{"id":115832,"date":"2024-05-16T14:59:26","date_gmt":"2024-05-16T12:59:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi"},"modified":"2024-05-16T14:59:26","modified_gmt":"2024-05-16T12:59:27","slug":"ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","title":{"rendered":"SSID Confusion r\u00fcnnak, mis v\u00f5imaldab Wi-Fi v\u00f5rku valeandmetega asendada.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Leedu katoliku \u00fclikooli teadlaste r\u00fchm avastas arhitektuurse haavatavuse (CVE-2023-52424) Wi-Fi IEEE 802.11 standardis, mis v\u00f5imaldab korraldada \u00fchendust v\u00e4hem kaitstud traadita v\u00f5rku, selle asemel, et liituda usaldusv\u00e4\u00e4rse v\u00f5rgu, millega kasutaja plaanis \u00fchenduda. P\u00e4rast seda on v\u00f5imalik korraldada liikluse pealtkuulamine ja manipuleerimine. Probleem ilmneb k\u00f5ikide operatsioonis\u00fcsteemide traadita stekkides ning see m\u00f5jutab autentimismeetodeid WPA3, WEP, EAP, AMPE ja FILS. <\/p>\n

Ettepanekud r\u00fcnnete tehnikaks, mida kutsutakse SSID Confusioniks, v\u00f5imaldavad m\u00f6\u00f6duda protokollis olemasolevatest autentimismeetoditest, mis kaitsevad SSID v\u00f5rgu identifikaatori asendamise eest ning ei luba luua valev\u00f5rke sama nimega, millega klient liitub. Probleemi p\u00f5hjuseks on standardis m\u00e4\u00e4ratlemine olukordadest, mil SSID v\u00f5ib olla autentimata. Eriti, et n\u00e4idata oma kohalolekut, saadab juurdep\u00e4\u00e4supunkt laiale helikandjale beacon-kaadreid, mis sisaldavad teavet SSID v\u00f5rgu kohta. Protsessi lihtsustamiseks ei autentita kliendi poolt SSID-d nendes kaadrites, kuna eeldatakse, et kontrollimine on vajalik alles p\u00e4rast seda, kui klient otsustab liituda v\u00f5rgu. <\/p>\n

R\u00fcnde edukaks sooritamiseks peab kasutaja alustama \u00fchendust teatava traadita v\u00f5rgu, samas kui l\u00e4heduses on teine traadita v\u00f5rk, millel on samad \u00fchendusparameetrid nagu esimesel. Sarnane praktika toimub n\u00e4iteks siis, kui 2.4GHz ja 5GHz sagedusvahemike jaoks luuakse erinevad v\u00f5rgud, millest \u00fcks on n\u00f5rgalt kaitstud ja haavatav tavalistele liikluse pealtkuulamise r\u00fcnnakutele, nagu KRACK v\u00f5i Frag. Problemaatiline konfigureerimine on samuti rakendatav teatud \u00fclikoolide v\u00f5rkudes, mis toetavad Eduroam teenust. R\u00fcndaja peab olema signaali ulatuses, et j\u00f5uda kasutaja ja sihiv\u00f5rgu vahele (MitM). R\u00fcnde sooritamiseks ei pea r\u00fcndaja teadma ohvri kasutajatunnuseid. <\/p>\n

R\u00fcnnak seisneb r\u00fcndaja juurdep\u00e4\u00e4supunkti (WrongAP diagrammil) loomises, mis tagab teisel kanalil v\u00e4hem kaitstud \u00fclev\u00f5etud v\u00f5rku (WrongNet), millega klient peab \u00fchenduma, selle asemel et soovitud v\u00f5rku (TrustedNet). Juurdep\u00e4\u00e4supunkt v\u00f5ib olla loodud tavalise s\u00fclearvuti abil ja seda kasutatakse mitmekanalilise MitM-r\u00fcnnaku korraldamiseks ohvrile (MC MitM). R\u00fcnnak toimub kolmes etapis: <\/p>\n

  • V\u00f5rgutuvastus (Network Discovery). MitM-s\u00fcsteem p\u00fc\u00fcab kinni pakette, mis saadetakse eetrisse ohvrilt ja usaldusv\u00e4\u00e4rselt p\u00e4\u00e4supunktilt (TrustedNet), asendades neis SSID - p\u00e4\u00e4supunkti pakettides asendatakse SSID v\u00e4hem turvalise v\u00f5rgu identifikaatoriga, ja ohvri vastustes reaalsega, et simuleerida interaktsiooni kliendi ja usaldusv\u00e4\u00e4rse p\u00e4\u00e4supunkti vahel. Tulemusena saab ohvri seade vastuseid ja arvab, et otsitav v\u00f5rk asub l\u00e4heduses, kuigi neid vastuseid edastab r\u00fcndaja p\u00e4\u00e4supunkt.\n
  • Autentimise haaramine (Authentication hijacking). R\u00fcndaja simuleerib eduka autentimise ja sunnib klienti \u00fchenduma v\u00e4hem kaitstud v\u00f5rguga, mitte usaldusv\u00e4\u00e4rsega. Nagu eelmisel etapil, peidab r\u00fcndaja kaardid, mis saadetakse kliendi autentimisel, asendab nendes SSID ja edastab need juurdep\u00e4\u00e4supunkti.\n
  • MitM. P\u00e4rast suhtluse kanali kokkuleppimist asendab r\u00fcndaja SSID WrongNet usaldusv\u00e4\u00e4rse TrustedNet-iga, luues mulje, et kasutaja t\u00f6\u00f6tab usaldusv\u00e4\u00e4rses v\u00f5rgus, mitte v\u00e4hem kaitstud v\u00f5rgus.
    \"SSID<\/center>\n

    Kasuks kasutades v\u00f5ib r\u00fcndaja sundida klienti \u00fchenduma v\u00e4hem kaitstud v\u00f5rguga ning samas kuvatakse liideses SSID v\u00f5rgu nimest, millega kasutaja algselt plaanis \u00fchendada, mitte sellele, millega ta tegelikult \u00fchendatud on. Saades kasutaja \u00fchendama mitte kaitstud v\u00f5rku, v\u00f5ib r\u00fcndaja anal\u00fc\u00fcsida ja sekkuda mittekr\u00fcpteeritud andmevoogudesse. Samuti, kasutades m\u00f5ningaid VPN<\/a>, nagu WARP, hide.me ja Windscribe, ei kaasata VPN-i, kui \u00fchendatakse usaldusv\u00e4\u00e4rsete seadistustega v\u00f5rku. <\/p>\n

    R\u00fcnnak kehtib traadita autentimise protokollide vastu, mis kasutavad EAP (Extensible Authentication Protocol), SAE (Simultaneous Authentication of Equals) ja 802.1X, samuti valikulise t\u00f6\u00f6re\u017eiimi WPA3 protokollis, kus SSID-d ei kasutata PMK (Pairwise Master Key) v\u00f5tme loomisel, et k\u00f5rvaldada algselt tuntud andmed v\u00f5tme loomisel kaitse tagamiseks erinevate kr\u00fcpto\u00e4kkide vastu. Protokoll FILS (Fast Initial Link Setup) on haavatav, kui kasutatakse PMK-d, mis on loodud seose kokkuleppe k\u00e4igus EAP p\u00f5hjal. Protokollid WPA1, WPA2 ja FT (Fast BSS Transition) ei katsu probleemi, kuna n\u00f5uavad seose kokkuleppe ajal korrektset SSID-d. <\/p>\n

    SSID Confusion r\u00fcnnaku v\u00e4ltimiseks p\u00e4\u00e4supunkti poolest soovitatakse 802.11 standardisse lisada SSID autentimise n\u00f5ue \u00fchenduse loomisel, mida saab rakendada, lisades SSID v\u00f5tme loomise funktsiooni v\u00f5i h\u00f5lmates SSID k\u00f5rvaldatavate andmete hulka, mis kontrollitakse seose kokkuleppe ajal. Klientide poolel saab kaitset korraldada beacon-kaadrivormide kaitse kaudu (rakendatakse WiFi 7-s). V\u00f5rgukujundajad saavad r\u00fcnnaku v\u00e4ltida, loobudes jagatud mandaadide kasutamisest erinevate SSID-dega v\u00f5rkudes. Kasutajad saavad end kaitsta usaldusv\u00e4\u00e4rsete VPN-ide kasutamisega, kui nad \u00fchendavad end igasuguste traadita v\u00f5rkudega.

    \r\n \"M\u00e4ngi\r\n
    <\/div>\r\n <\/div><\/center>
    \n
    Allikas:     opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041b\u0451\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e \u043a\u0430\u0442\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0411\u0435\u043b\u044c\u0433\u0438\u044f), \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-52424) \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 Wi-Fi IEEE 802.11, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u043c\u0435\u043d\u0435\u0435 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0439 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0441\u0435\u0442\u0438, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0430\u043c\u0435\u0440\u0435\u0432\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0442\u0435\u043a\u0430\u0445 \u043b\u044e\u0431\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 WPA3, WEP, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115833,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115832","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSID Confusion r\u00fcnnak, mis v\u00f5imaldab Wi-Fi v\u00f5rgu petmist | ProHoster","description":"Leuveni Katoliku \u00dclikooli teadlaste r\u00fchm avastas arhitektuurilise haavatavuse (CVE-2023-52424) Wi-Fi standardis IEEE 802.11, mis v\u00f5imaldab \u00fchendada v\u00e4hem kaitstud v\u00f5rkudega.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 SSID Confusion, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u0435\u0442\u044c Wi-Fi | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041b\u0451\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e \u043a\u0430\u0442\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0411\u0435\u043b\u044c\u0433\u0438\u044f), \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-52424) \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 Wi-Fi IEEE 802.11, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u043c\u0435\u043d\u0435\u0435 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T12:59:27+00:00","article:modified_time":"2024-05-16T12:59:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115832","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:58:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:29:19","updated":"2026-02-04 14:58:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115832","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=115832"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115832\/revisions"}],"predecessor-version":[{"id":156771,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115832\/revisions\/156771"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/115833"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=115832"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=115832"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=115832"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}