{"id":84662,"date":"2020-06-10T01:42:15","date_gmt":"2020-06-09T23:42:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti"},"modified":"2020-06-10T01:42:15","modified_gmt":"2020-06-09T23:42:15","slug":"uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","title":{"rendered":"UPnP haavatavus, mis sobib DDoS-r\u00fcnnakute tugevdamiseks ja sisev\u00f5rgu skaneerimiseks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ava<\/a><\/noindex> teavet haavatavuse<\/a><\/noindex> (CVE-2020-12695<\/a><\/noindex>) UPnP-protokollis, mis v\u00f5imaldab suunata liiklust suvalisele saajale, kasutades standardis ette n\u00e4htud operatsiooni «SUBSCRIBE». Haavatavustele on antud koodnimi CallStranger<\/a><\/noindex>. Haavatavust saab kasutada andmete v\u00e4ljav\u00f5tmiseks DLP (andmelekke ennetamise) s\u00fcsteemidega kaitstud v\u00f5rkudest, arvutite sadamate skaneerimiseks sisev\u00f5rgus ning DDoS-r\u00fcnnakute tugevdamiseks miljoneid globaalv\u00f5rku \u00fchendatud UPnP-seadmete kaudu, nagu kaabelmodemid, koduredelid, m\u00e4ngukonsoolid, IP-kaamerad, TV-digiboksid, meedia keskused ja printerid.<\/p>\n

Probleem on p\u00f5hjustatud<\/a><\/noindex> selle t\u00f5ttu, et spetsifikatsioonis etten\u00e4htud funktsioon «SUBSCRIBE» v\u00f5imaldab igal v\u00e4lisel r\u00fcndajal saata HTTP-pakette nende p\u00e4isega Callback ja kasutada UPnP-seadet teistele hostidele p\u00e4ringute saatmiseks vahepunktina. Funktsioon «SUBSCRIBE» on m\u00e4\u00e4ratletud UPnP spetsifikatsioonis ja seda kasutatakse teiste seadmete ja teenuste muudatuste j\u00e4lgimiseks. HTTP p\u00e4ise Callback abil on v\u00f5imalik m\u00e4\u00e4rata suvaline URL, millega seade \u00fcritab \u00fchendust luua. <\/p>\n

\"UPnP<\/a><\/noindex><\/center><\/p>\n

Probleemiga on haavatavad peaaegu k\u00f5ik UPnP rakendused, mis p\u00f5hinevad spetsiifikatsioon<\/a><\/noindex>, mis on v\u00e4lja antud enne 17. aprilli. Sealhulgas on haavatavus kinnitatud<\/a><\/noindex> avatud paketis hostapd<\/a><\/noindex> traadita juurdep\u00e4\u00e4supunkti elluviimisega (WPS AP). Parandused on hetkel saadaval parandustena<\/a><\/noindex>. Jaotustes ei ole veel v\u00e4rskendusi v\u00e4lja antud (Debian<\/a><\/noindex>, OpenWRT<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>). Probleem puudutab ka lahendusi, mis p\u00f5hinevad avatud UPnP stekil puudutab<\/a><\/noindex> pupnp , teavet selle paranduste kohta pole veel saadaval.<\/a><\/noindex>UPnP protokoll m\u00e4\u00e4ratleb mehhanismi seadmete automaatseks avastamiseks kohalikus v\u00f5rgus ja nendega suhtlemiseks. Erinevalt sellest, et protokoll on algselt projekteeritud kasutamiseks sisev\u00f5rkudes, ei eelda see mingeid autentimise ega kontrollimise vorme. Sellest hoolimata ei l\u00fclita miljonid seadmed UPnP toetust v\u00e4lja v\u00e4liste v\u00f5rgu liidestes ja<\/p>\n

p\u00fcsivad avatud globaalv\u00f5rgust p\u00e4ringute jaoks. R\u00fcnnak v\u00f5ib toimuda mis tahes sarnase UPnP-seadme kaudu.<\/a><\/noindex> R\u00fcnnak v\u00f5ib toimuda mis tahes sarnase UPnP-seadme kaudu.
\nN\u00e4iteks v\u00f5ivad Xbox One konsoolid olla r\u00fcnnatavad v\u00f5rguporti 2869 kaudu, kuna nad v\u00f5imaldavad j\u00e4lgida selliseid muudatusi nagu sisu jagamise v\u00f5imaldamine SUBSCRIBE k\u00e4su kaudu.<\/p>\n

Open Connectivity Foundation (OCF) organisatsioon sai probleemist teada eelmise aasta l\u00f5pus, kuid alguses keeldus seda k\u00e4sitlemast kui spetsifikatsiooni haavatavust. P\u00e4rast detailselt kirjeldatud aruande esitamist tunnustati probleemi olemasolu ja spetsifikatsiooni lisati n\u00f5ue kasutada UPnP-d ainult LAN-liidestel. Kuna probleem tuleneb standardi puuduj\u00e4\u00e4kidest, v\u00f5ib haavatavuse parandamine eri seadmetes v\u00f5tta kaua aega, ning vanade seadmete jaoks ei pruugi tarkvarauuendusi kunagi tulla.<\/p>\n

Kaitsemeetmena soovitatakse UPnP-seadmed isoleerida v\u00e4liste p\u00e4ringute eest tulem\u00fc\u00fcriga, blokeerida v\u00e4lish HTTP-p\u00e4ringud «SUBSCRIBE» ja «NOTIFY» r\u00fcnnakute ennetamise s\u00fcsteemides v\u00f5i deaktiviseerida UPnP-protokoll v\u00e4listes v\u00f5rguliidestes. Tootjatele soovitatakse vaikimisi seade SUBSCRIBE funktsioon v\u00e4lja l\u00fclitada ja lubada see ainult sisemise v\u00f5rgu p\u00e4ringute vastuv\u00f5tmiseks.
\nOma seadmete haavatavuse testimiseks avaldati<\/a><\/noindex> spetsiaalne t\u00f6\u00f6riist, mis on kirjutatud Pythonis ja levitatakse MIT litsentsi alusel. <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-12695) \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 UPnP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u044e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u043d\u0443\u044e \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044e «SUBSCRIBE». \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f CallStranger. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0441\u0435\u0442\u0435\u0439, \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445 (DLP), \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84663,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-84662","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UPnP haavatavus, mis sobib DDoS-r\u00fcnnakute suurendamiseks ja sisev\u00f5rgu skaneerimiseks | ProHoster","description":"Avalikustatud on teavet","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 UPnP, \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a \u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-09T23:42:15+00:00","article:modified_time":"2020-06-09T23:42:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84662","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:53:24","updated":"2022-09-27 14:10:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/84662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=84662"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/84662\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/84663"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=84662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=84662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=84662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}