{"id":112410,"date":"2023-12-22T03:10:14","date_gmt":"2023-12-22T01:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij"},"modified":"2023-12-22T03:10:14","modified_gmt":"2023-12-22T01:10:16","slug":"smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","title":{"rendered":"SMTP Smuggling \u2014 nova tehnika spoofinga email poruka","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Istra\u017eiva\u010di iz tvrtke SEC Consult objavili su novu tehniku uspje\u0161nog krivotvorenja uzrokovanu nesrazmjernostima u slijedu specifikacije u razli\u010ditim implementacijama SMTP protokola. Predlo\u017eena tehnika napada omogu\u0107ava razdvajanje jedne poruke na nekoliko razli\u010ditih poruka prilikom prijenosa s izvornog SMTP poslu\u017eitelja na drugi SMTP poslu\u017eitelj, koji druga\u010dije tuma\u010di redoslijed za razdvajanje poruka koje se \u0161alju kroz jedne veze. Metoda se mo\u017ee koristiti za slanje la\u017enih poruka u ime drugih po\u0161iljatelja u e-mail servisima koji provjeravaju izvornog po\u0161iljatelja. <\/p>\n

Problem je uzrokovan time \u0161to razli\u010diti SMTP serveri druga\u010dije tuma\u010de redoslijed zavr\u0161etka podataka, \u0161to mo\u017ee dovesti do razdvajanja jedne poruke na nekoliko u okviru jednog sesije sa SMTP serverom. U specifikaciji za ozna\u010davanje zavr\u0161etka prijenosa poruke definirana je sekvenca «\r\n.\r\n» (to\u010dka, okru\u017eena simbolima povratka karijere i prijeloma linije). Nakon ove sekvence mogu uslijediti naredbe za slanje druge poruke bez prekida veze. Neki SMTP serveri strogo se pridr\u017eavaju propisa, dok drugi, radi osiguravanja kompatibilnosti s nekim rijetkim mail klijentima, obra\u0111uju i sekvence kao «\n.\n», «\n.\r\n», «\r\n.\n», «\r.\r», «\r\n0.\r\n» i «\r\n0.\r\n» kao razdjeljnike. <\/p>\n

Napad se svodi na to da se na prvi server<\/a>, koji obra\u0111uje samo razdjelnik «\r\n.\r\n» \u0161alje poruku \u010dije tijelo sadr\u017ei alternativni razdjelnik, na primjer, «\r.\r», nakon kojeg slijede naredbe za slanje druge poruke. Kako prvi server strogo slijedi specifikaciju, obra\u0111uje primljenu sekvencu kao jednu poruku. Ako se zatim poruka \u0161alje na tranzitni server ili server primatelja, koji dodatno do\u017eivljava sekvencu «\r.\r» kao razdjelnik, ona \u0107e biti obra\u0111ena kao dva posebno poslana pisma (druga poruka mo\u017ee biti poslana u ime korisnika koji nije autentificiran preko «AUTH LOGIN», ali \u0107e izgledati kao ispravna s strane primatelja).

\"SMTP<\/center>
\"SMTP<\/center> <\/p>\n

Kao primjeri SMTP servera i usluga koje dopu\u0161taju alternativne razdjeljnike isti\u010du se Postfix, Sendmail, MS Exchange Online i Cisco Secure Email Gateway, dok me\u0111u uslugama e-po\u0161te koje ne filtriraju neispravne razdjeljnike iz poruka prilikom obra\u0107anja drugim serverima — GMX, iCloud i Microsoft Outlook. <\/p>\n

Kako bi se rije\u0161io problem u Postfixu u verzijama 3.8.1, 3.7.6, 3.6.10 i 3.5.20, dodana je postavka «smtpd_forbid_unauth_pipelining», koja uzrokuje prekid veze u slu\u010daju kori\u0161tenja razdjelnika koji ne udovoljavaju zahtjevima RFC 2920 i RFC 5321. Trenuta\u010dno je ova postavka prema zadanim postavkama isklju\u010dena, no planira se aktivirati prema zadanim postavkama u grani Postfix 3.9, koja se o\u010dekuje na prolje\u0107e 2024. U grani 3.9 tako\u0111er \u0107e biti uklju\u010dena postavka smtpd_forbid_bare_newline, koja prikazuje gre\u0161ku kada se koristi samo znak novog reda («\n») za razdvajanje linija, \u0161to kr\u0161i RFC 5321. <\/p>\n

U pripremi verzije Sendmail 8.18.0.2, kako bi se za\u0161titili od napada, u srv_features je predlo\u017eena opcija ‘o’, koja uklju\u010duje obradu samo sekvenci «\r\n.\r\n». Napominje se da isklju\u010denje podr\u0161ke za alternativne razdjeljnike mo\u017ee ometati rad nekih rijetkih e-mail klijenata koji nisu u potpunosti uskla\u0111eni sa SMTP specifikacijom.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SEC Consult \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMTP. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0440\u0430\u0441\u0449\u0435\u043f\u0438\u0442\u044c \u043e\u0434\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043f\u0440\u0438 \u0435\u0433\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c SMTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 SMTP-\u0441\u0435\u0440\u0432\u0435\u0440, \u043f\u043e \u0438\u043d\u043e\u043c\u0443 \u0442\u0440\u0430\u043a\u0442\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0438\u0441\u0435\u043c, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043e\u0434\u043d\u043e \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":112411,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112410","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SMTP Smuggling \u2014 nova tehnika spoofinga e-po\u0161te | ProHoster","description":"Istra\u017eiva\u010di iz tvrtke SEC Consult objavili su novu tehniku spoofinga koja proizlazi iz neslaganja u slijedu specifikacije u razli\u010ditim implementacijama SMTP protokola.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SMTP Smuggling \u2014 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SEC Consult \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMTP.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-22T01:10:16+00:00","article:modified_time":"2023-12-22T01:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/112410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=112410"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/112410\/revisions"}],"predecessor-version":[{"id":172924,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/112410\/revisions\/172924"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/112411"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=112410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=112410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=112410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}