{"id":117239,"date":"2024-07-10T15:43:03","date_gmt":"2024-07-10T13:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii"},"modified":"2024-07-10T15:43:03","modified_gmt":"2024-07-10T13:43:04","slug":"uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","title":{"rendered":"RADIUS-protokolli haavatavus, mis v\u00f5imaldab autentimise k\u00e4igus vastuse valeandmist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

R\u00fchm teadlasi mitmest Ameerika \u00fclikoolist ja ettev\u00f5tetest Cloudflare ja Microsoft on v\u00e4lja t\u00f6\u00f6tanud uue r\u00fcnnetehnika RADIUS-protokolle vastu, mida kasutavad sideoperaatorid, pilveteenused ja VPN-teenuse pakkujad kasutajate autentimiseks, autoriseerimiseks ja arveldamiseks. R\u00fcnnak, mille koodnimeks on Blast-RADIUS, v\u00f5imaldab vale RADIUS-serveri vastuse genereerimist autentimise k\u00e4igus ja abonendi \u00fchendamise korraldamist ilma juurdep\u00e4\u00e4susalvestuse teadmiseta. <\/p>\n

Haavatavuse (CVE-2024-3596) \u00e4rakasutamiseks peab r\u00fcndaja suutma p\u00fc\u00fcda transiidivoo ning teostama t\u00f5husa MITM-r\u00fcnnaku, mis v\u00f5imaldab lugeda, p\u00fc\u00fcda, blokeerida ja muuta sissetulevaid ja v\u00e4ljuvaid transiid UDP-pakette, mis saadetakse juurdep\u00e4\u00e4supunktide poolt klientide autentimisn\u00f5udmiseks (Access-Request) ja RADIUS-serveri poolt, mis kinnitab v\u00f5i tagasi l\u00fckkab operatsiooni. P\u00fc\u00fcdes autentimisn\u00f5uet, saab r\u00fcndaja saata vale vastuse, m\u00e4rkides sellesse vastusesse erineva tulemuse t\u00fc\u00fcbi (n\u00e4iteks Access-Accept asemel Access-Reject). R\u00fcndaja v\u00f5ib samuti potentsiaalselt p\u00fc\u00fcda Access-Challenge vastust, mis kasutatakse kahefaktorilise autentimise k\u00e4igus, ja asendada selle Access-Accept vastusega, et m\u00f6\u00f6da minna t\u00e4iendavast kontrollietapist.

\"RADIUS-protokolli<\/center> <\/p>\n

R\u00fcnnak p\u00f5hineb asjaolul, et RADIUS-protokoll kasutab edastamiseks UDP-d ja kontrollib edastatavate s\u00f5numite terviklikkust MD5-algoritmi abil. S\u00f5numite autentimiseks, mis saadetakse RADIUS-serveri ja juurdep\u00e4\u00e4supunkti vahel, kasutatakse saladuslikku v\u00f5tit, mis on teada juurdep\u00e4\u00e4supunktile ja RADIUS-serverile, kuid mitte r\u00fcndajale. Vastusena RADIUS-serveri autentimisn\u00f5udele genereerib server MD5-hashi, mille abil juurdep\u00e4\u00e4suserver saab kinnitada, et s\u00f5num on saadetud volitatud serveri poolt. MD5-hash h\u00f5lmab n\u00f5udes saadetavat juhuslikku v\u00e4\u00e4rtust, n\u00f5ude identifikaatorit, tagastatud atribuutide ja saladusliku v\u00f5tit. serverilt<\/a> juurdep\u00e4\u00e4s ja RADIUS-server, rakendatakse salajane v\u00f5ti, mis on teada juurdep\u00e4\u00e4supunktile ja RADIUS-serverile, kuid r\u00fcndajale teadmata. Vastuseks autentimise p\u00e4ringule genereerib RADIUS-server MD5-r\u00e4siga, mille abil juurdep\u00e4\u00e4suserver saab kinnitada, et s\u00f5num saadeti volitatud serveri poolt. MD5-r\u00e4s h\u00f5lmab p\u00e4ringus saadetud juhuslikku v\u00e4\u00e4rtust, p\u00e4ringu identifikaatorit, tagastatavaid atribuute ja salajast v\u00f5tit. <\/p>\n

R\u00fcndaja v\u00f5ib MITM-r\u00fcnnaku k\u00e4igus mitte ainult kinni p\u00fc\u00fcda p\u00e4ringus edastatud identifikaatori ja juhusliku v\u00e4\u00e4rtuse, vaid ka ennustada operatsioonikoodi, suurust ja atribuute. \u00dclesanne seisneb kehtiva kontrollhundi loomises, mis vastaks muudetud operatsiooni tulemusele ja l\u00e4biks kontrollimise, kasutades salajast v\u00f5tit. MD5 algoritm ei ole kollisioonide genereerimise suhtes vastupidav, mis v\u00f5imaldab r\u00fcndajal manipulatsiooni kaudu m\u00f5ttetuks peidetud t\u00e4idisega leida andmete kombinatsiooni, mille MD5-hash vastab algse vastuse MD5-hashile, ja saata vale vastus, mis sisaldab edukat autentimise koodi (Access-Accept) selle asemel, et edastada vea teade.

\"RADIUS-protokolli<\/center> <\/p>\n

Kuna juurdep\u00e4\u00e4supakettide (Access-Request) t\u00f6\u00f6tlemisel ei rakendata autentimist ja terviklikkuse kontrolli, saab r\u00fcnnaku k\u00e4igus algsesse p\u00e4ringusse. serverilt<\/a> R\u00fcnnaku korral saab r\u00fcndaja lisada t\u00e4iendava atribuudiga \u00abProxy-State\u00bb, mis kajastub RADIUS-serveri vastuses. Atribuudi \u00abProxy-State\u00bb sisu valitakse kokkusattumise arvestamisel nii, et kontrolliva MD5-\u00e4mber v\u00e4\u00e4rtused reaalsetes ja valevastustes oleksid identsed. Katse k\u00e4igus v\u00f5ttis MD5 kokkusattumise otsimine r\u00fcnnaku teostamiseks aega 3-6 minutit, mis on rohkem kui t\u00fc\u00fcpiline aeg 30-60 sekundit, kuid otsinguaega saab l\u00fchendada, kasutades v\u00f5imsamat riistvara, kaasates GPU ja tehes toiminguid paralleelselt. <\/p>\n

Peamise kaitsemeetmena soovitatakse kasutada EAP (Extensible Authentication Protocol, RFC 3579) protokolli, mille raames kasutatakse s\u00f5numite t\u00e4iendavaks verifitseerimiseks atribuuti Message-Authenticator. R\u00fcnnaku kestel v\u00f5ib samuti kasutada protokolli laiendusi (RadSec), mis h\u00f5lmavad RADIUS-s\u00f5numite edastamist kr\u00fcpteeritud kanalite kaudu, mis p\u00f5hinevad TLS-il v\u00f5i DTLS-il. Lisaks saab v\u00e4hendada vastuse ajavahemikke miinimumini ja blokeerida vastused, millel on atribuut Proxy-State. RADIUS-s\u00f5numite edastamine TCP kaudu muudab r\u00fcnnaku keerulisemaks, kuid ei v\u00e4lista selle l\u00e4biviimist. <\/p>\n

R\u00fcnnakukoodi ei ole veel avalikult avaldatud, kuid hashclashi projektile on edastatud muudatused, mis parandavad MD5 kokkulangevuste leidmist r\u00fcnnaku spetsiifikat arvestades. FreeRADIUS RADIUS-serveris on probleem lahendatud versioonides 3.0.27 ja 3.2.5, rakendades kohustusliku Message-Authenticator atribuudiga ja lisades konfiguratsiooni, et piirata pakettide t\u00f6\u00f6tlemist Proxy-State atribuudiga.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Cloudflare \u0438 Microsoft \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b RADIUS, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430\u043c\u0438 \u0441\u0432\u044f\u0437\u0438, \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 \u0438 VPN-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c\u0438 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0438\u043d\u0433\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0410\u0442\u0430\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Blast-RADIUS, \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0442\u0432\u0435\u0442 RADIUS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0430 \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117240,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117239","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 RADIUS protokolli haavatavus, mis v\u00f5imaldab autentimise vastuse valeandmist | ProHoster","description":"Grupp teadlasi mitmest Ameerika \u00fclikoolist ja ettev\u00f5tetest Cloudflare ja Microsoft on v\u00e4lja t\u00f6\u00f6tanud uue r\u00fcnnaku tehnika RADIUS protokolli vastu, mida kasutavad sideoperaatorid, pilveteenused ja.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 RADIUS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0442\u0432\u0435\u0442 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Cloudflare \u0438 Microsoft \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b RADIUS, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430\u043c\u0438 \u0441\u0432\u044f\u0437\u0438, \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 \u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-10T13:43:04+00:00","article:modified_time":"2024-07-10T13:43:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117239","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:44:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:56:19","updated":"2026-02-22 15:44:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=117239"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117239\/revisions"}],"predecessor-version":[{"id":162456,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117239\/revisions\/162456"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/117240"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=117239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=117239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=117239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}