{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"A\u017eurirajte RouterOS na va\u0161em MikroTik","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"A\u017eurirajte
\nU ve\u010dernjim satima 10. o\u017eujka korisni\u010dka podr\u0161ka Mail.ru po\u010dela je primati pritu\u017ebe korisnika o nemogu\u0107nosti povezivanja na IMAP\/SMTP poslu\u017eitelje Mail.ru putem po\u0161tanskih programa. Prilikom toga, neki od povezanih poku\u0161aja nisu prolazili, dok su drugi prikazivali gre\u0161ku certifikata. Gre\u0161ka je uzrokovana time \u0161to \u201eposlu\u017eitelj\u201c pru\u017ea samo-potpisani TLS certifikat.
\n<\/a><\/noindex>\u00a0
\n\"A\u017eurirajte
\nTijekom dva dana zaprimljeno je vi\u0161e od 10 pritu\u017ebi korisnika iz raznih mre\u017ea i s raznim ure\u0111ajima, \u0161to je \u010dinilo malo vjerojatnim da je problem u mre\u017ei nekog jednoga davatelja usluga. Detaljnija analiza problema pokazala je da dolazi do zamjene poslu\u017eitelja imap.mail.ru (kao i drugih po\u0161tanskih poslu\u017eitelja i usluga) na razini DNS-a. Zatim, uz aktivnu pomo\u0107 na\u0161ih korisnika, otkrili smo da je uzrok u pogre\u0161nom unosu u predmemoriji njihovog usmjeriva\u010da, koji je ujedno slu\u017eio kao lokalni DNS resolver, a koja je u mnogim (ali ne svim) slu\u010dajevima bilo ure\u0111aj MikroTik, vrlo popularan u malim korporativnim mre\u017eama i me\u0111u malim davateljima internetskih usluga.<\/p>\n

Koji je problem<\/h2>\n

\nU rujnu 2019. godine, istra\u017eiva\u010di. otkriveno <\/a><\/noindex>nekoliko ranjivosti u MikroTik RouterOS (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979), koje su omogu\u0107avale DNS cache poisoning napad, tj. mogu\u0107nost zamjene DNS zapisa u DNS predmemoriji usmjeriva\u010da, a CVE-2019-3978 omogu\u0107ava napada\u010du da ne \u010deka da netko iz unutarnje mre\u017ee zatra\u017ei unos sa svog DNS poslu\u017eitelja kako bi otrovao predmemoriju resolvera, ve\u0107 da sam pokrene takav zahtjev putem porta 8291 (UDP i TCP). Ranjivost je ispravljena od strane MikroTik-a u verzijama RouterOS 6.45.7 (stabilna) i 6.44.6 (dugoro\u010dna) 28. listopada 2019., me\u0111utim, prema istra\u017eivanjima <\/a><\/noindex>ve\u0107i dio korisnika trenutno nije instalirao zakrpe.<\/p>\n

O\u010digledno je da se sada ovaj problem aktivno iskori\u0161tava \"u \u017eivo\".<\/p>\n

Kako to mo\u017ee biti opasno<\/h2>\n

\nNapada\u010d mo\u017ee zamijeniti DNS zapis bilo kojeg hosta na koji se korisnik iz unutarnje mre\u017ee obra\u0107a, time presre\u0107u\u0107i promet prema njemu. Ako se osjetljive informacije \u0161alju bez enkripcije (npr. putem http:\/\/ bez TLS-a) ili korisnik pristane prihvatiti la\u017eni certifikat, napada\u010d mo\u017ee dobiti sve podatke koji se \u0161alju kroz vezu, kao \u0161to su korisni\u010dko ime ili lozinka. Na\u017ealost, praksa pokazuje da ako korisnik ima mogu\u0107nost prihvatiti la\u017eni certifikat, tada \u0107e je iskoristiti.<\/p>\n

Za\u0161to ba\u0161 SMTP i IMAP poslu\u017eitelji, i \u0161to je \u0161titilo korisnike<\/h2>\n

\nZa\u0161to su napada\u010di poku\u0161avali presresti upravo SMTP\/IMAP promet e-po\u0161tanskih aplikacija, a ne web promet, iako ve\u0107ina korisnika pristupa po\u0161ti putem preglednika koriste\u0107i HTTPS?<\/p>\n

Nisu sve e-po\u0161tanske aplikacije koje koriste SMTP i IMAP\/POP3 za\u0161titile korisnika od pogre\u0161ke, onemogu\u0107uju\u0107i mu slanje korisni\u010dkog imena i lozinke putem nesigurne ili kompromitirane veze, iako prema standardu RFC 8314<\/a><\/noindex>, usvojenom 2018. (a provedenom u Mail.ru mnogo ranije), trebale bi \u0161tititi korisnika od presretanja lozinke putem bilo koje neza\u0161ti\u0107ene veze. Osim toga, dok se u e-po\u0161tnim klijentima vrlo rijetko koristi OAuth protokol (koji podr\u017eavaju e-po\u0161tanski poslu\u017eitelji Mail.ru), bez njega se korisni\u010dko ime i lozinka prenose u svakoj sesiji.<\/p>\n

Preglednici mogu biti malo bolje za\u0161ti\u0107eni od napada Man-in-the-Middle. Na svim kriti\u010dnim domenima mail.ru pored HTTPS-a uklju\u010dena je HSTS politika (HTTP stroga sigurnost prijenosa). Kada je HSTS uklju\u010den, moderni preglednik ne daje korisniku jednostavnu mogu\u0107nost prihva\u0107anja la\u017enog certifikata, \u010dak i ako korisnik to \u017eeli. Osim HSTS-a, korisnicima je pomoglo i to \u0161to od 2017. godine SMTP, IMAP i POP3 poslu\u017eitelji Mail.ru zabranjuju prijenos lozinke putem neza\u0161ti\u0107ene veze, svi na\u0161i korisnici koristili su TLS za pristup putem SMTP, POP3 i IMAP, pa se lozinka i korisni\u010dko ime mogu presresti samo ako korisnik sam pristane prihvatiti zamijenjeni certifikat.<\/p>\n

Za mobilne korisnike uvijek preporu\u010dujemo kori\u0161tenje Mail.ru aplikacija za pristup e-po\u0161ti, jer je rad s po\u0161tom u njima sigurniji nego u preglednicima ili ugra\u0111enim SMTP\/IMAP klijentima.<\/p>\n

\u0160to treba u\u010diniti<\/h2>\n

\nPotrebno je a\u017eurirati firmware MikroTik RouterOS na sigurnu verziju. Ako to iz bilo kojeg razloga nije mogu\u0107e, potrebno je filtrirati promet na portu 8291 (tcp i udp), \u0161to \u0107e ote\u017eati iskori\u0161tavanje problema, iako ne\u0107e otkloniti mogu\u0107nost pasivne injekcije u DNS cache. Internet provajderi trebaju filtrirati ovaj port u svojim mre\u017eama kako bi za\u0161titili korporativne korisnike.\u00a0<\/p>\n

Svi korisnici koji su prihvatili zamijenjeni certifikat trebaju hitno promijeniti lozinku e-po\u0161te i drugih servisa za koje je taj certifikat prihva\u0107en. S na\u0161e strane, obavijestit \u0107emo korisnike koji se prijavljuju na e-po\u0161tu putem ranjivih ure\u0111aja.<\/p>\n

P.S. Postoji jo\u0161 jedna povezana ranjivost opisana u postu LukaSafonov<\/a><\/noindex> \"Backport ranjivost u RouterOS ugro\u017eava stotine tisu\u0107a ure\u0111aja<\/a><\/noindex>\".
\n
Izvor: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A\u017eurirajte RouterOS na va\u0161em MikroTik | ProHoster","description":"U ve\u010dernjim satima 10. o\u017eujka slu\u017eba za korisnike Mail.ru zapo\u010dela je.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}