{"id":115832,"date":"2024-05-16T14:59:26","date_gmt":"2024-05-16T12:59:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi"},"modified":"2024-05-16T14:59:26","modified_gmt":"2024-05-16T12:59:27","slug":"ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","title":{"rendered":"SSID Confusion r\u00fcnnak, mis v\u00f5imaldab Wi-Fi v\u00f5rgu petmist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Leuveni Katoliku \u00dclikooli (Belgia) teadlaste r\u00fchm tuvastas arhitektuurilise haavatavuse (CVE-2023-52424) IEEE 802.11 Wi-Fi standardis, mis v\u00f5imaldab luua \u00fchenduse v\u00e4hem turvalise traadita v\u00f5rguga, selle asemel, et \u00fchendada usaldusv\u00e4\u00e4rse v\u00f5rguga, millele kasutaja soovib \u00fchenduda. Seej\u00e4rel on v\u00f5imalik organiseerida liikluse pealtkuulamine ja manipuleerimine. Probleem ilmneb traadita protokollides igasugustes operatsioonis\u00fcsteemides ning m\u00f5jutab WPA3, WEP, EAP, AMPE ja FILS autentimismeetodeid. <\/p>\n

Pakutud r\u00fcnnetehnika, mille nimeks on SSID Confusion, v\u00f5imaldab m\u00f6\u00f6duda juurdep\u00e4\u00e4supunkti autentimise meetoditest, mis kaitsevad SSID v\u00f5rgu identifikaatori asendamise eest ja ei luba luua valev\u00f5rke sama nimega, millega klient \u00fchendub. Probleemi p\u00f5hjuseks on standardis s\u00e4testatud olukordade m\u00e4\u00e4ratlemine, millal SSID v\u00f5ib olla autentimata. Eelk\u00f5ige saadab juurdep\u00e4\u00e4supunkt oma kohaloleku t\u00e4histamiseks raadiosageduses beacon-raame, mis sisaldavad teavet SSID v\u00f5rgu kohta. Otsingu protsessi lihtsustamiseks ei autentida kliendid SSID-d nende andmete raames, kuna eeldatakse, et kontroll tuleb teha p\u00e4rast seda, kui klient on otsustanud v\u00f5rku \u00fchendada. <\/p>\n

Eduroami teenuste toetamine 2.4GHz ja 5GHz erinevate v\u00f5rkude loomise tavad, mis on haavatavad n\u00e4iteks KRACK v\u00f5i Frag r\u00fcnnakute suhtes. R\u00fcnnaku edukaks toimumiseks peab kasutaja looma \u00fchenduse kindla traadita v\u00f5rguga, samas peab l\u00e4heduses olema veel \u00fcks traadita v\u00f5rk, mille \u00fchendamisparameetrid langevad kokku esimese v\u00f5rguga. R\u00fcndaja peab olema signaali ulatuses, et sekkuda kasutaja ja sihtv\u00f5rgu vahel (MitM). R\u00fcnnaku teostamiseks ei pea r\u00fcndajal olema ohvri autentimisandmeid. <\/p>\n

R\u00fcnnak seisneb r\u00fcndaja juurdep\u00e4\u00e4supunkti loomises (WrongAP diagrammil), mis v\u00f5imaldab teises kanalil suunata p\u00e4ringud v\u00e4hem kaitstud valev\u00f5rku (WrongNet), millesse klient peaks \u00fchenduma soovitud v\u00f5rgu (TrustedNet) asemel. Juurdep\u00e4\u00e4supunkti saab luua tavalise s\u00fclearvuti abil ja seda kasutatakse mitmekanalilise MitM-r\u00fcnnaku korraldamiseks ohvri kallal (MC MitM). R\u00fcnnak toimub kolmes etapis: <\/p>\n

  • V\u00f5rgu avastamine (Network Discovery). MitM-s\u00fcsteem p\u00fc\u00fcab kinni ohvri ja usaldusv\u00e4\u00e4rse ligip\u00e4\u00e4supunkti (TrustedNet) vahel edastatavaid pakette, asendades neis SSID — ligip\u00e4\u00e4supunktilt saadetud paketis vahetatakse SSID v\u00e4hem turvalise v\u00f5rgu tuvastustunnuse vastu, ning ohvri vastustes t\u00f5elisega, et simuleerida kliendi ja usaldusv\u00e4\u00e4rse ligip\u00e4\u00e4supunkti vahelise suhtluse olemasolu. L\u00f5puks saab ohvri seade vastuseid ja arvab, et soovitud v\u00f5rgu olemasolu, hoolimata sellest, et need vastused edastatakse r\u00fcndaja ligip\u00e4\u00e4supunkti kaudu.\n
  • Autentimise kaaperdamine (Authentication hijacking). R\u00fcndaja simuleerib edukat autentimist ja sunnib klienti \u00fchenduma v\u00e4hem turvalise v\u00f5rguga, mitte usaldusv\u00e4\u00e4rsega. Nagu eelnevates etappides, r\u00fcndaja p\u00fc\u00fcab kinni autentimise k\u00e4igus saadetud kaadrid, vahetab ajakohastatud SSID ja edastab need edasi juurdumispunktile.\n
  • MitM. P\u00e4rast suhtluskanali leppimise l\u00f5petamist vahetab r\u00fcndaja SSID WrongNet'i TrustedNet-i vastu, luues mulje, et kasutaja t\u00f6\u00f6tab usaldusv\u00e4\u00e4rses v\u00f5rgus, mitte v\u00e4hem turvalises v\u00f5rgus.
    \"SSID<\/center>\n

    Kasutes haavatavust, v\u00f5ib r\u00fcndaja sundida klienti \u00fchenduma v\u00e4hem turvalise v\u00f5rguga, samas n\u00e4idates liidese kaudu SSID-d v\u00f5rgust, millega kasutaja algselt soovis liituda, mitte sellest, millega ta t\u00f5eliselt on \u00fchendatud. Saades kasutaja \u00fchendama turvamata v\u00f5rguga, saab r\u00fcndaja anal\u00fc\u00fcsida ja sekkuda kr\u00fcptimata andmevoogudesse. VPN<\/a>, nagu WARP, hide.me ja Windscribe, ei kaasata VPN-i \u00fchenduse loomisel v\u00f5rkudega, mis on seadetes m\u00e4rgitud usaldusv\u00e4\u00e4rsetena. <\/p>\n

    R\u00fcnnak kehtib juurdep\u00e4\u00e4su autentimise traadita protokollide suhtes, mis kasutavad EAP-d (Extensible Authentication Protocol), SAE-d (Simultaneous Authentication of Equals) ja 802.1X, samuti WPA3 vabatahtlikus t\u00f6\u00f6re\u017eiimis, kus SSID-d ei kasutata PMK (Pairwise Master Key) v\u00f5tme genereerimisel. See toimub, et v\u00e4listada algselt teadaolevate andmete kasutamine v\u00f5tme genereerimisel, et kaitsta erinevate kr\u00fcpto r\u00fcnnakute eest. FILS (Fast Initial Link Setup) protokoll on haavatav PMK kasutamisel, mis on loodud EAP-p\u00f5hise \u00fchenduse koosk\u00f5lastamise k\u00e4igus. WPA1, WPA2 ja FT (Fast BSS Transition) protokollid ei ole probleemi all, kuna nad n\u00f5uavad \u00fchenduse koosk\u00f5lastamisel korrektset SSID-d. <\/p>\n

    SSID Confusion r\u00fcnnaku kaitseks p\u00e4\u00e4supunkti k\u00fcljelt mainitakse standardis 802.11 autentimisn\u00f5uete kaasamist SSID-de puhul \u00fchenduse loomisel, mida saab teostada lisades SSID v\u00f5tme genereerimise funktsiooni v\u00f5i kaasates SSID t\u00e4iendavate andmete hulka, mida kontrollitakse \u00fchenduse loomisel. Klientide poolel saab kaitset korraldada beacon-raamide kaitse tagamise kaudu (rakendatakse WiFi 7 puhul). V\u00f5rguloojad saavad r\u00fcnnaku ennetada, loobudes \u00fchiste kontoandmete kasutamisest mitme SSID-ga v\u00f5rkudes. Kasutajad saavad end kaitsta, kasutades usaldusv\u00e4\u00e4rseid VPN-e, kui nad \u00fchenduvad mis tahes juhtmevabade v\u00f5rkudega.

    \r\n \"Vaata\r\n
    <\/div>\r\n <\/div><\/center>
    \n
    Allikas:     opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041b\u0451\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e \u043a\u0430\u0442\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0411\u0435\u043b\u044c\u0433\u0438\u044f), \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-52424) \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 Wi-Fi IEEE 802.11, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u043c\u0435\u043d\u0435\u0435 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0439 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0441\u0435\u0442\u0438, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0430\u043c\u0435\u0440\u0435\u0432\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0442\u0435\u043a\u0430\u0445 \u043b\u044e\u0431\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 WPA3, WEP, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115833,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115832","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSID Confusion r\u00fcnnak, mis v\u00f5imaldab Wi-Fi v\u00f5rgu asendamist | ProHoster","description":"Leuveni Katoliku \u00dclikooli teadlaste grupp (Belgia) avastas arhitektuurilise haavatavuse (CVE-2023-52424) Wi-Fi IEEE 802.11 standardis, mis v\u00f5imaldab \u00fchendada v\u00e4hem turvalise traadita v\u00f5rku, selle asemel et kasutada usaldusv\u00e4\u00e4rset v\u00f5rku, millega kasutaja soovis \u00fchendada. Selle tulemusena on v\u00f5imalik andmete p\u00fc\u00fcdmine ja liikluse manipuleerimine. Probleem ilmneb olenemata operatsioonis\u00fcsteemi traadita hunnikutest ning m\u00f5jutab WPA3 ja WEP autentimist.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 SSID Confusion, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u0435\u0442\u044c Wi-Fi | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041b\u0451\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e \u043a\u0430\u0442\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0411\u0435\u043b\u044c\u0433\u0438\u044f), \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-52424) \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 Wi-Fi IEEE 802.11, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u043c\u0435\u043d\u0435\u0435 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0439 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0441\u0435\u0442\u0438, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0430\u043c\u0435\u0440\u0435\u0432\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0442\u0435\u043a\u0430\u0445 \u043b\u044e\u0431\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 WPA3, WEP,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T12:59:27+00:00","article:modified_time":"2024-05-16T12:59:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115832","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:58:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:29:19","updated":"2026-02-04 14:58:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115832","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=115832"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115832\/revisions"}],"predecessor-version":[{"id":156771,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115832\/revisions\/156771"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/115833"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=115832"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=115832"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=115832"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}