{"id":107780,"date":"2023-04-08T12:48:10","date_gmt":"2023-04-08T10:48:12","guid":{"rendered":"https:\/\/prohoster.info\/?p=107780"},"modified":"2023-04-10T11:12:07","modified_gmt":"2023-04-10T09:12:07","slug":"uyazvimost-v-besprovodnyh-tochkah-dostupa-pozvolyayushhaya-organizovat-perehvat-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-besprovodnyh-tochkah-dostupa-pozvolyayushhaya-organizovat-perehvat-trafika","title":{"rendered":"Sebezhet\u0151s\u00e9g a vezet\u00e9k n\u00e9lk\u00fcli hozz\u00e1f\u00e9r\u00e9si pontokban, amely lehet\u0151v\u00e9 teszi a forgalom lehallgat\u00e1s\u00e1t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A group of researchers from Tsinghua University (China) and George Mason University (USA) has disclosed a vulnerability (CVE-2022-25667) in wireless access points that allows traffic interception (MITM) in wireless networks protected by WPA, WPA2, and WPA3 protocols. By manipulating ICMP packets with the 'redirect' flag, an attacker can redirect a victim's traffic within the wireless network through their system, which can be used to intercept and spoof unencrypted sessions (for example, requests to sites without HTTPS). <\/p>\n

The vulnerability is caused by insufficient filtering of spoofed ICMP messages with a forged sender address in network processors (NPU, Network Processing Unit) that handle low-level packet processing in wireless networks. Among other things, NPUs redirected spoofed ICMP packets with the 'redirect' flag without checking for spoofing, which can be used to modify the routing table parameters on the victim's side. The attack consists of sending an ICMP packet on behalf of the access point with the 'redirect' flag, specifying forged data in the packet header. Due to the vulnerability, the message is redirected by the access point and processed by the victim's network stack, which believes the message was sent by the access point.

\"Sebezhet\u0151s\u00e9g<\/center> <\/p>\n

A kutat\u00f3k \u00e1ltal javasolt egy m\u00f3dszert az ICMP csomagok redirect z\u00e1szlaj\u00e1nak ellen\u0151rz\u00e9s\u00e9nek megker\u00fcl\u00e9s\u00e9re a v\u00e9gfelhaszn\u00e1l\u00f3 oldal\u00e1n \u00e9s a routing t\u00e1bl\u00e1j\u00e1nak megv\u00e1ltoztat\u00e1s\u00e1ra. A t\u00e1mad\u00f3 el\u0151sz\u00f6r meghat\u00e1rozza az akt\u00edv UDP portot az \u00e1ldozat oldal\u00e1n a sz\u0171r\u00e9s megker\u00fcl\u00e9se \u00e9rdek\u00e9ben. Ugyanabban a vezet\u00e9k n\u00e9lk\u00fcli h\u00e1l\u00f3zatban a t\u00e1mad\u00f3 k\u00e9pes forgalmat megfigyelni, de nem k\u00e9pes azt dek\u00f3dolni, mivel nem ismeri a s\u00e9rtett hozz\u00e1f\u00e9r\u00e9si pontoz\u00e1sakor haszn\u00e1lt session kulcsot. Mindazon\u00e1ltal, a t\u00e1mad\u00f3 ellen\u0151rz\u0151 csomagokat k\u00fcldve az \u00e1ldozatnak, az \u00e9rkez\u0151 ICMP v\u00e1laszok elemz\u00e9s\u00e9n alapul\u00f3an, a Destination Unreachable z\u00e1szl\u00f3val, ki tudja az akt\u00edv UDP portot hat\u00e1rozni. Ezut\u00e1n a t\u00e1mad\u00f3 egy ICMP \u00fczenetet gener\u00e1l redirect z\u00e1szl\u00f3val \u00e9s hamis UDP fejl\u00e9cet, amelyben a felfedezett nyitott UDP port szerepel. E bej\u00f6v\u0151 \u00fczenet feldolgoz\u00e1sa a s\u00e9rtett rendszer routing t\u00e1bl\u00e1j\u00e1nak torzul\u00e1s\u00e1hoz vezet, \u00e9s lehet\u0151v\u00e9 teszi a forgalom ny\u00edlt szint\u0171 elfog\u00e1s\u00e1t az adatkapcsolati szinten.

\"Sebezhet\u0151s\u00e9g<\/center> <\/p>\n

A probl\u00e9ma jelenl\u00e9te meger\u0151s\u00edt\u00e9st nyert a HiSilicon \u00e9s Qualcomm gy\u00e1rtm\u00e1ny\u00fa chipet haszn\u00e1l\u00f3 hozz\u00e1f\u00e9r\u00e9si pontokban. 55 k\u00fcl\u00f6nb\u00f6z\u0151 hozz\u00e1f\u00e9r\u00e9si pont modell vizsg\u00e1lata 10 ismert gy\u00e1rt\u00f3t\u00f3l (Cisco, NetGear, Xiaomi, Mercury, 360, Huawei, TP-Link, H3C, Tenda, Ruijie) azt mutatta, hogy mindegyik\u00fck sebezhet\u0151, \u00e9s nem blokkolja a hamis ICMP-csomagokat. Tov\u00e1bb\u00e1, 122 megl\u00e9v\u0151 vezet\u00e9k n\u00e9lk\u00fcli h\u00e1l\u00f3zat elemz\u00e9se sor\u00e1n 109 h\u00e1l\u00f3zatban (89%) is lehet\u0151s\u00e9get tal\u00e1ltak t\u00e1mad\u00e1s v\u00e9grehajt\u00e1s\u00e1ra.

\"Sebezhet\u0151s\u00e9g<\/center> <\/p>\n

A sebezhet\u0151s\u00e9gek kihaszn\u00e1l\u00e1s\u00e1hoz a t\u00e1mad\u00f3nak jogosult csatlakoz\u00e1si lehet\u0151s\u00e9ggel kell rendelkeznie a Wi-Fi h\u00e1l\u00f3zathoz, azaz ismernie kell a vezet\u00e9k n\u00e9lk\u00fcli h\u00e1l\u00f3zat bel\u00e9p\u00e9si param\u00e9tereit (a sebezhet\u0151s\u00e9gek lehet\u0151v\u00e9 teszik a WPA* protokollokban alkalmazott felhaszn\u00e1l\u00f3i forgalom elv\u00e1laszt\u00f3 mechanizmusok megker\u00fcl\u00e9s\u00e9t). A hagyom\u00e1nyos MITM-t\u00e1mad\u00e1sokkal ellent\u00e9tben a vezet\u00e9k n\u00e9lk\u00fcli h\u00e1l\u00f3zatokban, az ICMP-csomagok hamis\u00edt\u00e1sa alkalmaz\u00e1s\u00e1val a t\u00e1mad\u00f3 an\u00e9lk\u00fcl is megker\u00fclheti a hamis hozz\u00e1f\u00e9r\u00e9si pont telep\u00edt\u00e9s\u00e9t, hogy a forgalom elt\u00e9r\u00edt\u00e9s\u00e9re a h\u00e1l\u00f3zat leg\u00e1lis hozz\u00e1f\u00e9r\u00e9si pontjait haszn\u00e1ln\u00e1, \u00e9s a c\u00e9lnak megfelel\u0151en m\u00f3dos\u00edtott ICMP-csomagokat ir\u00e1ny\u00edtana \u00e1t.