\u201c s uv\u00e1d\u011bn\u00edm podvr\u017een\u00fdch \u00fadaj\u016f v z\u00e1hlav\u00ed paketu. V d\u016fsledku zranitelnosti je zpr\u00e1va p\u0159esm\u011brov\u00e1na p\u0159\u00edstupov\u00fdm bodem a zpracov\u00e1na s\u00ed\u0165ov\u00fdm z\u00e1sobn\u00edkem ob\u011bti, kter\u00fd se domn\u00edv\u00e1, \u017ee zpr\u00e1vu odeslal p\u0159\u00edstupov\u00fd bod.

\"Zranitelnost<\/center> <\/p>\n

Nav\u00edc v\u011bdci navrhli metodu pro obch\u00e1zen\u00ed kontrol ICMP paket\u016f s flagem \u201eredirect\u201c na stran\u011b koncov\u00e9ho u\u017eivatele a zm\u011bnu jeho routovac\u00ed tabulky. Aby obch\u00e1zeli filtrov\u00e1n\u00ed, \u00fato\u010dn\u00edk nejprve ur\u010d\u00ed aktivn\u00ed UDP port na stran\u011b ob\u011bti. Nach\u00e1zej\u00edc\u00ed se ve stejn\u00e9 bezdr\u00e1tov\u00e9 s\u00edti m\u016f\u017ee \u00fato\u010dn\u00edk zachyt\u00e1vat provoz, ale nem\u016f\u017ee ho de\u0161ifrovat, proto\u017ee nezn\u00e1 sezen\u00ed kl\u00ed\u010d pou\u017e\u00edvan\u00fd p\u0159i p\u0159\u00edstupu ob\u011bti k p\u0159\u00edstupov\u00e9mu bodu. P\u0159esto \u00fato\u010dn\u00edk, kter\u00fd pos\u00edl\u00e1 ob\u011bti kontroln\u00ed pakety, m\u016f\u017ee na z\u00e1klad\u011b anal\u00fdzy p\u0159\u00edchoz\u00edch ICMP odpov\u011bd\u00ed s flagem \u201eDestination Unreachable\u201c ur\u010dit aktivn\u00ed UDP port. D\u00e1le \u00fato\u010dn\u00edk vytv\u00e1\u0159\u00ed ICMP zpr\u00e1vu s flagem \u201eredirect\u201c a fale\u0161nou UDP hlavi\u010dkou, ve kter\u00e9 je uveden zji\u0161t\u011bn\u00fd otev\u0159en\u00fd UDP port. Zpracov\u00e1n\u00ed t\u00e9to zpr\u00e1vy vede k deformaci routovac\u00ed tabulky v syst\u00e9mu ob\u011bti a p\u0159esm\u011brov\u00e1n\u00ed provozu s mo\u017enost\u00ed jeho zachycen\u00ed v otev\u0159en\u00e9 podob\u011b na \u00farovni kan\u00e1lu.

\"Zranitelnost<\/center> <\/p>\n

Probl\u00e9m byl potvrzen u p\u0159\u00edstupov\u00fdch bod\u016f pou\u017e\u00edvaj\u00edc\u00edch \u010dipy vyr\u00e1b\u011bn\u00e9 firmami HiSilicon a Qualcomm. Studium 55 r\u016fzn\u00fdch model\u016f p\u0159\u00edstupov\u00fdch bod\u016f od 10 zn\u00e1m\u00fdch v\u00fdrobc\u016f (Cisco, NetGear, Xiaomi, Mercury, 360, Huawei, TP-Link, H3C, Tenda, Ruijie) uk\u00e1zalo, \u017ee v\u0161echny jsou n\u00e1chyln\u00e9 k zranitelnosti a neblokuj\u00ed fale\u0161n\u00e9 ICMP pakety. D\u00e1le p\u0159i anal\u00fdze 122 existuj\u00edc\u00edch bezdr\u00e1tov\u00fdch s\u00edt\u00ed byla zji\u0161t\u011bna mo\u017enost proveden\u00ed \u00fatoku v 109 s\u00edt\u00edch (89 %).

\"Zranitelnost<\/center> <\/p>\n

Aby \u00fato\u010dn\u00edk mohl zranitelnosti vyu\u017e\u00edt, mus\u00ed m\u00edt mo\u017enost leg\u00e1ln\u00edho p\u0159ipojen\u00ed k Wi-Fi s\u00edti, tj. mus\u00ed zn\u00e1t p\u0159ihla\u0161ovac\u00ed \u00fadaje do bezdr\u00e1tov\u00e9 s\u00edt\u011b (zranitelnosti umo\u017e\u0148uj\u00ed obch\u00e1zet mechanismy rozd\u011blen\u00ed provozu u\u017eivatel\u016f v r\u00e1mci protokol\u016f WPA*). Na rozd\u00edl od tradi\u010dn\u00edch MITM \u00fatok\u016f na bezdr\u00e1tov\u00e9 s\u00edt\u011b m\u016f\u017ee \u00fato\u010dn\u00edk pomoc\u00ed techniky spoofingu ICMP paket\u016f obej\u00edt nutnost nasazen\u00ed sv\u00e9ho fale\u0161n\u00e9ho p\u0159\u00edstupov\u00e9ho bodu pro odposlech provozu a vyu\u017e\u00edt leg\u00e1ln\u00ed p\u0159\u00edstupov\u00e9 body spravuj\u00edc\u00ed s\u00ed\u0165 k p\u0159esm\u011brov\u00e1n\u00ed speci\u00e1ln\u011b zformulovan\u00fdch ICMP paket\u016f k ob\u011bti.