{"id":112410,"date":"2023-12-22T03:10:14","date_gmt":"2023-12-22T01:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij"},"modified":"2023-12-22T03:10:14","modified_gmt":"2023-12-22T01:10:16","slug":"smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","title":{"rendered":"SMTP Smuggling \u2014 \u00faj technika a levelek hamis\u00edt\u00e1s\u00e1ra","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A SEC Consult kutat\u00f3i egy \u00faj spoofing technik\u00e1t publik\u00e1ltak, amely a SMTP protokoll k\u00fcl\u00f6nb\u00f6z\u0151 megval\u00f3s\u00edt\u00e1sainak specifik\u00e1ci\u00f3val val\u00f3 elt\u00e9r\u00e9seib\u0151l ad\u00f3dik. Az aj\u00e1nlott t\u00e1mad\u00e1si technika lehet\u0151v\u00e9 teszi, hogy egy \u00fczenetet t\u00f6bb k\u00fcl\u00f6nb\u00f6z\u0151 \u00fczenetre bontsanak, amikor az az els\u0151dleges SMTP szerverr\u0151l egy m\u00e1sik SMTP szerverre ker\u00fcl \u00e1t, amely m\u00e1sk\u00e9nt \u00e9rtelmezi az egy kapcsolaton kereszt\u00fcl k\u00fcld\u00f6tt \u00fczenetek elv\u00e1laszt\u00e1s\u00e1t. Ez a m\u00f3dszer felhaszn\u00e1lhat\u00f3 hamis \u00fczenetek k\u00fcld\u00e9s\u00e9re m\u00e1s felad\u00f3 nev\u00e9ben olyan levelez\u0151 szolg\u00e1ltat\u00e1sokban, amelyek ellen\u0151rzik az eredeti felad\u00f3t. <\/p>\n

A probl\u00e9ma abb\u00f3l fakad, hogy a k\u00fcl\u00f6nb\u00f6z\u0151 SMTP-szerverek elt\u00e9r\u0151en \u00e9rtelmezik az adatok befejez\u00e9s\u00e9t, ami miatt egy \u00fczenet t\u00f6bb r\u00e9szre is bonthat\u00f3 egy SMTP-szerverhez val\u00f3 kapcsol\u00f3d\u00e1s sor\u00e1n. A levelek k\u00fcld\u00e9s\u00e9nek v\u00e9g\u00e9t «\r\n.\r\n» (a pontot k\u00eds\u00e9r\u0151 visszat\u00e9r\u00e9si karakterek \u00e9s \u00faj sorok) jel\u00f6lik a specifik\u00e1ci\u00f3ban. E fon\u00e1s ut\u00e1n m\u00e1s \u00fczenetek k\u00fcld\u00e9s\u00e9re vonatkoz\u00f3 parancsok k\u00f6vetkezhetnek a kapcsolat megszak\u00edt\u00e1sa n\u00e9lk\u00fcl. N\u00e9h\u00e1ny SMTP-szerver szigor\u00faan k\u00f6veti a szab\u00e1lyokat, m\u00edg m\u00e1sok a ritka levelez\u0151kliens kompatibilit\u00e1s\u00e1nak biztos\u00edt\u00e1sa \u00e9rdek\u00e9ben olyan elv\u00e1laszt\u00f3 karakterl\u00e1ncokat is kezelnek, mint p\u00e9ld\u00e1ul «\n.\n», «\n.\r\n», «\r\n.\n», «\r.\r», «\r\n0.\r\n» \u00e9s «\r\n0.\r\n». <\/p>\n

A t\u00e1mad\u00e1s l\u00e9nyege, hogy az els\u0151 szerver<\/a>, amely csak a «\r\n.\r\n» elv\u00e1laszt\u00f3n kereszt\u00fcl kezeli az \u00fczenetet, amelynek t\u00f6rzs\u00e9ben alternat\u00edv elv\u00e1laszt\u00f3 van, p\u00e9ld\u00e1ul «\r.\r», amelyet a m\u00e1sodik \u00fczenet k\u00fcld\u00e9si parancsai k\u00f6vetnek. Mivel az els\u0151 szerver szigor\u00faan k\u00f6veti a specifik\u00e1ci\u00f3t, az eszk\u00f6z\u00f6ket egy \u00fczenetk\u00e9nt kezeli. Ha ezt k\u00f6vet\u0151en az \u00fczenet \u00e1tmeneti vagy a c\u00edmzett szerverhez ker\u00fcl, amely szint\u00e9n a «\r.\r» karakterl\u00e1ncot elv\u00e1laszt\u00f3k\u00e9nt fogadja, akkor ezt a levelet k\u00e9t k\u00fcl\u00f6n\u00e1ll\u00f3 k\u00fcld\u00f6tt \u00edr\u00e1sk\u00e9nt fogj\u00e1k feldolgozni (a m\u00e1sodik \u00fczenet k\u00fcldheti azt a felhaszn\u00e1l\u00f3t, aki nem az «AUTH LOGIN» parancs keretein bel\u00fcl van, de a c\u00edmzett oldal\u00e1n helyesnek t\u0171nhet).

\"SMTP<\/center>
\"SMTP<\/center> <\/p>\n

Az alternat\u00edv elv\u00e1laszt\u00f3kat megenged\u0151 SMTP-szerverek \u00e9s szolg\u00e1ltat\u00e1sok p\u00e9ld\u00e1ul a Postfix, Sendmail, MS Exchange Online \u00e9s Cisco Secure Email Gateway, m\u00edg a m\u00e1s szerverekhez val\u00f3 kapcsol\u00f3d\u00e1s sor\u00e1n a hib\u00e1s elv\u00e1laszt\u00f3kat nem sz\u0171r\u0151 levelez\u0151szolg\u00e1ltat\u00e1sok k\u00f6z\u00e9 tartozik a GMX, iCloud \u00e9s Microsoft Outlook. <\/p>\n

A Postfix 3.8.1, 3.7.6, 3.6.10 \u00e9s 3.5.20 kiad\u00e1sokban a probl\u00e9m\u00e1k blokkol\u00e1s\u00e1ra bevezet\u00e9sre ker\u00fclt az «smtpd_forbid_unauth_pipelining» be\u00e1ll\u00edt\u00e1s, amely megszak\u00edtja a kapcsolatot, ha nem megfelel\u0151 RFC 2920 \u00e9s RFC 5321 el\u0151\u00edr\u00e1soknak megfelel\u0151 elv\u00e1laszt\u00f3kat haszn\u00e1lnak. Jelenleg az alap\u00e9rtelmezett be\u00e1ll\u00edt\u00e1s ki van kapcsolva, azonban tervezik, hogy alap\u00e9rtelmez\u00e9s szerint aktiv\u00e1lj\u00e1k a Postfix 3.9 \u00e1gon, amely 2024 tavasz\u00e1n v\u00e1rhat\u00f3. A 3.9 \u00e1gon be lesz vezetve a smtpd_forbid_bare_newline be\u00e1ll\u00edt\u00e1s is, amely hib\u00e1t jelez, ha csak a sort\u00f6r\u00e9s karaktert («\n») haszn\u00e1lj\u00e1k a sorok elv\u00e1laszt\u00e1s\u00e1ra, ami megs\u00e9rti az RFC 5321-et. <\/p>\n

A k\u00f6zelg\u0151 Sendmail 8.18.0.2 kiad\u00e1sban a srv_features v\u00e9delem \u00e9rdek\u00e9ben egy ‘o’ opci\u00f3t javasolnak, amely csak a «\r\n.\r\n» szekvencia feldolgoz\u00e1s\u00e1t enged\u00e9lyezi. Megjegyzik, hogy az alternat\u00edv elv\u00e1laszt\u00f3k t\u00e1mogat\u00e1s\u00e1nak letilt\u00e1sa n\u00e9h\u00e1ny ritka levelez\u0151kliensek m\u0171k\u00f6d\u00e9s\u00e9t zavarhatja, amelyek nem felelnek meg teljes m\u00e9rt\u00e9kben az SMTP specifik\u00e1ci\u00f3nak.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SEC Consult \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMTP. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0440\u0430\u0441\u0449\u0435\u043f\u0438\u0442\u044c \u043e\u0434\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043f\u0440\u0438 \u0435\u0433\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c SMTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 SMTP-\u0441\u0435\u0440\u0432\u0435\u0440, \u043f\u043e \u0438\u043d\u043e\u043c\u0443 \u0442\u0440\u0430\u043a\u0442\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0438\u0441\u0435\u043c, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043e\u0434\u043d\u043e \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":112411,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112410","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SMTP Smuggling \u2014 egy \u00faj technika a levelek hamis\u00edt\u00e1s\u00e1ra | ProHoster","description":"A SEC Consult kutat\u00f3i k\u00f6zz\u00e9tettek egy \u00faj hamis\u00edt\u00e1si technik\u00e1t, amely a k\u00fcl\u00f6nb\u00f6z\u0151 SMTP protokoll megval\u00f3s\u00edt\u00e1sok specifik\u00e1ci\u00f3k k\u00f6vet\u00e9s\u00e9ben tapasztalhat\u00f3 elt\u00e9r\u00e9sekb\u0151l ered.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SMTP Smuggling \u2014 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SEC Consult \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMTP.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-22T01:10:16+00:00","article:modified_time":"2023-12-22T01:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/112410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=112410"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/112410\/revisions"}],"predecessor-version":[{"id":172924,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/112410\/revisions\/172924"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/112411"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=112410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=112410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=112410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}