{"id":115832,"date":"2024-05-16T14:59:26","date_gmt":"2024-05-16T12:59:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi"},"modified":"2024-05-16T14:59:26","modified_gmt":"2024-05-16T12:59:27","slug":"ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","title":{"rendered":"Napad SSID Confusion koji omogu\u0107uje zamjenu Wi-Fi mre\u017ee","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Grupa istra\u017eiva\u010da s Katoli\u010dkog sveu\u010dili\u0161ta u Leuvenu (Belgija) otkrila je arhitektonsku ranjivost (CVE-2023-52424) u Wi-Fi standardu IEEE 802.11, koja omogu\u0107uje povezivanje na manje za\u0161ti\u0107enu be\u017ei\u010dnu mre\u017eu umjesto na povjerljivu mre\u017eu na koju se korisnik namjerava povezati, a nakon toga omogu\u0107uje presretanje i manipulaciju prometom. Problem se o\u010dituje u be\u017ei\u010dnim stablima svih operativnih sustava i uti\u010de na metode autentifikacije WPA3, WEP, EAP, AMPE i FILS. <\/p>\n

Predlo\u017eena tehnika napada, nazvana SSID Confusion, omogu\u0107uje zaobila\u017eenje postoje\u0107ih metoda autentifikacije pristupne to\u010dke koje \u0161tite od zamjene identifikatora mre\u017ee SSID i sprje\u010davaju stvaranje la\u017enih mre\u017ea s imenom mre\u017ee na koju se klijent povezuje. Uzrok problema le\u017ei u definiranju situacija u standardu kada SSID mo\u017ee biti neautentificiran. Konkretno, radi ozna\u010davanja svog prisustva, pristupna to\u010dka \u0161alje u \u0161irokopojasnom re\u017eimu beacon-okvire koji sadr\u017ee informacije o SSID mre\u017ei. Za pojednostavljenje procesa pronalaska mre\u017ee, klijenti ne autentificiraju SSID u tim okvirima, budu\u0107i da se o\u010dekuje da \u0107e provjera biti potrebna nakon \u0161to se klijent odlu\u010di povezati na mre\u017eu. <\/p>\n

Za uspje\u0161no izvr\u0161enje napada potrebno je da korisnik pokrene povezivanje na odre\u0111enu be\u017ei\u010dnu mre\u017eu, a u blizini se nalazi druga be\u017ei\u010dna mre\u017ea s istim parametrima povezivanja kao u prvom mre\u017enom okru\u017eenju. Takva praksa se, na primjer, koristi kada se za raspona 2.4GHz i 5GHz kreiraju razli\u010dite mre\u017ee, od kojih je jedna slabo za\u0161ti\u0107ena i ranjiva na tipi\u010dne napade presretanja prometa, poput KRACK ili Frag. Problemati\u010dna konfiguracija tako\u0111er se primjenjuje u nekim sveu\u010dili\u0161nim mre\u017eama koje podr\u017eavaju uslugu Eduroam. Napada\u010d mora biti unutar dometa signala da bi se umetnuo izme\u0111u korisnika i ciljne mre\u017ee (MitM). Za provedbu napada, napada\u010du nisu potrebne vjerodajnice \u017ertve. <\/p>\n

Napad se svodi na stvaranje pristupne to\u010dke od strane napada\u010da (WrongAP na dijagramu), koja omogu\u0107uje prijenos zahtjeva na manje sigurnu podmetnutu mre\u017eu (WrongNet), na koju bi se klijent trebao povezati umjesto \u017eeljene mre\u017ee (TrustedNet). Pristupna to\u010dka mo\u017ee biti stvorena na obi\u010dnom laptopu i koristi se za organizaciju vi\u0161ekanalnog MitM napada na \u017ertvu (MC MitM). Napad se provodi u tri faze: <\/p>\n

  • Definicija mre\u017ee (Network Discovery). MitM sustav presre\u0107e pakete koje \u0161alje \u017ertva i pouzdana pristupna to\u010dka (TrustedNet), zamjenjuju\u0107i SSID \u2014 u paketima sa pristupne to\u010dke SSID se zamjenjuje s identifikatorom manje za\u0161ti\u0107ene mre\u017ee, a u odgovorima \u017ertve s pravim, kako bi se simulirala interakcija klijenta i pouzdane pristupne to\u010dke. Na kraju, ure\u0111aj \u017ertve prima odgovore i misli da se tra\u017eena mre\u017ea nalazi u blizini, unato\u010d tome \u0161to te odgovore prenosi pristupna to\u010dka napada\u010da.\n
  • Zamjena autentifikacije (Authentication hijacking). Napada\u010d simulira uspje\u0161nu autentifikaciju i prisiljava klijenta da se pove\u017ee na manje za\u0161ti\u0107enu mre\u017eu umjesto na vjerodostojnu. Kao i u prethodnoj fazi, napada\u010d presre\u0107e okvire poslane tijekom autentifikacije od strane klijenta, mijenja SSID i ponovo ih \u0161alje pristupnoj to\u010dki.\n
  • MitM. Nakon uskla\u0111ivanja komunikacijskog kanala, napada\u010d mijenja SSID s WrongNet na TrustedNet, stvaraju\u0107i dojam da korisnik radi preko vjerodostojne mre\u017ee, a ne preko manje za\u0161ti\u0107ene mre\u017ee.
    \"Napad<\/center>\n

    Iskoristiv\u0161i ranjivost, napada\u010d mo\u017ee prisiliti klijenta da se pove\u017ee na manje za\u0161ti\u0107enu mre\u017eu, a u su\u010delju \u0107e se prikazivati SSID mre\u017ee na koju se korisnik prvotno namjeravao povezati, a ne onoj na koju je zapravo povezan. Kada uspije povezati korisnika preko neza\u0161ti\u0107ene mre\u017ee, napada\u010d mo\u017ee analizirati i uplesti se u nekriptirane tokove prometa. U tom procesu, uz upotrebu nekih VPN<\/a>, kao \u0161to su WARP, hide.me i Windscribe, VPN ne\u0107e biti aktiviran pri povezivanju na mre\u017ee ozna\u010dene u postavkama kao vjerodostojne. <\/p>\n

    Napad se mo\u017ee primijeniti na protokole be\u017ei\u010dne autentifikacije koji koriste EAP (Extensible Authentication Protocol), SAE (Simultaneous Authentication of Equals) i 802.1X, kao i u opcionalnom re\u017eimu rada protokola WPA3, gdje SSID nije kori\u0161ten u formiranju PMK (Pairwise Master Key), \u0161to se radi kako bi se isklju\u010dili izvorno poznati podaci prilikom formiranja klju\u010da s ciljem za\u0161tite od razli\u010ditih kripto napada. Protokol FILS (Fast Initial Link Setup) je ranjiv prilikom kori\u0161tenja PMK-a, koji je stvoren tijekom uskla\u0111ivanja veze bazirane na EAP-u. Protokoli WPA1, WPA2 i FT (Fast BSS Transition) nisu pogo\u0111eni ovom problematikom jer zahtijevaju ispravni SSID tijekom uskla\u0111ivanja veze. <\/p>\n

    Za za\u0161titu od napada SSID Confusion s strane pristupne to\u010dke, spominje se uklju\u010divanje zahtjeva za autentifikaciju SSID-a prilikom povezivanja u standard 802.11, \u0161to se mo\u017ee ostvariti dodavanjem SSID-a u funkciju formiranja klju\u010da ili uklju\u010divanjem SSID-a u dodatne podatke koji se provjeravaju tijekom uskla\u0111ivanja veze. S strane klijenta, za\u0161tita se mo\u017ee organizirati osiguravanjem za\u0161tite beacon okvira (bit \u0107e primijenjena u WiFi 7). Kreatori mre\u017ea mogu sprije\u010diti napad odbijanjem kori\u0161tenja zajedni\u010dkih akreditiva u mre\u017eama s razli\u010ditim SSID-ima. Korisnici se mogu za\u0161tititi koriste\u0107i pouzdane VPN-ove prilikom povezivanja putem bilo kojih be\u017ei\u010dnih mre\u017ea.

    \r\n \"Pogledajte\r\n
    <\/div>\r\n <\/div><\/center>
    \n
    Izvor:     opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041b\u0451\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e \u043a\u0430\u0442\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0411\u0435\u043b\u044c\u0433\u0438\u044f), \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-52424) \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 Wi-Fi IEEE 802.11, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u043c\u0435\u043d\u0435\u0435 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0439 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0441\u0435\u0442\u0438, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0430\u043c\u0435\u0440\u0435\u0432\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0441\u0442\u0435\u043a\u0430\u0445 \u043b\u044e\u0431\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 WPA3, WEP, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115833,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115832","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Napad SSID Confusion, koji omogu\u0107ava zamjenu Wi-Fi mre\u017ee | ProHoster","description":"Grupa istra\u017eiva\u010da sa Sveu\u010dili\u0161ta u Leuven (Belgija) otkrila je arhitektonsku ranjivost (CVE-2023-52424) u Wi-Fi standardu IEEE 802.11 koja omogu\u0107ava povezivanje s manje za\u0161ti\u0107enim mre\u017eama.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 SSID Confusion, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u0435\u0442\u044c Wi-Fi | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041b\u0451\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e \u043a\u0430\u0442\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0411\u0435\u043b\u044c\u0433\u0438\u044f), \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-52424) \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 Wi-Fi IEEE 802.11, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u043c\u0435\u043d\u0435\u0435 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T12:59:27+00:00","article:modified_time":"2024-05-16T12:59:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115832","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:58:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:29:19","updated":"2026-02-04 14:58:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/115832","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=115832"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/115832\/revisions"}],"predecessor-version":[{"id":156771,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/115832\/revisions\/156771"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/115833"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=115832"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=115832"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=115832"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}