{"id":53634,"date":"2019-12-06T00:00:00","date_gmt":"2019-12-05T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli"},"modified":"2020-02-18T14:01:34","modified_gmt":"2020-02-18T11:01:34","slug":"uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","title":{"rendered":"Ranljivost koja omogu\u0107ava presretanje TCP veza koje se uspostavljaju preko VPN tunela","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Objavljeno<\/a><\/noindex> Tehnika napada (CVE-2019-14899) omogu\u0107uje zamjenu, promjenu ili umetanje paketa u TCP veze koje se propu\u0161taju kroz VPN tunele. Problem se odnosi na Linux, FreeBSD, OpenBSD, Android, macOS, iOS i druge Unix-sli\u010dne sustave. Linux podr\u017eava mehanizam rp_filter (filtriranje povratnog puta) za IPv4, \u010dije uklju\u010divanje u 'Strict' na\u010din neutralizira ovaj problem. <\/p>\n

Metoda omogu\u0107ava umetanje paketa na razini TCP veza unutar \u0161ifriranog tunela, ali ne omogu\u0107ava provale u veze koje koriste dodatne slojeve \u0161ifriranja (npr. TLS, HTTPS, SSH). Primijenjeni algoritmi \u0161ifriranja u VPN-u nisu bitni, jer la\u017eni paketi dolaze s vanjskog su\u010delja, a jezgra ih obra\u0111uje kao pakete iz VPN su\u010delja. Najvjerojatnija meta napada su neza\u0161ti\u0107ene HTTP veze, ali nije isklju\u010deno<\/a><\/noindex> i kori\u0161tenje napada za manipulaciju DNS odgovorima. <\/p>\n

Uspje\u0161na zamjena paketa demonstrirana je za tunele koje stvaraju OpenVPN, WireGuard i IKEv2\/IPSec. Tor nije podlo\u017ean ovom problemu jer koristi SOCKS za propu\u0161tanje prometa i vezanje na loopback su\u010delje. Za IPv4, napad je mogu\u0107 u slu\u010daju kada je rp_filter postavljen u 'Loose' na\u010din (sysctl net.ipv4.conf.all.rp_filter = 2). Prvotno je u ve\u0107ini sustava primijenjen 'Strict' na\u010din, ali od systemd 240<\/a><\/noindex>, objavljenog u prosincu pro\u0161le godine, zadani na\u010din rada je promijenjen u 'Loose' i ova promjena odra\u017eava se u zadanom postavkama mnogih Linux distribucija.<\/p>\n

Mehanizam rp_filter se koristi<\/a><\/noindex> za dodatnu provjeru putanja prolaska paketa kako bi se sprije\u010dila falsifikacija adrese izvora. Kada je postavljen na 0, provjera adrese izvora se ne provodi i svaki paket mo\u017ee bez ograni\u010denja prolaziti izme\u0111u mre\u017enih su\u010delja. Na\u010din 1 'Strict' uklju\u010duje provjeru svakog dolaznog paketa izvana na uskla\u0111enost s tablicom usmjeravanja, a ako mre\u017eno su\u010delje kroz koje je paket primljen nije povezano s optimalnom rutom za dostavu odgovora, paket se odbacuje. Na\u010din 2 'Loose' ubla\u017eava provjeru kako bi dopu\u0161tao rad prilikom primjene ravnote\u017eiva\u010da optere\u0107enja ili asimetri\u010dnog usmjeravanja, pri \u010demu
\nruta odgovora mo\u017ee prolaziti ne kroz onaj mre\u017eni su\u010delje kroz koje je primljen ulazni paket.<\/p>\n

U na\u010dinu 'Loose' dolazni paket se provjerava na uskla\u0111enost s tablicom usmjeravanja, ali se smatra dopu\u0161tenim ako je adresa izvora dostupna putem bilo kojeg postoje\u0107eg mre\u017enog su\u010delja. Predlo\u017eeni napad se temelji na tome da napada\u010d mo\u017ee poslati paket s zamijenjenom adresom izvora koja odgovara VPN su\u010delju, i unato\u010d tome \u0161to \u0107e ovaj paket u sustav do\u0107i putem vanjskog mre\u017enog su\u010delja, a ne putem VPN-a, u 'Loose' na\u010dinu rp_filter takav paket ne\u0107e biti odbijen. <\/p>\n

Za izvr\u0161enje napada, napada\u010d mora kontrolirati gateway putem kojeg korisnik izlazi na mre\u017eu (na primjer, putem MITM napada, pri povezivanju \u017ertve na kontroliranu napada\u010dem be\u017ei\u010dnu pristupnu to\u010dku ili preko hakiranja rutera<\/a><\/noindex>). Kontroliraju\u0107i gateway putem kojeg je povezan korisnik, napada\u010d mo\u017ee slati la\u017ene pakete koji \u0107e se do\u017eivjeti u kontekstu VPN mre\u017enog su\u010delja, ali \u0107e odgovori biti usmjereni kroz tunel.<\/p>\n

Generiranjem toka la\u017enih paketa, u kojima se zamjenjuje IP adresa VPN su\u010delja, poku\u0161ava se utjecati na uspostavljenu vezu od strane klijenta, no promatrati u\u010dinak ovih paketa mo\u017ee se samo putem pasivnog analize \u0161ifriranog toka prometa koji se odnosi na rad tunela. Za izvr\u0161enje napada potrebno je saznati dodeljenu IP adresu mre\u017enog su\u010delja tunela od strane VPN servera, kao i utvrditi da je trenutno aktivna veza ka odre\u0111enom hostu kroz tunel. <\/p>\n

Za odre\u0111ivanje IP-a virtualnog mre\u017enog su\u010delja VPN koristi se slanje SYN-ACK paketa na sustav \u017ertve, postupno pretra\u017euju\u0107i cijeli raspon virtualnih adresa (prvo se pretra\u017euju adrese koje se po defaultu koriste u VPN-u, na primjer, u OpenVPN se koristi podmre\u017ea 10.8.0.0\/24). O postojanju adrese mo\u017ee se suditi na temelju primanja odgovora s RST oznakom.<\/p>\n

Na sli\u010dan na\u010din odre\u0111uje se prisutnost veze s odre\u0111enim web mjestom i broj porta na strani klijenta \u2014 pretra\u017euju\u0107i brojeve portova \u0161alje se SYN paket, pri \u010demu se kao adresa izvora koristi IP adresa web mjesta, a adresa odredi\u0161ta je virtualni IP VPN. Serverski port se mo\u017ee predvidjeti (80 za HTTP), dok se broj porta na strani klijenta mo\u017ee izra\u010dunati pretra\u017eivanjem, analiziraju\u0107i za razli\u010dite brojeve promjenu intenziteta ACK odgovora uz izostanak paketa s RST oznakom.<\/p>\n

U ovoj se fazi napada\u010d zna sva \u010detiri elementa veze (izvora\/destinacije IP adrese\/portovi), ali da bi generirao la\u017eni paket koji \u0107e sustav \u017ertve prihvatiti, napada\u010d mora odrediti brojeve sekvenci i potvrde (seq i ack) TCP veze. Da bi odredio te parametre, napada\u010d kontinuirano \u0161alje la\u017ene RST pakete, isprobavaju\u0107i razli\u010dite brojeve sekvenci, dok ne zabilje\u017ei odgovor ACK paketa, \u010dija pojava ukazuje da broj spada unutar TCP prozora. <\/p>\n

Nakon toga napada\u010d potvr\u0111uje to\u010dnost odredbe slanjem paketa s istim brojem i promatraju\u0107i dolazak ACK odgovora, nakon \u010dega odabire to\u010dan broj trenutne sekvence. Zadatak je ote\u017ean \u010dinjenicom da se odgovori \u0161alju unutar \u0161ifriranog tunela i njihovo prisustvo u presretnutom prometu mo\u017ee se analizirati samo posredno. \u010cinjenica slanja ACK paketa namijenjenog VPN serveru od strane klijenta utvr\u0111uje se na temelju veli\u010dine i latencije \u0161ifriranih odgovora, koji koreliraju s slanjem la\u017enih paketa. Na primjer, za OpenVPN \u0161ifrirani paket veli\u010dine 79 omogu\u0107uje to\u010dno odre\u0111ivanje da unutar njega postoji ACK potvrda.<\/p>\n

Prije nego \u0161to za\u0161tita od napada bude dodana u jezgru operativnog sustava, kao privremena metoda blokiranja problema preporu\u010duje se<\/a><\/noindex> uz pomo\u0107 paketnog filtra u lancu \u00abpreroute\u00bb blokirati prolazak paketa u kojima je kao adresa odredi\u0161ta navedena virtualna IP adresa tunela.<\/p>\n

iptables -t raw -I PREROUTING ! -i wg0 -d 10.182.12.8 -m addrtype ! --src-type LOCAL -j DROP<\/p>\n

ili za nftables<\/p>\n

nft add table ip raw
\n nft add chain ip raw prerouting '{ type filter hook prerouting priority 0; }'
\n nft add rule ip raw prerouting 'iifname != \u00abwg0\u00bb ip daddr 10.182.12.8 fib saddr type != local drop'<\/p>\n

Za za\u0161titu pri kori\u0161tenju tunela s IPv4 adresama dovoljno je prebaciti rp_filter u 'Strict' re\u017eim ('sysctl net.ipv4.conf.all.rp_filter = 1'). S VPN strane, metoda odre\u0111ivanja broja sekvence mo\u017ee biti blokirana dodavanjem punjenja enkripciji paketa, \u010dime se posti\u017ee da sve pakete imaju istu veli\u010dinu. <\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-14899), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0432 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043f\u0440\u043e\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Linux, FreeBSD, OpenBSD, Android, macOS, iOS \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 Unix-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. Linux \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c rp_filter (reverse path filtering) \u0434\u043b\u044f IPv4, \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u0436\u0438\u043c «Strict» \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u041c\u0435\u0442\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432\u043d\u0443\u0442\u0440\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53634","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranljivost koja omogu\u0107ava infiltraciju u TCP veze ostvarene kroz VPN tunela | ProHoster","description":"Objavljena je tehnika napada (CVE-2019-14899) koja omogu\u0107ava zamjenu, izmjenu ili umetanje paketa.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043a\u043b\u0438\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-14899), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0432.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-05T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53634","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 08:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:21:20","updated":"2026-01-24 08:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/53634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=53634"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/53634\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=53634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=53634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=53634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}