Sabunta RouterOS akan MikroTik na ku

Da maraice na Maris 10, sabis na tallafi na Mail.ru ya fara samun gunaguni daga masu amfani game da rashin iya haɗawa zuwa sabar Mail.ru IMAP/SMTP ta shirye-shiryen imel. A lokaci guda, wasu haɗin gwiwar ba su shiga ba, wasu kuma suna nuna kuskuren takaddun shaida. Kuskuren yana faruwa ne ta hanyar "uwar garken" tana ba da takardar shedar TLS mai sa hannun kanta.
 

A cikin kwanaki biyu, fiye da korafe-korafe 10 sun shigo daga masu amfani da su a kan cibiyoyin sadarwa daban-daban da na'urori iri-iri, wanda hakan ya sa da wuya matsalar ta kasance a cikin hanyar sadarwar kowane mai samar da kayayyaki. Ƙarin cikakken bayani game da matsalar ya nuna cewa ana maye gurbin sabar imap.mail.ru (da sauran sabar sabar da sabis) a matakin DNS. Bugu da ari, tare da taimakon masu amfani da mu, mun gano cewa dalilin shine shigar da ba daidai ba a cikin cache na na'ura mai ba da hanya tsakanin hanyoyin sadarwa, wanda kuma shine mai warwarewar DNS na gida, kuma wanda a yawancin (amma ba duka) ya zama MikroTik ba. na'urar, shahararriya sosai a cikin ƙananan cibiyoyin sadarwa da kuma daga ƙananan masu samar da Intanet.

Menene matsalar

A cikin Satumba 2019, masu bincike samu lahani da yawa a cikin MikroTik RouterOS (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979), wanda ya ba da damar harin guba na cache na DNS, watau. Damar da zazzage bayanan DNS a cikin cache na DNS na na'ura mai ba da hanya tsakanin hanyoyin sadarwa, kuma CVE-2019-3978 yana ba maharin damar kada ya jira wani daga cibiyar sadarwar cikin gida don neman shigarwa akan sabar DNS ɗin sa don guba cache mai warwarewa, amma don fara irin wannan. bukatar kansa ta hanyar tashar jiragen ruwa 8291 (UDP da TCP). MikroTik ya daidaita raunin a cikin nau'ikan RouterOS 6.45.7 (barga) da 6.44.6 (tsawon lokaci) akan Oktoba 28, 2019, amma bisa ga bincike Yawancin masu amfani ba su shigar da faci a halin yanzu ba.

A bayyane yake cewa yanzu ana amfani da wannan matsala ta "rayuwa".

Me yasa yake da haɗari

Mai kai hari zai iya ɓata rikodin DNS na kowane mai masaukin baki da mai amfani ya samu akan hanyar sadarwar ciki, ta haka yana hana zirga-zirga zuwa gare ta. Idan an watsa mahimman bayanai ba tare da ɓoyewa ba (misali, sama da http:// ba tare da TLS ba) ko mai amfani ya yarda ya karɓi takardar shedar karya, maharin na iya samun duk bayanan da aka aika ta hanyar haɗin yanar gizo, kamar shiga ko kalmar sirri. Abin takaici, aikin yana nuna cewa idan mai amfani yana da damar karɓar takardar shaidar karya, zai yi amfani da shi.

Me yasa SMTP da IMAP sabar, da abin da aka ajiye masu amfani

Me ya sa maharan suka yi ƙoƙarin hana zirga-zirgar SMTP/IMAP na aikace-aikacen imel, ba zirga-zirgar yanar gizo ba, kodayake yawancin masu amfani suna samun damar wasiku ta hanyar burauzar HTTPS?

Ba duk shirye-shiryen imel da ke aiki ta hanyar SMTP da IMAP/POP3 suna kare mai amfani daga kurakurai ba, suna hana shi aika shiga da kalmar wucewa ta hanyar haɗin da ba ta da tsaro ko kuma ba ta cika ba, kodayake bisa ga ma'auni. RFC 8314, wanda aka karɓa a cikin 2018 (kuma an aiwatar da shi a cikin Mail.ru da yawa a baya), dole ne su kare mai amfani daga shiga kalmar sirri ta kowane haɗin da ba a sani ba. Bugu da kari, ba kasafai ake amfani da ka'idar OAuth a cikin abokan ciniki na imel (sabar sabar Mail.ru tana da goyan bayansa), kuma ba tare da shi ba, ana watsa shiga da kalmar wucewa a kowane zama.

Masu bincike na iya samun ɗan kariya daga harin Mutum-in-da-Tsakiya. A kan duk yankuna masu mahimmanci na mail.ru, ban da HTTPS, an kunna manufar HTS (HTTP tsauraran tsaro na sufuri). Tare da kunna HSTS, mai bincike na zamani ba ya ba mai amfani zaɓi mai sauƙi don karɓar takardar shedar karya, ko da mai amfani yana so. Baya ga HSTS, masu amfani sun sami ceto ta gaskiyar cewa tun daga 2017, SMTP, IMAP da POP3 sabobin Mail.ru sun haramta canja wurin kalmomin shiga akan hanyar da ba ta da tsaro, duk masu amfani da mu sun yi amfani da TLS don samun dama ta hanyar SMTP, POP3 da IMAP, kuma don haka shiga da kalmar sirri na iya shiga tsakani kawai idan mai amfani da kansa ya yarda ya karɓi takaddun shaida.

Ga masu amfani da wayar hannu, koyaushe muna ba da shawarar amfani da aikace-aikacen Mail.ru don samun damar wasiku, saboda... Yin aiki tare da wasiku a cikinsu ya fi aminci fiye da masu bincike ko ginannen abokan ciniki na SMTP/IMAP.

Me ya kamata ayi

Wajibi ne a sabunta MikroTik RouterOS firmware zuwa amintaccen sigar. Idan saboda wasu dalilai wannan ba zai yiwu ba, ya zama dole don tace zirga-zirga akan tashar jiragen ruwa 8291 (tcp da udp), wannan zai dagula amfani da matsalar, kodayake ba zai kawar da yuwuwar allurar wucewa a cikin cache na DNS ba. Ya kamata ISPs tace wannan tashar jiragen ruwa akan hanyoyin sadarwar su don kare masu amfani da kamfanoni. 

Duk masu amfani waɗanda suka karɓi takardar shedar musanya yakamata su canza kalmar sirri cikin gaggawa don imel da sauran sabis waɗanda aka karɓi wannan takardar shaidar. A namu bangaren, za mu sanar da masu amfani waɗanda ke samun damar wasiku ta na'urori masu rauni.

PS Har ila yau, akwai lahani mai alaƙa da aka bayyana a cikin gidan LukaSafonov "Rashin raunin baya a cikin RouterOS yana sanya dubunnan na'urori cikin haɗari".

source: www.habr.com