{"id":119766,"date":"2024-09-12T03:43:01","date_gmt":"2024-09-12T01:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom"},"modified":"2024-09-12T03:43:01","modified_gmt":"2024-09-12T01:43:01","slug":"popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","title":{"rendered":"Katse saada TLS-sertifikaateid teiste domeenide jaoks mobiilis, kasutades aegunud domeeni WHOIS-teenusega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

WatchTowr Labs'i teadlased avaldasid katse tulemused, mis k\u00e4sitlevad vananenud WHOIS-teenuse registreerijast domeenitsoonis .MOBI. Uuringu aluseks oli see, et registreerija muutis WHOIS-teenuse aadressi, liikudes domeenilt whois.dotmobiregistry.net uuele hostile whois.nic.mobi. Selle tulemusena lakkas domeen dotmobiregistry.net olemast ja detsembris 2023 vabastati see ning see sai registreerimiseks k\u00e4ttesaadavaks. <\/p>\n

Teadlased kulutasid 20 dollarit ning ostsid selle domeeni, p\u00e4rast mida k\u00e4ivitasid oma serveris vale WHOIS-teenuse whois.dotmobiregistry.net. \u00dcllatus oli suur, et paljud s\u00fcsteemid ei l\u00fclitunud uuele hostile whois.nic.mobi, vaid j\u00e4tkasid vana nime kasutamist. 30. augustist 4. septembrini sel aastal registreeriti 2,5 miljonit p\u00e4ringut vana nime kaudu, mis saadeti rohkem kui 135 000 unikaalsest s\u00fcsteemist. <\/p>\n

P\u00e4ringute saatjate seas olid ka postiteenused. serverid<\/a> riigi- ja s\u00f5jav\u00e4eorganisatsioonid, kes kontrollisid e-kirjades esinevaid domeene WHOIS'i kaudu, spetsialiseerudes ettev\u00f5tte turvalisusele ja turbeplatvormidele (VirusTotal, Group-IB), samuti sertifitseerimiskeskused, domeenide kontrollimise teenused, SEO-teenused ja domeeniregistraatorid (n\u00e4iteks domain.com, godaddy.com, who.is, whois.ru, smallseo.tools, seocheki.net, centralops.net, name.com, urlscan.io ja webchart.org). <\/p>\n

V\u00f5imet saata mis tahes andmeid vastuseks vanale WHOIS-teenusele domeenitsoonis .MOBI kasutati mitme r\u00fcnnaku t\u00fc\u00fcbi v\u00e4ljat\u00f6\u00f6tamiseks, mis suunati p\u00e4ringu saatjatele. Esimene r\u00fcnnak p\u00f5hines oletusel, et kui keegi j\u00e4tkab p\u00e4ringute saatmist vananenud teenusele, siis t\u00f5en\u00e4oliselt teeb ta seda vananenud t\u00f6\u00f6riistade abil, mis sisaldavad haavatavusi. <\/p>\n

N\u00e4iteks avastati phpWHOIS-s 2015. aastal haavatavus CVE-2015-5243, mis v\u00f5imaldas r\u00fcnnakutegevuse k\u00e4ivitamist spetsiaalselt vormistatud WHOIS-serveri andmete anal\u00fc\u00fcsimisel. Teine n\u00e4ide on 2021. aastal tuvastatud haavatavus CVE-2021-32749 Fail2Ban pakendis, mis v\u00f5imaldab v\u00e4lise koodi k\u00e4ivitamist, kui WHOIS-teenus tagastab eba\u00f5igeid andmeid, mida kasutatakse blokeerimise teavitamisel (Fail2Ban tuvastas WHOIS-i kaudu hosti administraatori e-posti ja n\u00e4itas seda k\u00e4skluse mail k\u00e4ivitamisel ilma spetsiaalsete s\u00fcmbolite \u00f5igesti ekraanistamist). <\/p>\n

Teine r\u00fcnnak p\u00f5hineb asjaolul, et m\u00f5ned sertifitseerimiskeskused pakuvad v\u00f5imalust domeeni omandi t\u00f5endamiseks e-posti teel, mis on loetletud domeeniregistri andmebaasis, mis on saadaval WHOIS protokolli kaudu. Selgus, et mitmed sellist kontrollimeetodit toetavad sertifitseerimiskeskused kasutavad endiselt vana WHOIS-serverit domeenitsoonis .MOBI. <\/p>\n

Seega, kui r\u00fcndajad saavad kontrolli whois.dotmobiregistry.net \u00fcle, saavad nad tagastada oma andmed, viia l\u00e4bi kinnituse ja saada TLS-sertifikaat<\/a> .MOBI tsoonis. N\u00e4iteks katsete k\u00e4igus k\u00fcsisid uurijad registrilt GlobalSign TLS-sertifikaadi domeenile microsoft.mobi ja vale WHOIS-teenuse kaudu tagastatud e-posti aadress 'whois@watchTowr.com' kuvati liideses kui kinnituskoode saatmise jaoks saadaval.

\"Katse<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0433\u043e WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b «.MOBI». \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0443\u0436\u0438\u043b\u043e \u0442\u043e, \u0447\u0442\u043e \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u043f\u043e\u043c\u0435\u043d\u044f\u043b \u0430\u0434\u0440\u0435\u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u043f\u0435\u0440\u0435\u043c\u0435\u0441\u0442\u0438\u0432 \u0435\u0433\u043e \u0441 \u0434\u043e\u043c\u0435\u043d\u0430 whois.dotmobiregistry.net \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0445\u043e\u0441\u0442 whois.nic.mobi. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043e\u043c\u0435\u043d dotmobiregistry.net \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438 \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2023 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d \u0438 \u0441\u0442\u0430\u043b \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0440\u0430\u0442\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":119767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Proov saada TLS-sertifikaate teiste mobiildomeenide jaoks, kasutades aegunud domeeni WHOIS-teenusega | ProHoster","description":"Teadlased firmast watchTowr Labs avaldasid katse tulemused, mis k\u00e4sitlesid vananenud WHOIS-teenuse h\u00f5ivamist domeeniala \".MOBI\" registreerija poolt. Uuringu p\u00f5hjuseks oli see, et registreerija muutis WHOIS-teenuse aadressi, liigutades selle aadressilt whois.dotmobiregistry.net uuele hostile whois.nic.mobi. Sellega l\u00f5petati domeeni dotmobiregistry.net kasutamine, mis vabastati ja sai registreerimiseks k\u00e4tte 2023. aasta detsembris. Teadlased kulutasid","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043b\u044f \u0447\u0443\u0436\u0438\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 mobi, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u043e\u0441\u0440\u043e\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u043c\u0435\u043d \u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0433\u043e WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b ".MOBI". \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0443\u0436\u0438\u043b\u043e \u0442\u043e, \u0447\u0442\u043e \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u043f\u043e\u043c\u0435\u043d\u044f\u043b \u0430\u0434\u0440\u0435\u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u043f\u0435\u0440\u0435\u043c\u0435\u0441\u0442\u0438\u0432 \u0435\u0433\u043e \u0441 \u0434\u043e\u043c\u0435\u043d\u0430 whois.dotmobiregistry.net \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0445\u043e\u0441\u0442 whois.nic.mobi. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043e\u043c\u0435\u043d dotmobiregistry.net \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438 \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2023 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d \u0438 \u0441\u0442\u0430\u043b \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0440\u0430\u0442\u0438\u043b\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-09-12T01:43:01+00:00","article:modified_time":"2024-09-12T01:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:33:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:28:23","updated":"2026-02-09 17:33:24"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=119766"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119766\/revisions"}],"predecessor-version":[{"id":159214,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119766\/revisions\/159214"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/119767"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=119766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=119766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=119766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}