{"id":117239,"date":"2024-07-10T15:43:03","date_gmt":"2024-07-10T13:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii"},"modified":"2024-07-10T15:43:03","modified_gmt":"2024-07-10T13:43:04","slug":"uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","title":{"rendered":"Zranitelnost v protokolu RADIUS, kter\u00e1 umo\u017e\u0148uje fal\u0161ov\u00e1n\u00ed odpov\u011bdi p\u0159i autentizaci","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f z n\u011bkolika americk\u00fdch univerzit a spole\u010dnost\u00ed Cloudflare a Microsoft vyvinula novou techniku \u00fatoku na protokol RADIUS, kter\u00fd vyu\u017e\u00edvaj\u00ed oper\u00e1to\u0159i, cloudov\u00e9 slu\u017eby a poskytovatel\u00e9 VPN k autentizaci, autorizaci a \u00fa\u010detnictv\u00ed u\u017eivatel\u016f. \u00datok, kter\u00fd dostal kryc\u00ed n\u00e1zev Blast-RADIUS, umo\u017e\u0148uje pad\u011blat odpov\u011b\u010f RADIUS-serveru b\u011bhem autentizace a zorganizovat p\u0159ipojen\u00ed u\u017eivatele bez znalosti p\u0159\u00edstupov\u00e9ho hesla. <\/p>\n

K vyu\u017eit\u00ed zranitelnosti (CVE-2024-3596) mus\u00ed \u00fato\u010dn\u00edk m\u00edt mo\u017enost odposlechnout p\u0159enosov\u00fd provoz a prov\u00e9st plnohodnotn\u00fd \u00fatok MITM, kter\u00fd umo\u017e\u0148uje \u010d\u00edst, odposlouch\u00e1vat, blokovat a m\u011bnit p\u0159\u00edchoz\u00ed a odchoz\u00ed p\u0159enosov\u00e9 UDP pakety, kter\u00e9 jsou pos\u00edl\u00e1ny p\u0159\u00edstupov\u00fdmi body pro \u017e\u00e1dost o autentizaci klient\u016f (Access-Request) a vraceny RADIUS-serverem s potvrzen\u00edm nebo odm\u00edtnut\u00edm operace. Pokud \u00fato\u010dn\u00edk zachyt\u00ed \u017e\u00e1dost o autentizaci, m\u016f\u017ee poslat pad\u011blanou odpov\u011b\u010f, uveden\u00edm jin\u00e9ho typu v\u00fdsledku (nap\u0159. Access-Accept m\u00edsto Access-Reject). \u00dato\u010dn\u00edk tak\u00e9 m\u016f\u017ee potenci\u00e1ln\u011b zachytit odpov\u011b\u010f Access-Challenge pou\u017e\u00edvanou p\u0159i dvoufaktorov\u00e9 autentizaci a nahradit ji odpov\u011bd\u00ed Access-Accept, aby obe\u0161el dodate\u010dnou kontrolu.

\"Zranitelnost<\/center> <\/p>\n

\u00datok vych\u00e1z\u00ed z toho, \u017ee protokol RADIUS pou\u017e\u00edv\u00e1 jako transport UDP a ov\u011b\u0159uje integritu p\u0159en\u00e1\u0161en\u00fdch zpr\u00e1v pomoc\u00ed algoritmu MD5. Pro ov\u011b\u0159en\u00ed zpr\u00e1v, kter\u00e9 se p\u0159en\u00e1\u0161ej\u00ed mezi serverem<\/a> p\u0159\u00edstupov\u00fdm bodem a RADIUS-serverem, se pou\u017e\u00edv\u00e1 tajn\u00fd kl\u00ed\u010d, kter\u00fd je zn\u00e1m p\u0159\u00edstupov\u00e9mu bodu a RADIUS-serveru, ale nen\u00ed zn\u00e1m \u00fato\u010dn\u00edkovi. V odpov\u011bdi na \u017e\u00e1dost o autentizaci RADIUS-server generuje MD5 hash, pomoc\u00ed n\u011bho\u017e se p\u0159\u00edstupov\u00fd server m\u016f\u017ee ujistit, \u017ee zpr\u00e1vu poslal autorizovan\u00fd server. MD5 hash pokr\u00fdv\u00e1 n\u00e1hodnou hodnotu zaslanou v \u017e\u00e1dosti, identifik\u00e1tor \u017e\u00e1dosti, vracen\u00e9 atributy a tajn\u00fd kl\u00ed\u010d. <\/p>\n

\u00dato\u010dn\u00edk b\u011bhem MITM \u00fatoku m\u016f\u017ee zachytit identifik\u00e1tor a n\u00e1hodnou hodnotu p\u0159edanou v po\u017eadavku, a tak\u00e9 m\u016f\u017ee p\u0159edv\u00eddat k\u00f3d operace, velikost a atributy. C\u00edlem je vytvo\u0159en\u00ed spr\u00e1vn\u00e9ho kontroln\u00edho hash, kter\u00fd bude odpov\u00eddat zm\u011bn\u011bn\u00e9mu v\u00fdsledku operace a projde ov\u011b\u0159en\u00edm pomoc\u00ed hashov\u00e1n\u00ed se skryt\u00fdm kl\u00ed\u010dem. Algoritmus MD5 nen\u00ed odoln\u00fd v\u016f\u010di koliz\u00edm, co\u017e umo\u017e\u0148uje \u00fato\u010dn\u00edkovi manipulovat s bezv\u00fdznamn\u00fdm p\u0159\u00eddavn\u00fdm vypln\u011bn\u00edm, aby na\u0161el kombinaci dat s po\u017eadovan\u00fdmi parametry, jej\u00ed\u017e MD5 hash bude shodn\u00fd s MD5 hashem p\u016fvodn\u00ed odpov\u011bdi, a poslat fale\u0161nou odpov\u011b\u010f s k\u00f3dem \u00fasp\u011b\u0161n\u00e9ho ov\u011b\u0159en\u00ed (Access-Accept) m\u00edsto zpr\u00e1vy s informac\u00ed o chyb\u011b.

\"Zranitelnost<\/center> <\/p>\n

Jeliko\u017e p\u0159i zpracov\u00e1n\u00ed paket\u016f s po\u017eadavkem na p\u0159\u00edstup (Access-Request) nen\u00ed aplikov\u00e1no ov\u011b\u0159ov\u00e1n\u00ed a kontrola integrity, m\u016f\u017ee \u00fato\u010dn\u00edk do p\u016fvodn\u00edho po\u017eadavku v pr\u016fb\u011bhu \u00fatoku vlo\u017eit serveru<\/a> \u00fato\u010dn\u00edk m\u016f\u017ee p\u0159idat dal\u0161\u00ed atribut \u201eProxy-State\u201c, kter\u00fd bude vr\u00e1cen zp\u011bt RADIUS serverem ve sv\u00e9 odpov\u011bdi. Obsah \u201eProxy-State\u201c je vyb\u00edr\u00e1n s ohledem na kolize, tak\u017ee hodnoty kontroln\u00edho MD5 hash v re\u00e1ln\u00fdch a fal\u0161ovan\u00fdch odpov\u011bd\u00edch budou shodn\u00e9. B\u011bhem experimentu vyhled\u00e1n\u00ed kolize v MD5 pro proveden\u00ed \u00fatoku trvalo 3-6 minut, co\u017e je v\u00edce ne\u017e typick\u00fd \u010dasov\u00fd limit 30-60 sekund, ale doba pot\u0159ebn\u00e1 k nalezen\u00ed kolize m\u016f\u017ee b\u00fdt zkr\u00e1cena pomoc\u00ed v\u00fdkonn\u011bj\u0161\u00edho hardwaru, zapojen\u00edm GPU a paralelizac\u00ed operac\u00ed. <\/p>\n

Jako hlavn\u00ed opat\u0159en\u00ed na ochranu proti t\u00e9to zranitelnosti se doporu\u010duje vyu\u017eit\u00ed protokolu EAP (Extensible Authentication Protocol, RFC 3579), ve kter\u00e9m se pro dodate\u010dn\u00e9 ov\u011b\u0159ov\u00e1n\u00ed zpr\u00e1v pou\u017e\u00edv\u00e1 atribut Message-Authenticator. Pro ochranu p\u0159ed \u00fatokem lze tak\u00e9 pou\u017e\u00edt roz\u0161\u00ed\u0159en\u00ed protokolu (RadSec), kter\u00e1 zahrnuj\u00ed p\u0159enos RADIUS zpr\u00e1v prost\u0159ednictv\u00edm \u0161ifrovan\u00fdch kan\u00e1l\u016f zalo\u017een\u00fdch na TLS nebo DTLS. Krom\u011b toho je mo\u017en\u00e9 zkr\u00e1tit hodnoty \u010dasov\u00fdch limit\u016f pro p\u0159ijet\u00ed odpov\u011bdi na minimum a zablokovat odpov\u011bdi s atributem Proxy-State. P\u0159enos RADIUS zpr\u00e1v p\u0159es TCP komplikuje \u00fatok, ale nevylu\u010duje jeho proveden\u00ed. <\/p>\n

K\u00f3d pro proveden\u00ed \u00fatoku dosud nebyl zve\u0159ejn\u011bn, ale projektu hashclash byly p\u0159ed\u00e1ny zm\u011bny, kter\u00e9 zlep\u0161uj\u00ed vyhled\u00e1v\u00e1n\u00ed koliz\u00ed v MD5 s ohledem na specifika \u00fatoku. V serveru FreeRADIUS byla probl\u00e9m odstran\u011bn ve verz\u00edch 3.0.27 a 3.2.5 zaveden\u00edm povinn\u00e9ho pou\u017eit\u00ed atributu Message-Authenticator a p\u0159id\u00e1n\u00edm nastaven\u00ed pro omezen\u00ed zpracov\u00e1n\u00ed paket\u016f s atributem Proxy-State.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Cloudflare \u0438 Microsoft \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b RADIUS, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430\u043c\u0438 \u0441\u0432\u044f\u0437\u0438, \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 \u0438 VPN-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c\u0438 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0438\u043d\u0433\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0410\u0442\u0430\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Blast-RADIUS, \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0442\u0432\u0435\u0442 RADIUS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0430 \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117240,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117239","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v protokolu RADIUS, kter\u00e1 umo\u017e\u0148uje podvrhnout odpov\u011b\u010f p\u0159i autentizaci | ProHoster","description":"Skupina v\u00fdzkumn\u00edk\u016f z n\u011bkolika americk\u00fdch univerzit a firem Cloudflare a Microsoft vyvinula novou techniku \u00fatoku na protokol RADIUS, kter\u00fd vyu\u017e\u00edvaj\u00ed mobiln\u00ed oper\u00e1to\u0159i a cloudov\u00e9 slu\u017eby.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 RADIUS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0442\u0432\u0435\u0442 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Cloudflare \u0438 Microsoft \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b RADIUS, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430\u043c\u0438 \u0441\u0432\u044f\u0437\u0438, \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 \u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-10T13:43:04+00:00","article:modified_time":"2024-07-10T13:43:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117239","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:44:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:56:19","updated":"2026-02-22 15:44:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/117239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=117239"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/117239\/revisions"}],"predecessor-version":[{"id":162456,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/117239\/revisions\/162456"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/117240"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=117239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=117239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=117239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}