{"id":117814,"date":"2024-07-18T15:43:01","date_gmt":"2024-07-18T13:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi"},"modified":"2024-07-18T15:43:01","modified_gmt":"2024-07-18T13:43:04","slug":"ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","title":{"rendered":"Port Shadow-angrebet, der muligg\u00f8r omdirigering af forbindelser for andre brugere af VPN og Wi-Fi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En gruppe forskere fra canadiske og amerikanske universiteter har udviklet en angrebsteknik kaldet Port Shadow, der g\u00f8r det muligt at manipulere med overs\u00e6ttelsestabeller for adresser p\u00e5 VPN-serveren for at sende svar p\u00e5 foresp\u00f8rgsler til en anden bruger, der er tilsluttet den samme VPN-server. Metoden kan bruges til at organisere opsnapning eller omdirigering af krypteret trafik, udf\u00f8re portscanning og de-anonymisering af VPN-brugere. Som eksempel vises, hvordan metoden kan bruges til at omdirigere DNS-foresp\u00f8rgsler fra en bruger, der arbejder gennem en VPN-server, som angriberen har mulighed for at tilslutte sig, til angriberens host. <\/p>\n

For at udf\u00f8re angrebet skal angriberen have mulighed for at oprette forbindelse til den samme VPN<\/a>-server som offeret, hvilket er muligt, for eksempel ved brug af standard VPN-udbydere og offentlige VPN-tjenester, der giver adgang til alle interesserede. S\u00e5rbarheden ber\u00f8rer VPN-servere, der bruger adressetranslation (NAT) for at organisere klienters adgang til eksterne ressourcer, hvor det kr\u00e6ves, at en og samme IP-adresse anvendes til at modtage trafik fra klienter og sende foresp\u00f8rgsler til eksterne websteder. serveren<\/a> der skal bruges den samme IP-adresse. <\/p>\n

Angrebet bygger p\u00e5, at ved at sende specielt formaterede foresp\u00f8rgsler, kan angriberen, der er tilsluttet den samme VPN-server og bruger en delt NAT, opn\u00e5 forvridning af indholdet i overs\u00e6ttelsestabellerne for adresser, hvilket vil resultere i, at pakker, der er adresseret til en bruger, bliver sendt til en anden bruger. I overs\u00e6ttelsestabellerne bestemmes informationen om, hvilken intern IP-adresse den sendte foresp\u00f8rgsel er knyttet til, baseret p\u00e5 det originale netv\u00e6rksportnummer, der blev brugt ved sendt foresp\u00f8rgsel. Angriberen kan ved at sende visse SYN- og ACK-pakker samt samtidig manipulere med klientforbindelsen til VPN-serveren og den kontrollerede angriberens eksterne server, skabe en kollision i NAT-tabellen og tilf\u00f8je en post med det samme originale portnummer, men knyttet til hans lokale adresse, hvilket vil resultere i, at svar p\u00e5 en andens foresp\u00f8rgsel returneres til angriberens adresse.

\"Port<\/center> <\/p>\n

I l\u00f8bet af unders\u00f8gelsen blev systemer til adresseovers\u00e6ttelse i Linux og FreeBSD testet i kombination med VPN OpenVPN, OpenConnect og WireGuard. Platformen FreeBSD viste sig ikke at v\u00e6re modtagelig for metoder til angreb ved omdirigering af foresp\u00f8rgsler, der blev udf\u00f8rt af andre brugere tilsluttet den samme VPN. Inds\u00e6ttelse i NAT-tabellerne kunne kun foretages under angrebet ATIP (Adjacent-to-In-Path), hvor en angriber kan tr\u00e6nge ind i trafikken mellem brugeren og VPN-serveren (for eksempel n\u00e5r brugeren tilsluttes et Wi-Fi-netv\u00e6rk kontrolleret af angriberen) eller mellem VPN-serveren og det m\u00e5lrettede websted. Desuden blev NAT p\u00e5 FreeBSD ogs\u00e5 ramt af et angreb, der g\u00f8r det muligt at bestemme, om en bruger er tilsluttet et bestemt websted (Connection Inference). <\/p>\n

Hvad ang\u00e5r Linux, viste Netfilter-subsystemet sig at v\u00e6re modtageligt for angreb, hvor der inds\u00e6ttes poster i adresseovers\u00e6ttelsestabellen, hvilket muligg\u00f8r omdirigering af indg\u00e5ende pakker til en anden bruger, tvinge pakker til at sendes uden for den krypterede VPN-kanal (Decapsulation) eller bestemme \u00e5bne netv\u00e6rksporte p\u00e5 klientsiden.

\"Port<\/center> <\/p>\n

Som foranstaltninger til at blokere angrebet anbefales VPN-udbydere at anvende passende metoder til tilf\u00e6ldigg\u00f8relse af de udg\u00e5ende portnumre i NAT, begr\u00e6nse antallet af samtidige forbindelser til VPN-serveren fra \u00e9n bruger samt blokere muligheden for, at klienten v\u00e6lger den netv\u00e6rksport, der modtager foresp\u00f8rgsler p\u00e5 VPN-serverens side. <\/p>\n

If\u00f8lge en repr\u00e6sentant fra virksomheden Proton AG p\u00e5virker angrebet ikke VPN-tjenester, der bruger separate IP-adresser til indg\u00e5ende og udg\u00e5ende foresp\u00f8rgsler. Der er desuden tvivl om angrebets anvendelighed mod reelle VPN-tjenester, da et vellykket angreb indtil videre kun er blevet demonstreret i laboratorietests, og det kr\u00e6ver opfyldelse af bestemte betingelser p\u00e5 VPN-serverens og den angrebne klients side. Derudover kan angrebet v\u00e6re nyttigt kun til manipulation af ukrypterede foresp\u00f8rgsler, s\u00e5som anmodninger til DNS, mens brugen af TLS og HTTPS p\u00e5 applikationsniveau g\u00f8r trafikomdirigering meningsl\u00f8s. <\/p>\n

Manipulation of address translation tables for attacks applies not only to VPNs but also to wireless networks, where NAT is used to connect users to external resources on the access point. Last month, a study was published on the possibility of conducting a similar attack to intercept TCP connections of other users within a wireless network. The attack method proved applicable to 24 out of 33 tested wireless access points.

\"Port<\/center> <\/p>\n

The proposed Wi-Fi attack turned out to be significantly simpler than the aforementioned method for VPNs, as many access points, due to optimizations, do not verify the correctness of sequence numbers in TCP packets. As a result, it was sufficient to send a fake RST packet to clear the entry in the address translation table, and then achieve the redirection of the response to the attacker's host to determine the necessary sequence (SEQ) and acknowledgment (ACK) numbers for intercepting the TCP connection.

\"Port<\/center>
\"Port<\/center>
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0445 \u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441 \u0434\u0440\u0443\u0433\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c\u0443 \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0443. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u0434\u0435\u0430\u043d\u043e\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117815,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117814","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Port Shadow Attack, enabling redirection of other users' VPN and Wi-Fi connections | ProHoster","description":"A group of researchers from Canadian and American universities developed the Port Shadow attack technique, which allows for the redirection of responses through manipulation of address translation tables on the VPN server side.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN \u0438 Wi-Fi | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0445 \u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-18T13:43:04+00:00","article:modified_time":"2024-07-18T13:43:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117814","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:00:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 04:28:19","updated":"2026-02-09 22:00:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/117814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=117814"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/117814\/revisions"}],"predecessor-version":[{"id":160055,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/117814\/revisions\/160055"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/117815"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=117814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=117814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=117814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}