{"id":117814,"date":"2024-07-18T15:43:01","date_gmt":"2024-07-18T13:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi"},"modified":"2024-07-18T15:43:01","modified_gmt":"2024-07-18T13:43:04","slug":"ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","title":{"rendered":"Port Shadow napad koji omogu\u0107uje preusmjeravanje veza drugih korisnika VPN-a i Wi-Fi-ja","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Grupa istra\u017eiva\u010da iz kanadskih i ameri\u010dkih sveu\u010dili\u0161ta razvila je tehniku napada Port Shadow koja omogu\u0107ava, manipulacijom tablicama prevo\u0111enja adresa na strani VPN poslu\u017eitelja, isporuku odgovora na zahtjev drugom korisniku koji je povezan na isti VPN poslu\u017eitelj. Metoda se mo\u017ee koristiti za presretanje ili preusmjeravanje \u0161ifriranog prometa, provo\u0111enje skeniranja portova i deanonimizaciju korisnika VPN-a. Kao primjer, prikazuje se kako se metoda mo\u017ee koristiti za preusmjeravanje DNS-upita korisnika koji radi preko VPN poslu\u017eitelja, na koji se mo\u017ee spojiti napada\u010d. <\/p>\n

Kako bi izveo napad, napada\u010d mora imati mogu\u0107nost povezivanja s jednim VPN<\/a>-poslu\u017eiteljem s metom, \u0161to je mogu\u0107e, na primjer, kori\u0161tenjem standardnih VPN operatera i javnih VPN usluga koje nude pristup svima zainteresiranima. Ranjivost poga\u0111a VPN poslu\u017eitelje koji koriste prevo\u0111enje adresa (NAT) za organiziranje pristupa klijenata vanjskim resursima, pri \u010demu se za prijem prometa od klijenata i slanje zahtjeva vanjskim stranicama serveru<\/a> mora koristiti istu IP adresu. <\/p>\n

Napad se temelji na tome da slanjem posebno oblikovanih zahtjeva napada\u010d, povezan na isti VPN poslu\u017eitelj i koristi zajedni\u010dki NAT, mo\u017ee uzrokovati iskrivljenje sadr\u017eaja tablica prevo\u0111enja adresa, \u0161to \u0107e rezultirati time da \u0107e paketi upu\u0107eni jednom korisniku biti usmjereni drugom korisniku. U tablicama prevo\u0111enja adresa, informacija o tome s kojom unutarnjom IP adresom se podudara poslan zahtjev, odre\u0111uje se na temelju broja izvorne mre\u017ene pristupne to\u010dke kori\u0161tene pri slanju zahtjeva. Napada\u010d mo\u017ee slanjem odre\u0111enih SYN i ACK paketa i istodobnim manipulacijama sa strane klijentove veze prema VPN poslu\u017eitelju i sa strane napada\u010devog kontroliranog vanjskog poslu\u017eitelja uzrokovati pojavu kolizije u NAT tablici i dodavanje unosa s istim brojem izvorne pristupne to\u010dke, ali povezanog s njegovom lokalnom adresom, \u0161to \u0107e rezultirati time da \u0107e odgovori na tu\u0111i zahtjev biti vra\u0107eni na adresu napada\u010da.

\"Port<\/center> <\/p>\n

Istra\u017eivanjem su testirani sustavi prevo\u0111enja adresa Linux i FreeBSD u kombinaciji s VPN-om OpenVPN, OpenConnect i WireGuard. Platforma FreeBSD pokazala se otpornom na metode napada usmjeravanja zahtjeva koje provode drugi korisnici povezani na istom VPN-u. Zamjena u NAT tablicama mogla se izvr\u0161iti samo tijekom ATIP napada (Adjacent-to-In-Path), gdje napada\u010d mo\u017ee presje\u0107i promet izme\u0111u korisnika i VPN servera (na primjer, kada se korisnik povezuje na Wi-Fi mre\u017eu koju kontrolira napada\u010d) ili izme\u0111u VPN servera i ciljne stranice. Pri tome je NAT FreeBSD tako\u0111er bila zahva\u0107ena napadom koji omogu\u0107uje odre\u0111ivanje povezivanja korisnika na odre\u0111enu web stranicu (Connection Inference). <\/p>\n

\u0160to se ti\u010de Linuxa, podsustav Netfilter bio je podlo\u017ean napadima koji omogu\u0107avaju zamjenu unosa u tablici prevo\u0111enja adresa, \u0161to omogu\u0107uje preusmjeravanje dolaznih paketa drugom korisniku, slanje paketa izvan \u0161ifriranog VPN kanala (Decapsulation) ili odre\u0111ivanje otvorenih mre\u017enih portova na strani klijenta.

\"Port<\/center> <\/p>\n

Kao mjere za blokiranje napada, VPN pru\u017eateljima se preporu\u010duje kori\u0161tenje adekvatnih metoda randomizacije brojeva izvora portova u NAT-u, ograni\u010davanje broja dopu\u0161tenih simultanih poveza na VPN server od strane jednog korisnika, kao i blokiranje mogu\u0107nosti izbora mre\u017enog porta od strane klijenta za prihva\u0107anje zahtjeva na strani VPN servera. <\/p>\n

Prema rije\u010dima predstavnika tvrtke Proton AG, napad ne utje\u010de na VPN usluge koje koriste odvojene IP adrese za dolazne i odlazne zahtjeve. Osim toga, postoje sumnje u mogu\u0107nost primjene napada na stvarne VPN usluge, budu\u0107i da je uspje\u0161an napad do sada demonstriran samo u laboratorijskim testovima i za njega su potrebni odre\u0111eni uvjeti na strani VPN servera i napadnutog klijenta. Tako\u0111er, napad mo\u017ee biti koristan samo za manipulacije ne\u0161ifriranim zahtjevima, poput DNS upita, dok upotreba TLS-a i HTTPS-a na razini aplikacija \u010dini preusmjeravanje prometa beskorisnim. <\/p>\n

Manipulacije s tablicama prevo\u0111enja adresa napada primjenjuju se ne samo na VPN, ve\u0107 i na be\u017ei\u010dne mre\u017ee, u kojima se za organizaciju povezivanja korisnika s vanjskim resursima na pristupnoj to\u010dki koristi NAT. Pro\u0161log mjeseca objavljeni su rezultati istra\u017eivanja mogu\u0107nosti provo\u0111enja sli\u010dnog napada za presretanje TCP veza drugih korisnika be\u017ei\u010dne mre\u017ee. Metoda napada pokazala se primjenjivom na 24 od 33 testirane be\u017ei\u010dne pristupne to\u010dke.

\"Port<\/center> <\/p>\n

Predlo\u017eeni napad za Wi-Fi bio je znatno jednostavniji od prethodno spomenutog metoda za VPN, jer zbog primjene optimizacija, mnoge pristupne to\u010dke ne provjeravaju ispravnost brojeva sekvenci u TCP paketima. Na kraju, za napad je bilo dovoljno poslati la\u017eni RST paket za \u010di\u0161\u0107enje zapisa u tablici prevo\u0111enja adresa, a zatim ostvariti preusmjeravanje odgovora na doma\u0107in napada\u010da kako bi se odredili brojevi sekvenci (SEQ) i potvrde (ACK) potrebni za presretanje TCP veze.

\"Port<\/center>
\"Port<\/center>
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0445 \u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441 \u0434\u0440\u0443\u0433\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c\u0443 \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0443. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u0434\u0435\u0430\u043d\u043e\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117815,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117814","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Napad Port Shadow, koji omogu\u0107ava preusmjeravanje veza drugih korisnika VPN i Wi-Fi | ProHoster","description":"Grupa istra\u017eiva\u010da iz kanadskih i ameri\u010dkih sveu\u010dili\u0161ta razvila je tehniku napada Port Shadow, koja omogu\u0107ava, manipulacijom s tablicama prevo\u0111enja adresa na strani VPN poslu\u017eitelja, slanje odgovora na.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN \u0438 Wi-Fi | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0445 \u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-18T13:43:04+00:00","article:modified_time":"2024-07-18T13:43:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117814","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:00:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 04:28:19","updated":"2026-02-09 22:00:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/117814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=117814"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/117814\/revisions"}],"predecessor-version":[{"id":160055,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/117814\/revisions\/160055"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/117815"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=117814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=117814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=117814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}