{"id":113690,"date":"2024-02-18T22:02:41","date_gmt":"2024-02-18T20:02:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/problemy-privodyashhie-k-obhodu-autentifikaczii-wi-fi-v-iwd-i-wpa_supplicant"},"modified":"2024-02-18T22:02:41","modified_gmt":"2024-02-18T20:02:41","slug":"problemy-privodyashhie-k-obhodu-autentifikaczii-wi-fi-v-iwd-i-wpa_supplicant","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/problemy-privodyashhie-k-obhodu-autentifikaczii-wi-fi-v-iwd-i-wpa_supplicant","title":{"rendered":"Problemi koji dovode do zaobila\u017eenja autentifikacije Wi-Fi u IWD-u i wpa_supplicant-u.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>U otvorenim paketima IWD (Intel inet Wireless Daemon) i wpa_supplicant, koji se koriste za uspostavljanje veze klijentskih Linux sustava s be\u017ei\u010dnom mre\u017eom, otkrivene su ranjivosti koje omogu\u0107uju zaobila\u017eenje mehanizama autentifikacije:    <\/p>\n<ul>\n<li class=\"l\"> U IWD ranjivost (CVE-2023-52161) se manifestira samo kada je aktiviran na\u010din rada to\u010dke pristupa, \u0161to je neuobi\u010dajeno za IWD, koji se obi\u010dno koristi za uspostavljanje veze s be\u017ei\u010dnim mre\u017eama. Ranjivost omogu\u0107ava povezivanje s uspostavljenom to\u010dkom pristupa bez poznavanja lozinke, na primjer, kada korisnik izri\u010dito dopu\u0161ta izlazak na mre\u017eu putem svog ure\u0111aja (Hotspot). Problem je ispravljen u verziji IWD 2.14.\n<p>Ranjivost je uzrokovana nedostatkom pravilne provjere redoslijeda prolaska svih koraka tijekom 4-faznog dogovora o komunikacijskom kanalu, koji se koristi pri prvom povezivanju s za\u0161ti\u0107enom be\u017ei\u010dnom mre\u017eom. Budu\u0107i da IWD prihva\u0107a poruke za sve faze dogovora o povezivanju bez provjere je li prethodni korak zavr\u0161en, napada\u010d mo\u017ee zaobi\u0107i slanje poruke druge faze i odmah poslati poruku \u010detvrte faze te dobiti pristup mre\u017ei, presko\u010div\u0161i korak u kojem se provodi provjera autentifikacije.     <\/p>\n<p>Pri tome IWD poku\u0161ava verifikovati MIC (Message Integrity Code) za primljenu poruku \u010detvrte faze. Budu\u0107i da poruka druge faze s parametrima autentifikacije nije primljena, prilikom obrade poruke \u010detvrte faze klju\u010d PTK (Pairwise Transient Key) postavlja se na nulu. Prema tome, napada\u010d mo\u017ee izra\u010dunati MIC koriste\u0107i nul-PTK, a ovaj provjeravaju\u0107i kod \u0107e biti prihva\u0107en od strane IWD kao ispravan. Nakon zavr\u0161etka takvog nepotpunog dogovora o povezivanju, napada\u010d \u0107e dobiti potpuni pristup be\u017ei\u010dnoj mre\u017ei, budu\u0107i da \u0107e to\u010dka pristupa primati njegove okvire, enkriptirane nul klju\u010dem PTK.        <\/p>\n<li class=\"l\"> Otkriveni problem u wpa_supplicant (CVE-2023-52160) omogu\u0107ava napada\u010du da zavede korisnika u la\u017enu be\u017ei\u010dnu mre\u017eu, koja je klon mre\u017ee kojoj se korisnik namjerava povezati. U slu\u010daju povezanosti korisnika s la\u017enom mre\u017eom, napada\u010d mo\u017ee organizirati presretanje ne\u0161ifriranog tranzitnog prometa korisnika (na primjer, pristupi stranicama bez HTTPS).\n<p>Zbog nedostatka u implementaciji PEAP (Protected Extensible Authentication Protocol) protokola, napada\u010d mo\u017ee presko\u010diti drugu fazu autentifikacije prilikom povezivanja neispravno konfiguriranog korisni\u010dkog ure\u0111aja. Preskakanje druge faze autentifikacije omogu\u0107ava napada\u010du da stvori la\u017eni klon pouzdane Wi-Fi mre\u017ee i osigura povezivanje korisnika s la\u017enom mre\u017eom bez provjere lozinke.     <\/p>\n<p>Za uspje\u0161no izvo\u0111enje napada u wpa_supplicant, na strani korisnika mora biti isklju\u010dena provjera <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hr\/ssl-sertifikat\/\"   title=\"TLS-certifikata\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"948\">TLS-certifikata<\/a> poslu\u017eitelja, a napada\u010d mora znati identifikator be\u017ei\u010dne mre\u017ee (SSID, Service Set Identifier). Pri tome napada\u010d mora biti unutar dometa be\u017ei\u010dnog adaptera \u017ertve, ali izvan dometa pristupne to\u010dke klonirane be\u017ei\u010dne mre\u017ee. Napad je mogu\u0107 na mre\u017eama s WPA2-Enterprise ili WPA3-Enterprise, u kojima se koristi PEAP protokol.      <\/p>\n<p>Razvija\u010di wpa_supplicant su izjavili da ne smatraju problem ranjivost, budu\u0107i da se manifestira samo u neispravno konfiguriranim be\u017ei\u010dnim mre\u017eama u kojima se EAP autentifikacija koristi zajedno s PEAP protokolom (EAP-TTLS) bez provjere TLS certifikata. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hr\/server\/dts-los-angeles\/\"   title=\"poslu\u017eitelja\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3604\">poslu\u017eitelja<\/a>Konfiguracije bez provjere certifikata nemaju za\u0161titu od aktivnih napada. Oni koji su otkrili ranjivost tvrde da su takve neispravne konfiguracije tipi\u010dne i \u0161iroko rasprostranjene, \u0161to ugro\u017eava mnoge potro\u0161a\u010dke ure\u0111aje na Linux, Android i Chrome OS platformama koje koriste wpa_supplicant.     <\/p>\n<p>Za blokiranje problema u wpa_supplicant je objavljena zakrpa koja dodatno uvodi obveznu drugu fazu autentifikacije, osim provjere TLS certifikata. Prema rije\u010dima razvija\u010da, predlo\u017eena izmjena je samo zaobila\u017eenje, koje ote\u017eava izvo\u0111enje napada kada se koristi ru\u010dna autentifikacija i beskorisna je kada su uklju\u010dene opcije poput EAP-GTC. Za stvarno rje\u0161enje problema, mre\u017eni administratori trebaju pravilno konfigurisati svoje postavke, tj. postaviti lanac povjerenja za provjeru certifikata poslu\u017eitelja pomo\u0107u parametra ca_cert.            <\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60623\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 IWD (Intel inet Wireless Daemon) \u0438 wpa_supplicant, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 Linux-\u0441\u0438\u0441\u0442\u0435\u043c \u043a \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438: \u0412 IWD \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-52161) \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0442\u043e\u0447\u043a\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0447\u0442\u043e \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u043e \u0434\u043b\u044f IWD, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u043c \u0441\u0435\u0442\u044f\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113690","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 IWD (Intel inet Wireless Daemon) \u0438 wpa_supplicant, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 Linux-\u0441\u0438\u0441\u0442\u0435\u043c \u043a \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/problemy-privodyashhie-k-obhodu-autentifikaczii-wi-fi-v-iwd-i-wpa_supplicant\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Wi-Fi \u0432 IWD \u0438 wpa_supplicant | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 IWD (Intel inet Wireless Daemon) \u0438 wpa_supplicant, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 Linux-\u0441\u0438\u0441\u0442\u0435\u043c \u043a \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/problemy-privodyashhie-k-obhodu-autentifikaczii-wi-fi-v-iwd-i-wpa_supplicant\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-02-18T20:02:41+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-02-18T20:02:41+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Problemi koji dovode do zaobila\u017eenja Wi-Fi autentifikacije u IWD i wpa_supplicant | ProHoster","description":"U otvorenim paketima IWD (Intel inet Wireless Daemon) i wpa_supplicant, koji se koriste za organizaciju povezivanja klijent-linuks sistema na be\u017ei\u010dnu mre\u017eu, otkrivene su ranjivosti koje dovode do zaobila\u017eenja mehanizama.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/problemy-privodyashhie-k-obhodu-autentifikaczii-wi-fi-v-iwd-i-wpa_supplicant","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Wi-Fi \u0432 IWD \u0438 wpa_supplicant | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 IWD (Intel inet Wireless Daemon) \u0438 wpa_supplicant, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 Linux-\u0441\u0438\u0441\u0442\u0435\u043c \u043a \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/problemy-privodyashhie-k-obhodu-autentifikaczii-wi-fi-v-iwd-i-wpa_supplicant","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-18T20:02:41+00:00","article:modified_time":"2024-02-18T20:02:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113690","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 21:02:57","updated":"2026-02-22 15:29:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/113690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=113690"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/113690\/revisions"}],"predecessor-version":[{"id":162131,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/113690\/revisions\/162131"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=113690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=113690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=113690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}