{"id":53634,"date":"2019-12-06T00:00:00","date_gmt":"2019-12-05T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli"},"modified":"2020-02-18T14:01:34","modified_gmt":"2020-02-18T11:01:34","slug":"uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","title":{"rendered":"Haavatavus, mis v\u00f5imaldab sekkuda VPN-tunnelite kaudu toimuvaid TCP-\u00fchendusi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud<\/a><\/noindex> r\u00fcnde r\u00fcnne (CVE-2019-14899), mis v\u00f5imaldab muuta, asendada v\u00f5i suunata TCP-\u00fchendustes, mis l\u00e4hevad VPN-tunnelite kaudu. Probleem m\u00f5jutab Linuxi, FreeBSD, OpenBSD, Androidi, macOS, iOSi ja teisi Unix-sarnaseid s\u00fcsteeme. Linux toetab IPv4 jaoks rp_filter (tagurpidi tee filtreerimine) mehhanismi, mille aktiveerimine 'Strict' re\u017eiimis k\u00f5rvaldab selle probleemi. <\/p>\n

Meetod v\u00f5imaldab pakettide asendamist TCP-\u00fchenduste tasemel, mis kulgevad kr\u00fcpteeritud tunnelis, kuid ei v\u00f5imalda sekkuda \u00fchendustesse, mis kasutavad t\u00e4iendavaid kr\u00fcptimise kihte (n\u00e4iteks TLS, HTTPS, SSH). VPN-is kasutatavad kr\u00fcptimisalgoritmid pole olulised, kuna vale paketid tulevad v\u00e4listelt liidestelt ja t\u00f6\u00f6deldakse k\u00e4rnaga nagu VPN-i liidese paketid. R\u00fcndeaarsi t\u00f5en\u00e4olisem siht on sekkumine kr\u00fcpteerimata HTTP-\u00fchendustesse, kuid ei v\u00e4listata<\/a><\/noindex> ka r\u00fcnnaku kasutamist DNS-i vastuste manipuleerimiseks. <\/p>\n

Edukas pakettide asendamine on n\u00e4idatud tunnelites, mis on loodud OpenVPN, WireGuard ja IKEv2\/IPSec abil. Tor ei ole selle probleemi all, kuna see kasutab SOCKSi liikluse edastamiseks ja on seotud loopback-liidesega. IPv4 jaoks on r\u00fcnnak v\u00f5imalik juhul, kui rp_filter muudetakse 'Loose' re\u017eiimi (sysctl net.ipv4.conf.all.rp_filter = 2). Enamikus s\u00fcsteemides kasutati algselt 'Strict' re\u017eiimi, kuid alates systemd 240<\/a><\/noindex>, mis vabastati eelmisel aasta detsembris, on vaikeolek vahetatud 'Loose' vastu ning see muudatus on kajastunud paljude Linuxi distributsioonide vaike seadetes.<\/p>\n

rp_filter mehhanism kasutatud<\/a><\/noindex> lisaks, et kontrollida pakettide edastusteede t\u00e4psust, et v\u00e4ltida allika aadressi spoofimist. Kui 0 v\u00e4\u00e4rtus on seadistatud, ei kontrollita allika aadressi ja mis tahes pakett v\u00f5ib suunata piiramatu hulgal vahel, mis tahes v\u00f5rguliideste. Re\u017eiim 1 'Strict' h\u00f5lmab igasuguste v\u00e4ljastpoolt v\u00f5etavate pakettide kontrollimist marsruutimistabeli kaudu, ja kui v\u00f5rgu liides, mille kaudu pakett saadi, ei ole seotud optimaalse vastuse edastamise marsruudiga, siis pakett blokeeritakse. Re\u017eiim 2 'Loose' leevendab kontrolli, et lubada t\u00f6\u00f6tamist koormuse jaotamise seadmete v\u00f5i as\u00fcmmeetrilise marsruutimise puhul.
\nvastuse marsruut v\u00f5ib kulgeda mitte l\u00e4bi selle v\u00f5rguliidese, mille kaudu sisenev pakett saabus.<\/p>\n

Loose re\u017eiimis kontrollitakse sisenenud paketti marsruutimistabeli suhtes, kuid see arvatakse lubatud olevat, kui allika aadress on kergesti ligip\u00e4\u00e4setav mis tahes olemasoleva v\u00f5rgu liidese kaudu. Eespool kirjeldatud r\u00fcnnak p\u00f5hineb sellel, et r\u00fcndaja saab saata paketi valeallika aadressiga, mis vastab VPN-i liidesele, ja kuigi see pakett j\u00f5uab s\u00fcsteemi v\u00e4lise v\u00f5rgu liidese kaudu, mitte VPN-i kaudu, ei blokeerita sellist paketti rp_filter 'Loose' re\u017eiimis. <\/p>\n

R\u00fcnnaku sooritamiseks peab r\u00fcndaja kontrollima v\u00e4ravat, mille kaudu kasutaja internetti p\u00e4\u00e4seb (n\u00e4iteks organisatsioonilise MITM-i kaudu, kui ohver \u00fchendub r\u00fcndaja hallatud juhtmevaba juurdep\u00e4\u00e4supunkiga v\u00f5i l\u00e4bi ruuteri h\u00e4kkimise<\/a><\/noindex>). Kontrollides v\u00e4ravat, mille kaudu kasutaja on v\u00f5rgus \u00fchendatud, saab r\u00fcndaja saata vale pakette, mida t\u00f5lgendatakse VPN-liidese kontekstis, kuid vastused saadetakse tunneli kaudu.<\/p>\n

Generaadi vale paki voolus, kus VPN liidese IP-aadress pannakse, p\u00fc\u00fcab m\u00f5jutada kliendi poolt seadistatud \u00fchendust, kuid nende pakettide m\u00f5ju saab j\u00e4lgida ainult passiivse anal\u00fc\u00fcsi kaudu, mis on seotud tunneliga edastatava kr\u00fcpteeritud liiklusega. R\u00fcnnaku teostamiseks on vajalik teada VPN-serveri m\u00e4\u00e4ratud tunneliliidese IP-aadressi ning m\u00e4\u00e4rata, et hetkel on tunnelis aktiivne \u00fchendus teatud hostiga. <\/p>\n

VPN virtuaalse v\u00f5rguliidese IP-aadressi m\u00e4\u00e4ramiseks saadetakse ohvri s\u00fcsteemile SYN-ACK pakette, j\u00e4rkj\u00e4rguliselt l\u00e4bides kogu virtuaalsete aadresside vahemiku (k\u00f5igepealt uuritakse vaikimisi VPN-is kasutatavaid aadresse, n\u00e4iteks OpenVPN-is kasutatakse alamv\u00f5rku 10.8.0.0\/24). Aadressi olemasolu saab tuvastada RST-flaagi vastuse saabumise p\u00f5hjal.<\/p>\n

Samuti m\u00e4\u00e4ratakse kindlaks \u00fchendus teatud saidi ja pordi numbriga kliendipool - skaneerides portaale suunas kasutaja saadetakse SYN-pakett, mille allika aadressis on sisestatud saidi IP ja sihtm\u00e4rgi aadress on VPN virtuaalne IP. Serveri porti v\u00f5ib ennustada (80 HTTP jaoks), samas kui kliendipoolse portaali number v\u00f5ib olla arvutatud t\u00f5rgete kaudu, anal\u00fc\u00fcsides erinevate numbrite muutuste intensiivsust ACK-vastuste osas koos RST-lipu paketiga, mis puudub.<\/p>\n

Selles etapis teab r\u00fcndaja k\u00f5iki nelja \u00fchenduse elementi (allika IP aadress\/port ja sihtkoha IP aadress\/port), kuid et genereerida vale pakett, mille s\u00fcsteem ehk ohver tajub, peab r\u00fcndaja kindlaks tegema TCP-\u00fchenduse j\u00e4rjestuse ja kinnituse numbrid (seq ja ack). Nende parameetrite m\u00e4\u00e4ramiseks saadab r\u00fcndaja pidevalt vale RST-pakette, proovides erinevaid j\u00e4rjestuse numbreid, kuni ta fikseerib vastuse ACK-paketi, mille saabumine n\u00e4itab, et number mahub TCP aknasse. <\/p>\n

Seejuhul selgitab r\u00fcndaja pakettide \u00f5ige tuvastamise kinnitamist sama numbri saatmise kaudu ja j\u00e4lgib ACK-vastuste saabumist, millega ta tuvastab praeguse j\u00e4rjestuse t\u00e4pse numbri. \u00dclesanne on keeruline, kuna vastused saadetakse kr\u00fcpteeritud tunneli kaudu ja nende olemasolu peidetud liiklusvoos saab anal\u00fc\u00fcsida vaid kaudsete meetoditega. Fakt, et VPN-serverile suunatud ACK-pakett saadetakse kliendi poolt, m\u00e4\u00e4ratakse kr\u00fcpteeritud vastuste suuruse ja viivituse p\u00f5hjal, mis on seotud vale pakettide saatmisega. N\u00e4iteks OpenVPN-i puhul v\u00f5imaldab kr\u00fcpteeritud paketi suurus 79 t\u00e4pselt aru saada, et selle sees on ACK-kinnitus.<\/p>\n

Enne kui r\u00fcnnakute kaitse lisatakse operatsioonis\u00fcsteemi tuumasse, on kui ajutine meetod probleemi blokeerimiseks soovitame<\/a><\/noindex> pakettide filtreerimise abil 'preroute' ahelas blokeerida pakettide edastamine, milles sihtm\u00e4rgi aadressiks on virtuaalne IP-aadress tunnelisse.<\/p>\n

iptables -t raw -I PREROUTING ! -i wg0 -d 10.182.12.8 -m addrtype ! --src-type LOCAL -j DROP<\/p>\n

v\u00f5i nftables puhul<\/p>\n

nft add table ip raw
\n nft add chain ip raw prerouting '{ type filter hook prerouting priority 0; }'
\n nft add rule ip raw prerouting 'iifname != \"wg0\" ip daddr 10.182.12.8 fib saddr type != local drop'<\/p>\n

IPv4 aadressidega tunnelite kasutamisel piisab rp_filter seadistamisest 'Strict' re\u017eiimi ('sysctl net.ipv4.conf.all.rp_filter = 1'). VPN-i k\u00fcljest v\u00f5ib jada numbri m\u00e4\u00e4ramise meetodit blokeerida, lisades kr\u00fcpteeritud pakkide juurde t\u00e4iendavat t\u00e4itmist, muutes k\u00f5igi pakettide suuruse \u00fchtlaseks. <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-14899), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0432 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043f\u0440\u043e\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Linux, FreeBSD, OpenBSD, Android, macOS, iOS \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 Unix-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. Linux \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c rp_filter (reverse path filtering) \u0434\u043b\u044f IPv4, \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u0436\u0438\u043c «Strict» \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u041c\u0435\u0442\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432\u043d\u0443\u0442\u0440\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53634","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerability that allows insertion into TCP connections made through VPN tunnels | ProHoster","description":"Avaldatud on r\u00fcnnetehnika (CVE-2019-14899), mis v\u00f5imaldab pakette asendada, muuta v\u00f5i sisestada.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043a\u043b\u0438\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-14899), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-05T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53634","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 08:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:21:20","updated":"2026-01-24 08:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53634"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53634\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}