{"id":117814,"date":"2024-07-18T15:43:01","date_gmt":"2024-07-18T13:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi"},"modified":"2024-07-18T15:43:01","modified_gmt":"2024-07-18T13:43:04","slug":"ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","title":{"rendered":"Port Shadow r\u00fcnnak, mis v\u00f5imaldab suunata teiste VPN ja Wi-Fi kasutajate \u00fchendusi.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kanada ja Ameerika \u00dchendriikide \u00fclikoolide teadlaste r\u00fchm arendas v\u00e4lja Port Shadow r\u00fcnnetehnika, mis v\u00f5imaldab VPN-serveri aadresside t\u00f5lketabelite manipuleerimise kaudu saadetud vastuse edastamist teisele samasse VPN-serverisse \u00fchendatud kasutajale. Meetodit saab kasutada kr\u00fcpteeritud liikluse pealtkuulamiseks v\u00f5i suunamiseks, portide skannimiseks ja VPN-kasutajate deanon\u00fc\u00fcmimiseks. N\u00e4iteks on n\u00e4idatud, kuidas saab seda meetodit kasutada r\u00fcnnakute hosti DNS-p\u00e4ringute suunamiseks VPN-serveri kaudu t\u00f6\u00f6tava kasutaja juuresolekul, kellele r\u00fcndaja saab kliendina \u00fchenduda. <\/p>\n

R\u00fcnnaku sooritamiseks peab r\u00fcndajal olema v\u00f5imalus \u00fchendust luua \u00fche VPN<\/a>-server to a victim, which is possible, for example, when using typical VPN operators and public VPN services that offer access to anyone. The vulnerability affects VPN servers that utilize address translation (NAT) to organize client requests to external resources, while ensuring that the same IP address is used for receiving traffic from clients and sending requests to external sites. serveril<\/a> a single IP address must be used. <\/p>\n

R\u00fcnnak p\u00f5hineb sellel, et r\u00fcndaja, kes on \u00fchendatud sama VPN-serveriga ja kasutab \u00fchist NAT-d, suudab saadetud kujundatud p\u00e4ringute kaudu saavutada aadressitranslatsiooni tabelite sisu moonutamise, mis toob kaasa selle, et \u00fchele kasutajale suunatud paketid saadetakse teisele kasutajale. Aadressitranslatsiooni tabelites m\u00e4\u00e4ratakse, millise sise-IP-aadressiga on saadetud p\u00e4ring seotud, l\u00e4htudes saadetud p\u00e4ringu algse v\u00f5rkpordi numbri kasutamisest. R\u00fcndaja, saates teatud SYN- ja ACK-pakette ning samaaegse manipuleerimisega kliendi\u00fchenduses VPN-serveriga ja r\u00fcndaja kontrollitava v\u00e4lisherveriga, v\u00f5ib saavutada NAT-tabelis kollisiooni tekkimise ja kirje lisamise, millel on sama algse pordi number, kuid mis on seotud tema kohalikku aadressiga, mis toob kaasa selle, et vastused v\u00f5\u00f5rale p\u00e4ringule saadetakse r\u00fcndaja aadressile.

\"Port<\/center> <\/p>\n

Uuringu k\u00e4igus testiti Linuxi ja FreeBSD aadressit\u00f5lkes\u00fcsteeme koos VPN-idega OpenVPN, OpenConnect ja WireGuard. FreeBSD platvorm osutus immuunseks r\u00fcnnakute suhtes, mis suunavad p\u00e4ringud teiste kasutajate poolt, kes on \u00fchendatud sama VPN-iga. NAT-tabelite asendamine \u00f5nnestus ainult ATIP (Adjacent-to-In-Path) r\u00fcnnaku k\u00e4igus, kus r\u00fcndaja suudab sekkuda kasutaja ja VPN-serveri vahelisse liiklusesse (n\u00e4iteks siis, kui kasutaja on \u00fchendatud r\u00fcndajale kuuluvasse Wi-Fi v\u00f5rku) v\u00f5i VPN-serveri ja sihtveebi vahel. Samuti m\u00f5jutas FreeBSD NAT-i r\u00fcnnak, mis v\u00f5imaldab m\u00e4\u00e4rata, kas kasutaja on \u00fchendatud teatud veebisaidiga (Connection Inference). <\/p>\n

Mis puudutab Linuxi, siis Netfilter alams\u00fcsteem osutus alti r\u00fcnnakutele, mis v\u00f5imaldavad aadressit\u00f5lke tabelisse kirjeid asendada, v\u00f5imaldades suunata sisenevaid pakette teisele kasutajale, saata pakette v\u00e4ljapoole kr\u00fcpteeritud VPN-kanalit (Decapsulation) v\u00f5i m\u00e4\u00e4rata avatud v\u00f5rgu pordid kliendi poolel.

\"Port<\/center> <\/p>\n

VPN-teenuste r\u00fcnnakute blokeerimiseks soovitatakse VPN-provideerijatel rakendada sobivaid meetodeid l\u00e4hteportide numbrite juhuslikuks muutmiseks NAT-is, piirata sama kasutaja poolt VPN-serveriga lubatud samaaegsete \u00fchenduste arvu ja takistada kliendil valida v\u00f5rgupordi, mis v\u00f5tab vastu p\u00e4ringuid VPN-serveri poolel. <\/p>\n

Proton AG esindaja s\u00f5nul ei puuduta r\u00fcnnak VPN-teenuseid, kus kasutatakse eraldi IP-aadresse sisenevate ja v\u00e4ljaminevate p\u00e4ringute jaoks. Lisaks on kahtlusi, kas r\u00fcnnakut on v\u00f5imalik rakendada tegelikele VPN-teenustele, kuna seni on edukas r\u00fcnnak demonstreeritud ainult laboritestides ning selle l\u00e4biviimiseks on vajalikud teatud tingimused VPN-serveri ja r\u00fcnnatava kliendi pool. Lisaks v\u00f5ib r\u00fcnnak olla kasulik ainult kr\u00fcpteerimata p\u00e4ringute, n\u00e4iteks DNS-i p\u00e4ringute manipuleerimiseks, samas kui TLS-i ja HTTPS-i kasutamine rakenduste tasandil muudab liikluse suunamise kasutu. <\/p>\n

Aadresside t\u00f5lketabelitega manipuleerimise meetodid on rakendatavad mitte ainult VPN-ide, vaid ka traadita v\u00f5rkudes, kus NAT-i kasutatakse kasutajate \u00fchendamiseks v\u00e4liste ressurssidega p\u00e4\u00e4supunktis. Eelmisel kuul avaldati uuringu tulemused, mis k\u00e4sitlevad sarnase r\u00fcnnaku v\u00f5imalust teiste traadita v\u00f5rgu kasutajate TCP-\u00fchenduste haaramiseks. R\u00fcnnaku meetod osutus rakendatavaks 24-st 33 testitud traadita p\u00e4\u00e4supunktist.

\"Port<\/center> <\/p>\n

Wi-Fi jaoks etten\u00e4htud r\u00fcnnak osutus oluliselt lihtsamaks kui eespool mainitud meetod VPN-ide jaoks, kuna paljud p\u00e4\u00e4supunktid ei kontrolli TCP-paketis j\u00e4rjestuse numbrite kohasust, t\u00e4nu optimeerimisele. Tulemuseks oli see, et r\u00fcnnaku jaoks piisab vale RST-paketi saatmisest aadresside t\u00f5lketabeli salvestuse t\u00fchjendamiseks, seej\u00e4rel on vajalik suunata vastus r\u00fcndaja hostile, et m\u00e4\u00e4rata j\u00e4rjestuse (SEQ) ja kinnituse (ACK) numbrid, mis on vajalikud TCP-\u00fchenduse katmiseks.

\"Port<\/center>
\"Port<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0445 \u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441 \u0434\u0440\u0443\u0433\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c\u0443 \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0443. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u0434\u0435\u0430\u043d\u043e\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117815,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117814","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Port Shadow r\u00fcnne, mis v\u00f5imaldab suunata teiste VPN ja Wi-Fi kasutajate \u00fchendusi | ProHoster","description":"Kanada ja Ameerika \u00dchendriikide \u00fclikoolide teadlaste grupp t\u00f6\u00f6tas v\u00e4lja Port Shadow r\u00fcnnaku tehnika, mis v\u00f5imaldab VPN-serveri aadressit\u00f5lke tabelite manipuleerimise kaudu suunata vastused teise kasutaja p\u00e4ringule, kes on \u00fchendatud sama VPN-serveriga. Meetodit saab kasutada kr\u00fcpteeritud liikluse pealtkuulamiseks v\u00f5i suunamiseks, portide skannimiseks ning VPN-kasutajate deanon\u00fc\u00fcmiseks. N\u00e4iteks","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN \u0438 Wi-Fi | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0445 \u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441 \u0434\u0440\u0443\u0433\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c\u0443 \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0443. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u0434\u0435\u0430\u043d\u043e\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-18T13:43:04+00:00","article:modified_time":"2024-07-18T13:43:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117814","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:00:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 04:28:19","updated":"2026-02-09 22:00:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=117814"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117814\/revisions"}],"predecessor-version":[{"id":160055,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117814\/revisions\/160055"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/117815"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=117814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=117814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=117814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}