{"id":119766,"date":"2024-09-12T03:43:01","date_gmt":"2024-09-12T01:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom"},"modified":"2024-09-12T03:43:01","modified_gmt":"2024-09-12T01:43:01","slug":"popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","title":{"rendered":"Katse saada TLS-sertifikaate teiste domeenide mobiilide jaoks, kasutades aegunud domeeni WHOIS-teenusega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

WatchTowr Labs'i teadlased avaldasid eksperimendi tulemused, milles uuriti vananenud WHOIS-teenust .MOBI domeeniala registri poolt. Uuringu p\u00f5hjuseks oli see, et registri WHOIS-teenuse aadressi vahetati, viies selle domeenilt whois.dotmobiregistry.net uuele hostile whois.nic.mobi. Sellega lakkas domeen dotmobiregistry.net olemast ja detsembris 2023 vabastati see ning see sai registreerimiseks k\u00e4ttesaadavaks. <\/p>\n

Teadlased kulutasid 20 dollarit ja ostsid selle domeeni, seej\u00e4rel k\u00e4ivitasid nad oma serveris oma vale WHOIS-teenuse whois.dotmobiregistry.net. \u00dcllatust tekitas see, et paljud s\u00fcsteemid ei l\u00fclitunud uuele hostile whois.nic.mobi ning j\u00e4tkasid vana nime kasutamist. Ajavahemikul 30. augustist kuni 4. septembrini registreeriti 2,5 miljonit p\u00e4ringut vana nime kaudu, mis saadeti \u00fcle 135 000 unikaalse s\u00fcsteemi. <\/p>\n

P\u00e4ringute saatjate seas olid kohal serverid<\/a> riiklike ja s\u00f5jav\u00e4eorganisatsioonide t\u00f6\u00f6tajad, kes kontrollisid emailides esinevaid domene WHOIS'i kaudu, samuti turvafirmade ja julgeoleku platvormide (VirusTotal, Group-IB) esindajad, sertifitseerimisagentuurid, domeenide kontrollimise teenused, SEO teenused ja domeenide registrijad (n\u00e4iteks domain.com, godaddy.com, who.is, whois.ru, smallseo.tools, seocheki.net, centralops.net, name.com, urlscan.io ja webchart.org). <\/p>\n

V\u00f5imalust edastada mis tahes andmeid vastusena p\u00e4ringutele vanale WHOIS-teenusele .MOBI domeenialal kasutati mitmete r\u00fcnnakute arendamiseks p\u00e4ringute saatjate vastu. Esimene r\u00fcnnak p\u00f5hines oletusel, et kui keegi j\u00e4tkab p\u00e4ringute saatmist pikka aega asendatud teenusele, siis t\u00f5en\u00e4oliselt teeb ta seda vananenud t\u00f6\u00f6riistade abil, mis sisaldavad turvaauke. <\/p>\n

N\u00e4iteks avastati 2015. aastal phpWHOIS-s haavatavus CVE-2015-5243, mis v\u00f5imaldas r\u00fcndeid, kui WHOIS server tagastas spetsiaalselt vormindatud andmeid, mis v\u00f5imaldasid r\u00fcndaja koodi t\u00e4itmist. Teise n\u00e4itena on 2021. aastal avastatud haavatavus CVE-2021-32749 paketis Fail2Ban, mis v\u00f5imaldas v\u00e4lise koodi t\u00e4itmist, kui WHOIS-teenus tagastas valeandmeid, mida kasutati blokeerimise hoiatuse genereerimise protsessis (Fail2Ban tuvastas WHOIS'i kaudu hosti administraatori emaili ja kasutas seda mail-k\u00e4sku k\u00e4ivitades ilma erim\u00e4rkide korralikku tagasikutsumist). <\/p>\n

Teine r\u00fcnnak p\u00f5hineb sel, et m\u00f5ned sertifitseerimisjaamad pakuvad v\u00f5imalust domeeni omamise kinnitamiseks e-posti teel, mis on registreerija andmebaasis ja mis on kergesti k\u00e4ttesaadav WHOIS-protokolli kaudu. Selgus, et mitmed sellist kontrollimeetodit toetavad sertifitseerimisjaamad j\u00e4tkavad vanade WHOIS-serverite kasutamist .MOBI domeeniala jaoks. <\/p>\n

Seega, saades kontrolli whois.dotmobiregistry.net \u00fcle, saavad r\u00fcndajad oma andmed tagasi tuua, kinnitada ja saada TLS-sertifikaat<\/a> iga domeeni jaoks .MOBI. N\u00e4iteks eksperimendi k\u00e4igus k\u00fcsisid teadlased registrilt GlobalSign TLS-sertifikaati domeeni microsoft.mobi jaoks ning tagastatud vale WHOIS-teenuse e-posti aadress \u201ewhois@watchTowr.com\u201d n\u00e4idati kasutajaliideses kui kinnituskoode saatmiseks saadaval olev.

\"Katse<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0433\u043e WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b «.MOBI». \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0443\u0436\u0438\u043b\u043e \u0442\u043e, \u0447\u0442\u043e \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u043f\u043e\u043c\u0435\u043d\u044f\u043b \u0430\u0434\u0440\u0435\u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u043f\u0435\u0440\u0435\u043c\u0435\u0441\u0442\u0438\u0432 \u0435\u0433\u043e \u0441 \u0434\u043e\u043c\u0435\u043d\u0430 whois.dotmobiregistry.net \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0445\u043e\u0441\u0442 whois.nic.mobi. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043e\u043c\u0435\u043d dotmobiregistry.net \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438 \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2023 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d \u0438 \u0441\u0442\u0430\u043b \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0440\u0430\u0442\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":119767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Proov saada TLS-sertifikaate teiste mobi domeenide jaoks, kasutades aegunud domeeni WHOIS-teenusega | ProHoster","description":"Uurijad ettev\u00f5ttest watchTowr Labs avaldasid katse tulemused vananenud WHOIS-teenuse \u00fcle v\u00f5tmise kohta domeenitsoonis \".MOBI\".","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043b\u044f \u0447\u0443\u0436\u0438\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 mobi, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u043e\u0441\u0440\u043e\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u043c\u0435\u043d \u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0433\u043e WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b ".MOBI".","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-09-12T01:43:01+00:00","article:modified_time":"2024-09-12T01:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:33:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:28:23","updated":"2026-02-09 17:33:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=119766"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119766\/revisions"}],"predecessor-version":[{"id":159214,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119766\/revisions\/159214"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/119767"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=119766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=119766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=119766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}