{"id":53634,"date":"2019-12-06T00:00:00","date_gmt":"2019-12-05T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli"},"modified":"2020-02-18T14:01:34","modified_gmt":"2020-02-18T11:01:34","slug":"uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","title":{"rendered":"Haavatavus, mis v\u00f5imaldab siseneda TCP-\u00fchendustesse, mis on tehtud VPN-tunnelite kaudu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud<\/a><\/noindex> r\u00fcnde, mis p\u00f5hinevad r\u00fcnde tehnikal (CVE-2019-14899), mis v\u00f5imaldab v\u00f5ltsida, muuta v\u00f5i lisada pakette TCP-\u00fchendustes, mis edastatakse VPN-tunnelite kaudu. Probleem puudutab Linuxit, FreeBSD, OpenBSD, Androidi, macOS'i, iOS'i ja teisi Unix-laadseid s\u00fcsteeme. Linux toetab rp_filter (tagurpidi tee filtreerimine) mehhanismi IPv4 jaoks, mille sissel\u00fclitamine 'Strict' re\u017eiimis neutraliseerib selle probleemi. <\/p>\n

Meetod v\u00f5imaldab pakettide asendamist TCP-\u00fchenduste tasandil, mis l\u00e4bivad kr\u00fcpteeritud tunnelit, kuid ei v\u00f5imalda siseneda \u00fchendustesse, mis kasutavad t\u00e4iendavaid kr\u00fcpteerimiskihte (n\u00e4iteks TLS, HTTPS, SSH). VPN-is kasutatavad kr\u00fcpteerimisalgoritmid ei oma t\u00e4htsust, kuna vale paketid sisenevad v\u00e4listelt liidestelt ja t\u00f6\u00f6tlev kernel neid kui VPN-liidese pakette. R\u00fcnnaku t\u00f5en\u00e4olisem siht on sekkumine dekr\u00fcpteeritud HTTP-\u00fchendustesse, aga ei v\u00e4listata<\/a><\/noindex> ja r\u00fcnnaku kasutamine DNS-vastuste manipuleerimiseks. <\/p>\n

Edukas pakettide v\u00f5ltsimine on demonstreeritud tunnelite puhul, mis on loodud OpenVPN, WireGuard ja IKEv2\/IPSec abil. Tor ei ole sellele probleemile altiivne, kuna see kasutab SOCKS-i, et suunata liiklust ja siduda seda loopback-liidesega. IPv4 puhul on r\u00fcnnak v\u00f5imalik, kui rp_filter muudetakse 'Loose' re\u017eiimiks (sysctl net.ipv4.conf.all.rp_filter = 2). Enamasti rakendati algselt enamikes s\u00fcsteemides 'Strict' re\u017eiimi, kuid alates systemd 240<\/a><\/noindex>, mis anti v\u00e4lja eelmise aasta detsembris, on vaikere\u017eiim vahetatud 'Loose' peale ja see muudatus on kajastunud paljude Linuxi distributsioonide vaikeseadetes.<\/p>\n

rp_filter mehhanism rakendatakse<\/a><\/noindex> on pakettide sihtpunktide vaatlemiseks ja allikaaadresside valeesituse v\u00e4ltimiseks. Kui seada v\u00e4\u00e4rtuseks 0, siis allikaaadressi kontrollimist ei toimu ja iga pakett v\u00f5ib piiranguteta suunata erinevate v\u00f5rguliideste vahel. Re\u017eiim 1 'Strict' t\u00f5endab igat saabuvat paketti v\u00e4ljastpoolt vastavuses marsruuditabelitega ning kui v\u00f5rguliides, mille kaudu pakett saabus, ei ole seotud optimaalse vastusmarsruudiga, siis pakett l\u00fclitatakse v\u00e4lja. Re\u017eiim 2 'Loose' leevendab kontrolli, et v\u00f5imaldada koormuse tasakaalustajate v\u00f5i as\u00fcmmeetrilise marsruutimise kasutamist, juhul kui
\nvastuse marsruut v\u00f5ib kulgeda mitte l\u00e4bi selle v\u00f5rgu liidese, mille kaudu sisse tulnud pakett saabus.<\/p>\n

Re\u017eiimis 'Loose' kontrollitakse saabuvat paketti marsruuditabelite suhtes, kuid pakett loetakse lubatavaks, kui allikaaadress on kergesti k\u00e4tte saadav mis tahes olemasoleva v\u00f5rguliidese kaudu. Ettepanek r\u00fcnnakuks p\u00f5hineb sellel, et r\u00fcndaja v\u00f5ib saata paketi vale allikaaadressiga, mis vastab VPN-liidesele, ja kuigi see pakett siseneb s\u00fcsteemi l\u00e4bi v\u00e4list v\u00f5rguliidest, mitte VPN-i kaudu, ei l\u00fckata sellist paketti v\u00e4lja 'Loose' rp_filter re\u017eiimis. <\/p>\n

R\u00fcnnaku sooritamiseks peab kurjategija kontrollima v\u00e4\u00e4rtuse, mille kaudu kasutaja internetti p\u00e4\u00e4seb (n\u00e4iteks l\u00e4bi MITM-organisatsiooni, kui ohver on \u00fchendatud r\u00fcndaja kontrollitava traadita juurdep\u00e4\u00e4supunktiga v\u00f5i l\u00e4bi ruuteri h\u00e4kkimise<\/a><\/noindex>). Kontrollides v\u00e4\u00e4rtust, mille kaudu kasutaja on v\u00f5rku \u00fchendatud, saab r\u00fcndaja saata vale pakette, mis tajutakse VPN-v\u00f5rgu kontekstis, kuid vastused suunatakse l\u00e4bi tunnel.<\/p>\n

Vale pakettide voolu genereerimise teel, milles sisestatakse VPN-i liidese IP-aadress, proovivad nad m\u00f5jutada kliendi seadistatud \u00fchendust, kuid nende pakettide m\u00f5ju saab j\u00e4lgida ainult passiivse anal\u00fc\u00fcsi kaudu kr\u00fcpteeritud liikluse voogude \u00fcle, mis on seotud tunneliga. R\u00fcnnaku viimiseks on vajalik teada, milline IP-aadress on m\u00e4\u00e4ratud VPN-serveri poolt tunneliliidesele, ning tuvastada, et tunnelis on aktiivne \u00fchendus konkreetse hostiga. <\/p>\n

VPN-i virtuaalse v\u00f5rgu liidese IP-aadressi m\u00e4\u00e4ramiseks saadetakse ohvri s\u00fcsteemile j\u00e4rjestikuseid SYN-ACK pakette, katsetades k\u00f5iki virtuaalsete aadresside vahemike j\u00e4rjestikku (esmaj\u00e4rjekorras testitakse aadresse, mida VPN-i vaikeseadistused kasutavad, n\u00e4iteks OpenVPN-is kasutatakse alamv\u00f5rku 10.8.0.0\/24). Aadressi olemasolu saab kindlaks teha vastuse saamise p\u00f5hjal RST-lipuga.<\/p>\n

Sarnaselt m\u00e4\u00e4ratakse kindlaks \u00fchenduse olemasolu teatud saidiga ja sadama number, uurides portide numbreid, mille kaudu saadetakse SYN-pakett, mille l\u00e4hteaadressiks on saidi IP ja sihtaadressiks virtuaalne VPN IP. Serveri sadama number on ennustatav (80 HTTP jaoks), samas kui kliendi poole sadama number arvutatakse l\u00e4bi proovimise, anal\u00fc\u00fcsides erinevate numbrite puhul ACK-vastuste intensiivsuse muutust koos RST-flaagi puudumisega.<\/p>\n

Selle etappi r\u00fcndaja teab k\u00f5iki nelja \u00fchenduse elementi (allika IP aadress\/port ja siht-IP aadress\/port), kuid et genereerida vale pakett, mille s\u00fcsteem sihtm\u00e4rgiks v\u00f5tab, peab r\u00fcndaja m\u00e4\u00e4rama TCP-\u00fchenduse j\u00e4rjestuse ja kinnituse numbrid (seq ja ack). Nende parameetrite m\u00e4\u00e4ramisel saadab r\u00fcndaja pidevalt vale RST-pakette, proovides erinevaid j\u00e4rjestuse numbreid, kuni ta saab k\u00e4tte vastava ACK-paketi, mille saabumine n\u00e4itab, et number mahub TCP aknasse. <\/p>\n

Seej\u00e4rel t\u00e4psustab r\u00fcndaja oma m\u00e4\u00e4rangut, saates pakette sama numbriga ja j\u00e4lgides ACK-vastuste saabumist, mille j\u00e4rel ta valib praeguse j\u00e4rjestuse t\u00e4pse numbri. \u00dclesanne on keeruline, kuna vastused saadetakse kr\u00fcpteeritud tunnelis ja nende olemasolu anal\u00fc\u00fcsitakse p\u00fc\u00fctud andmestructis ainult kaudsete meetoditega. Fakt, et klient saadab VPN-serveritele suunatud ACK-paketti, m\u00e4\u00e4ratakse kindlaks kr\u00fcpteeritud vastuste suuruse ja viivituse p\u00f5hjal, mis korreleerub vale pakettide saatmisega. N\u00e4iteks OpenVPN jaoks v\u00f5imaldab kr\u00fcpteeritud pakett, mille suurus on 79, t\u00e4pselt kindlaks teha, et sees on ACK-kinnitus.<\/p>\n

Enne kui r\u00fcndamise kaitse lisatakse operatsioonis\u00fcsteemi tuuma, on ajutise meetodina probleemide blokeerimiseks soovitatakse<\/a><\/noindex> kasutada pakettide filtrit ahelas «preroute» paketide blokeerimiseks, mille sihtaadressiks on tunneli virtuaalne IP-aadress.<\/p>\n

iptables -t raw -I PREROUTING ! -i wg0 -d 10.182.12.8 -m addrtype ! --src-type LOCAL -j DROP<\/p>\n

v\u00f5i nftables'i puhul<\/p>\n

nft add table ip raw
\n nft add chain ip raw prerouting '{ type filter hook prerouting priority 0; }'
\n nft add rule ip raw prerouting 'iifname != «wg0» ip daddr 10.182.12.8 fib saddr type != local drop'<\/p>\n

Tunnelite kasutamisel piisab IPv4-aadresside puhul rp_filteri seadistamisest «Strict» re\u017eiimi 'sysctl net.ipv4.conf.all.rp_filter = 1'. VPNi poolt v\u00f5ib j\u00e4rjestuse numbrite m\u00e4\u00e4ramist blokeerida, lisades kr\u00fcpteeritud pakettidele t\u00e4idise, mis muudab k\u00f5ikide pakettide suurused \u00fchesuguseks. <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-14899), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0432 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043f\u0440\u043e\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Linux, FreeBSD, OpenBSD, Android, macOS, iOS \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 Unix-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. Linux \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c rp_filter (reverse path filtering) \u0434\u043b\u044f IPv4, \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u0436\u0438\u043c «Strict» \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u041c\u0435\u0442\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432\u043d\u0443\u0442\u0440\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53634","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus, mis v\u00f5imaldab tungida TCP-\u00fchendustesse, mis on loodud VPN-tunnelite kaudu | ProHoster","description":"Avalikustatud r\u00fcnnaku tehnika (CVE-2019-14899), mis v\u00f5imaldab pakette asendada, muuta v\u00f5i sisestada.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043a\u043b\u0438\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-14899), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-05T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53634","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 08:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:21:20","updated":"2026-01-24 08:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53634"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53634\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}