{"id":84662,"date":"2020-06-10T01:42:15","date_gmt":"2020-06-09T23:42:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti"},"modified":"2020-06-10T01:42:15","modified_gmt":"2020-06-09T23:42:15","slug":"uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","title":{"rendered":"Zranitelnost v UPnP vhodn\u00e1 pro zes\u00edlen\u00ed DDoS \u00fatok\u016f a skenov\u00e1n\u00ed vnit\u0159n\u00ed s\u00edt\u011b","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Odhalen\u00e9<\/a><\/noindex> informace o zranitelnosti<\/a><\/noindex> (CVE-2020-12695<\/a><\/noindex>) v protokolu UPnP, kter\u00fd umo\u017e\u0148uje organizovat zas\u00edl\u00e1n\u00ed provozu jak\u00e9mukoli p\u0159\u00edjemci pomoc\u00ed standardn\u00ed operace \u201eSUBSCRIBE\u201c. Zranitelnosti bylo p\u0159id\u011bleno k\u00f3dov\u00e9 jm\u00e9no CallStranger<\/a><\/noindex>. Zranitelnost m\u016f\u017ee b\u00fdt vyu\u017eita k extrakci dat z s\u00edt\u00ed chr\u00e1n\u011bn\u00fdch syst\u00e9my pro prevenci \u00faniku dat (DLP), k portov\u00e9mu skenov\u00e1n\u00ed po\u010d\u00edta\u010d\u016f vnit\u0159n\u00ed s\u00edt\u011b, a tak\u00e9 k zes\u00edlen\u00ed DDoS \u00fatok\u016f pomoc\u00ed milion\u016f za\u0159\u00edzen\u00ed p\u0159ipojen\u00fdch k glob\u00e1ln\u00ed s\u00edti UPnP, jako jsou kabelov\u00e9 modemy, domovn\u00ed sm\u011brova\u010de, hern\u00ed konzole, IP kamery, TV boxy, mediacentra a tisk\u00e1rny.<\/p>\n

Probl\u00e9m byl zp\u016fsoben<\/a><\/noindex> t\u00edm, \u017ee specifikovan\u00e1 funkce \u201eSUBSCRIBE\u201c umo\u017e\u0148uje jak\u00e9mukoli extern\u00edmu \u00fato\u010dn\u00edkovi pos\u00edlat HTTP pakety s hlavi\u010dkou Callback a pou\u017e\u00edvat za\u0159\u00edzen\u00ed UPnP jako proxy pro zas\u00edl\u00e1n\u00ed po\u017eadavk\u016f na jin\u00e9 hostitele. Funkce \u201eSUBSCRIBE\u201c je definov\u00e1na ve specifikaci UPnP a pou\u017e\u00edv\u00e1 se k sledov\u00e1n\u00ed zm\u011bn v jin\u00fdch za\u0159\u00edzen\u00edch a slu\u017eb\u00e1ch. Pomoc\u00ed HTTP hlavi\u010dky Callback lze ur\u010dit libovolnou URL, na kterou se za\u0159\u00edzen\u00ed pokus\u00ed p\u0159ipojit. <\/p>\n

\"Zranitelnost<\/a><\/noindex><\/center><\/p>\n

Probl\u00e9m se t\u00fdk\u00e1 t\u00e9m\u011b\u0159 v\u0161ech implementac\u00ed UPnP, kter\u00e9 byly vyd\u00e1ny p\u0159ed specifikaci<\/a><\/noindex>, 17. dubnem. V\u010detn\u011b zranitelnosti bylo potvrzeno<\/a><\/noindex> v otev\u0159en\u00e9m bal\u00ed\u010dku hostapd<\/a><\/noindex> s implementac\u00ed bezdr\u00e1tov\u00e9ho p\u0159\u00edstupov\u00e9ho bodu (WPS AP). Oprava je zat\u00edm dostupn\u00e1 ve form\u011b z\u00e1plat<\/a><\/noindex>. V distribuc\u00edch zat\u00edm nebyla vyd\u00e1na aktualizace (Debian<\/a><\/noindex>, OpenWRT<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>). Probl\u00e9m tak\u00e9 ovliv\u0148uje<\/a><\/noindex> \u0159e\u0161en\u00ed zalo\u017een\u00e1 na otev\u0159en\u00e9m UPnP stacku pupnp<\/a><\/noindex>, informace o oprav\u00e1ch pro kter\u00e9 zat\u00edm nejsou k dispozici.<\/p>\n

Protokol UPnP ur\u010duje mechanismus pro automatick\u00e9 zji\u0161\u0165ov\u00e1n\u00ed za\u0159\u00edzen\u00ed v m\u00edstn\u00ed s\u00edti a interakci s nimi. Protokol byl p\u016fvodn\u011b navr\u017een pro vyu\u017eit\u00ed ve vnit\u0159n\u00edch lok\u00e1ln\u00edch s\u00edt\u00edch a ne\u0159\u00edk\u00e1 nic o jak\u00fdchkoli form\u00e1ch autentizace a ov\u011b\u0159ov\u00e1n\u00ed. I p\u0159es to miliony za\u0159\u00edzen\u00ed nep\u0159eru\u0161uj\u00ed podporu UPnP na extern\u00edch s\u00ed\u0165ov\u00fdch rozhran\u00edch a z\u016fst\u00e1vaj\u00ed dostupn\u00e9<\/a><\/noindex> pro po\u017eadavky z glob\u00e1ln\u00ed s\u00edt\u011b. \u00datok m\u016f\u017ee b\u00fdt proveden prost\u0159ednictv\u00edm jak\u00e9hokoli takov\u00e9ho UPnP za\u0159\u00edzen\u00ed.
\nNap\u0159\u00edklad hern\u00ed konzole Xbox One mohou b\u00fdt napadeny p\u0159es s\u00ed\u0165ov\u00fd port 2869, proto\u017ee umo\u017e\u0148uj\u00ed sledovat pomoc\u00ed p\u0159\u00edkazu SUBSCRIBE takov\u00e9 zm\u011bny, jako je poskytov\u00e1n\u00ed sd\u00edlen\u00ed obsahu.<\/p>\n

Organizace Open Connectivity Foundation (OCF) byla o probl\u00e9mu informov\u00e1na na konci lo\u0148sk\u00e9ho roku, ale zpo\u010d\u00e1tku odm\u00edtla pova\u017eovat ho za zranitelnost v specifikaci. Po podrobn\u011bj\u0161\u00edm hl\u00e1\u0161en\u00ed bylo uzn\u00e1no, \u017ee probl\u00e9m existuje, a do specifikace byla p\u0159id\u00e1na doporu\u010den\u00ed pro pou\u017e\u00edv\u00e1n\u00ed UPnP pouze na LAN rozhran\u00edch. Vzhledem k tomu, \u017ee probl\u00e9m byl zp\u016fsoben nedostatkem ve standardu, m\u016f\u017ee oprava zranitelnosti u jednotliv\u00fdch za\u0159\u00edzen\u00ed trvat dlouho, a u star\u0161\u00edch za\u0159\u00edzen\u00ed nemus\u00ed b\u00fdt k dispozici aktualizace firmwaru.<\/p>\n

Jako obchvaty ochrany se doporu\u010duje izolovat za\u0159\u00edzen\u00ed UPnP od extern\u00edch po\u017eadavk\u016f pomoc\u00ed br\u00e1ny firewall, blokovat extern\u00ed HTTP po\u017eadavky \u201eSUBSCRIBE\u201c a \u201eNOTIFY\u201c na syst\u00e9mech pro prevenci \u00fatok\u016f nebo deaktivovat protokol UPnP na extern\u00edch s\u00ed\u0165ov\u00fdch rozhran\u00edch. V\u00fdrobci by m\u011bli deaktivovat funkci SUBSCRIBE v z\u00e1kladn\u00edm nastaven\u00ed a omezit jej\u00ed pou\u017e\u00edv\u00e1n\u00ed pouze na p\u0159\u00edjem po\u017eadavk\u016f z vnit\u0159n\u00ed s\u00edt\u011b.
\nPro testov\u00e1n\u00ed zranitelnosti sv\u00fdch za\u0159\u00edzen\u00ed byla vyd\u00e1na<\/a><\/noindex> speci\u00e1ln\u00ed n\u00e1stroj napsan\u00fd v jazyce Python a vyd\u00e1van\u00fd pod licenc\u00ed MIT. <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-12695) \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 UPnP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u044e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u043d\u0443\u044e \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044e «SUBSCRIBE». \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f CallStranger. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0441\u0435\u0442\u0435\u0439, \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445 (DLP), \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84663,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-84662","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v UPnP, vhodn\u00e1 pro zes\u00edlen\u00ed DDoS \u00fatok\u016f a skenov\u00e1n\u00ed vnit\u0159n\u00ed s\u00edt\u011b | ProHoster","description":"Byly odhaleny informace o","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 UPnP, \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a \u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-09T23:42:15+00:00","article:modified_time":"2020-06-09T23:42:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84662","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:53:24","updated":"2022-09-27 14:10:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/84662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=84662"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/84662\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/84663"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=84662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=84662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=84662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}