{"id":117814,"date":"2024-07-18T15:43:01","date_gmt":"2024-07-18T13:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi"},"modified":"2024-07-18T15:43:01","modified_gmt":"2024-07-18T13:43:04","slug":"ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","title":{"rendered":"Port Shadow r\u00fcnnak, mis v\u00f5imaldab suunata teiste VPN ja Wi-Fi kasutajate \u00fchendusi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kanada ja Ameerika \u00dchendriikide \u00fclikoolide teadlaste r\u00fchm on t\u00f6\u00f6tanud v\u00e4lja Port Shadow r\u00fcnde tehnika, mis v\u00f5imaldab VPN-serveri poolel aadresside t\u00f5lke tabelite manipuleerimise kaudu suunata vastuse p\u00e4ringule teisele kasutajale, kes on \u00fchendatud sama VPN-serveriga. Meetodit saab kasutada kr\u00fcpteeritud liikluse pealtkuulamiseks v\u00f5i suunamiseks, sadamate skaneerimise l\u00e4biviimiseks ja VPN-kasutajate deanon\u00fc\u00fcmimiseks. N\u00e4itena on toodud, kuidas saab kasutada meetodit, et suunata r\u00fcndealuse DNS-p\u00e4ringud kasutajalt, kes t\u00f6\u00f6tab VPN-serveri kaudu, r\u00fcndealuse poolt \u00fchendatavale hostile. <\/p>\n

R\u00fcnde teostamiseks peab r\u00fcndaja olema v\u00f5imeline \u00fchenduma \u00fche VPN<\/a>-serveriga, kus on ohver, mis on v\u00f5imalik n\u00e4iteks tavaliste VPN-teenuse pakkujate ja avalike VPN-teenuste kasutamise kaudu, mis pakuvad juurdep\u00e4\u00e4su k\u00f5igile soovijaile. Haavatavus m\u00f5jutab VPN-servereid, mis kasutavad aadresside t\u00f5lget (NAT) klientide juurdep\u00e4\u00e4su korraldamiseks v\u00e4listele ressurssidele, tingimusel, et kliendilt saadud liikluse vastuv\u00f5tmiseks ja p\u00e4ringute edastamiseks v\u00e4lishostidele kasutatakse serveris<\/a> \u00fcht ja sama IP-aadressi. <\/p>\n

R\u00fcnnak p\u00f5hineb sellel, et r\u00fcndaja, kes on \u00fchendatud sama VPN-serveriga ja kasutab \u00fchise NAT-i, suudab saata spetsiaalselt koostatud p\u00e4ringud, mis moonutavad aadresside t\u00f5lke tabeli sisu, mille tulemusena saadetud paketid \u00fchele kasutajale suunatakse teisele kasutajale. Aadresside t\u00f5lke tabelites m\u00e4\u00e4ratakse teabe olemasolu, millega sisemine IP-aadress vastab saadetud p\u00e4ringule, l\u00e4htudes p\u00e4ringu saatmisel kasutatud algse v\u00f5rgu pordi numbrist. R\u00fcndaja suudab, saates teatud SYN- ja ACK-pakette ning samal ajal manipuleerides VPN-serveriga oleva kliendi\u00fchenduse ja r\u00fcndaja poolt kontrollitava v\u00e4lise serveri poolelt, p\u00f5hjustada NAT-tabelis kollisioni ja lisada kirje sama algse pordi numbriga, kuid seostatuna tema kohaliku aadressiga, mis toob kaasa selle, et vastused teise p\u00e4ringu kohta saadetakse r\u00fcndaja aadressile.

\"Port<\/center> <\/p>\n

Uuringu k\u00e4igus testiti Linuxi ja FreeBSD aadressi t\u00f5lkes\u00fcsteeme koos VPN-idega OpenVPN, OpenConnect ja WireGuard. FreeBSD platvorm osutus vastuv\u00f5tlikuks teiste VPN-iga \u00fchendatud kasutajate p\u00e4ringute suunamise r\u00fcnnakute meetoditele. NAT-tabelite asendamine \u00f5nnestus vaid ATIP (Adjacent-to-In-Path) r\u00fcnnaku k\u00e4igus, kus r\u00fcndaja suudab sekkuda liiklusesse kasutaja ja VPN-serveri vahel (nt kui kasutaja on \u00fchendatud r\u00fcndajale kuuluvasse Wi-Fi-v\u00f5rku) v\u00f5i VPN-serveri ja sihtveebi vahel. Samuti m\u00f5jutas NAT FreeBSD-d r\u00fcnnak, mis v\u00f5imaldab kindlaks teha, et kasutaja on \u00fchendatud teatud veebilehega (Connection Inference). <\/p>\n

Mis puutub Linuxisse, siis alams\u00fcsteem Netfilter osutus vastuv\u00f5tlikuks r\u00fcnnakutele, mis v\u00f5imaldavad asendada aadressi t\u00f5lketabeli kirjeid, mis v\u00f5ivad suunata sissetulevaid pakette teisele kasutajale, saavutada pakettide saatmist v\u00e4ljaspool kr\u00fcpteeritud VPN-kanalit (Decapsulation) v\u00f5i kindlaks teha avatud v\u00f5rguportid kliendi poolel.

\"Port<\/center> <\/p>\n

R\u00fcnnaku t\u00f5kestamiseks soovitatakse VPN-teenuse pakkujatele rakendada piisavaid algportide juhuslikkuse meetodeid NAT-is, piirata sama kasutaja samal ajal VPN-serveriga lubatud \u00fchenduste arvu ning samuti blokeerida klientide v\u00f5imalus valida VPN-serveris p\u00e4ringute vastuv\u00f5tmiseks v\u00f5rguporda. <\/p>\n

Proton AG esindaja s\u00f5nul ei m\u00f5juta r\u00fcnnak VPN-teenuseid, kus kasutatakse eraldi IP-aadresse sissetulevatele ja v\u00e4ljaminevatele p\u00e4ringutele. Lisaks on kahtlusi r\u00fcnnaku rakendamise v\u00f5imaluses reaalsetele VPN-teenustele, kuna edukat r\u00fcnnakut on seni n\u00e4idatud vaid laboratoorsetes testides ning selleks on vajalikud teatud tingimuste t\u00e4itmine VPN-serveri ja r\u00fcnnaku all oleva kliendi poolel. Samuti v\u00f5ib r\u00fcnnak olla kasulik ainult kr\u00fcpteerimata p\u00e4ringute manipuleerimiseks, nagu n\u00e4iteks DNS-ile p\u00f6\u00f6rdumine, samas kui TLS-i ja HTTPS-i kasutamine rakendustasandil muudab liikluse suunamise m\u00f5ttetuks. <\/p>\n

Aadressi t\u00f5lketabeliga manipuleerimine ei ole rakendatav ainult VPN-idele, vaid ka juhtmeta v\u00f5rkudele, kus NAT-i kasutatakse kasutajate \u00fchendamiseks v\u00e4listele ressurssidele p\u00e4\u00e4supunktis. Eelmisel kuul avaldati uuringu tulemused, mis k\u00e4sitlevad sarnase r\u00fcnnaku v\u00f5imalust, kus muude juhtmeta v\u00f5rguteenuste TCP-\u00fchendusi v\u00f5idakse kinni haarata. R\u00fcnnakumeetod osutus rakendatavaks 24-st 33 testitud juhtmeta p\u00e4\u00e4supunktist.

\"Port<\/center> <\/p>\n

Wi-Fi r\u00fcnnak, mida pakuti, osutus m\u00e4rksa lihtsamaks kui eespool mainitud meetod VPN-i jaoks, kuna paljude p\u00e4\u00e4supunktide puhul ei kontrollita j\u00e4rjestuse numbrite \u00f5igsust TCP-pakkides mitmesuguste optimeerimiste t\u00f5ttu. Selle tulemusena oli r\u00fcnnaku jaoks piisav vale RST-paki saatmine, et puhastada aadressi t\u00f5lketabeli kandeid, ning seej\u00e4rel saavutada vastuse suunamine r\u00fcndaja hostile, et m\u00e4\u00e4rata kindlaks vajalikud j\u00e4rjestuse (SEQ) ja tunnustamise (ACK) numbrid TCP-\u00fchenduse haaramiseks.

\"Port<\/center>
\"Port<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0445 \u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441 \u0434\u0440\u0443\u0433\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c\u0443 \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0443. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u0434\u0435\u0430\u043d\u043e\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117815,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117814","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Port Shadow r\u00fcnnak, mis v\u00f5imaldab suunata teiste VPN-i ja Wi-Fi kasutajate \u00fchendusi | ProHoster","description":"Kanada ja Ameerika \u00fclikoolide teadlaste r\u00fchm arendas v\u00e4lja Port Shadow r\u00fcnnakutehnika, mis v\u00f5imaldab aadressi t\u00f5lketabelitega manipuleerimise kaudu VPN-serveri k\u00fcljelt vastuse saatmist.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN \u0438 Wi-Fi | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0445 \u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-18T13:43:04+00:00","article:modified_time":"2024-07-18T13:43:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117814","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:00:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 04:28:19","updated":"2026-02-09 22:00:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=117814"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117814\/revisions"}],"predecessor-version":[{"id":160055,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117814\/revisions\/160055"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/117815"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=117814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=117814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=117814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}