{"id":119766,"date":"2024-09-12T03:43:01","date_gmt":"2024-09-12T01:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom"},"modified":"2024-09-12T03:43:01","modified_gmt":"2024-09-12T01:43:01","slug":"popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","title":{"rendered":"Pr\u00f3ba uzyskania certyfikat\u00f3w TLS dla cudzych domen mobi, korzystaj\u0105c z wygas\u0142ej domeny z us\u0142ug\u0105 WHOIS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Badacze z firmy watchTowr Labs opublikowali wyniki eksperymentu dotycz\u0105cego przej\u0119cia przestarza\u0142ego serwisu WHOIS rejestratora strefy domenowej «.MOBI». Powodem badania by\u0142a zmiana adresu serwisu WHOIS przez rejestratora, kt\u00f3ry przeni\u00f3s\u0142 go z domeny whois.dotmobiregistry.net na nowy host whois.nic.mobi. Domena dotmobiregistry.net przesta\u0142a by\u0107 u\u017cywana i w grudniu 2023 roku zosta\u0142a zwolniona, staj\u0105c si\u0119 dost\u0119pn\u0105 do rejestracji. <\/p>\n

Badacze wydali 20 dolar\u00f3w na zakup tej domeny, po czym uruchomili na swoim serwerze w\u0142asny fikcyjny serwis WHOIS whois.dotmobiregistry.net. Zaskoczeniem by\u0142o to, \u017ce wiele system\u00f3w nie przesz\u0142o na nowy host whois.nic.mobi i nadal u\u017cywa\u0142o starej nazwy. Od 30 sierpnia do 4 wrze\u015bnia bie\u017c\u0105cego roku odnotowano 2,5 miliona zapyta\u0144 do starej nazwy, wys\u0142anych z ponad 135 tysi\u0119cy unikalnych system\u00f3w. <\/p>\n

W\u015br\u00f3d nadawc\u00f3w zapyta\u0144 znajdowa\u0142y si\u0119 e-maile serwery<\/a> pa\u0144stwowych i wojskowych organizacji, kt\u00f3re sprawdza\u0142y pojawiaj\u0105ce si\u0119 w e-mailach domeny za po\u015brednictwem WHOIS, oraz firmy zajmuj\u0105ce si\u0119 bezpiecze\u0144stwem i platformy zapewniania bezpiecze\u0144stwa (VirusTotal, Group-IB), a tak\u017ce centra certyfikacji, us\u0142ugi sprawdzania domen, us\u0142ugi SEO i rejestratorzy domen (na przyk\u0142ad domain.com, godaddy.com, who.is, whois.ru, smallseo.tools, seocheki.net, centralops.net, name.com, urlscan.io oraz webchart.org). <\/p>\n

Mo\u017cliwo\u015b\u0107 wysy\u0142ania dowolnych danych w odpowiedzi na zapytania do starego serwisu WHOIS strefy domeny «.MOBI» zosta\u0142a wykorzystana do opracowania kilku rodzaj\u00f3w atak\u00f3w na nadawc\u00f3w zapyta\u0144. Pierwszy wariant ataku opiera\u0142 si\u0119 na za\u0142o\u017ceniu, \u017ce je\u015bli kto\u015b wci\u0105\u017c wysy\u0142a zapytania do dawno zamienionego serwisu, to prawdopodobnie robi to za pomoc\u0105 przestarza\u0142ych narz\u0119dzi, kt\u00f3re zawieraj\u0105 luki. <\/p>\n

Na przyk\u0142ad w phpWHOIS w 2015 roku odkryto luk\u0119 CVE-2015-5243, kt\u00f3ra umo\u017cliwia\u0142a wykonanie kodu atakuj\u0105cego podczas analizy specjalnie sformatowanych danych zwracanych przez serwer WHOIS. Innym przyk\u0142adem jest luka CVE-2021-32749 w pakiecie Fail2Ban, odkryta w 2021 roku, kt\u00f3ra umo\u017cliwia wykonanie zewn\u0119trznego kodu w przypadku zwr\u00f3cenia niepoprawnych danych przez serwis WHOIS, u\u017cywany w procesie generowania ostrze\u017cenia o blokadzie (Fail2Ban okre\u015bla\u0142 przez WHOIS e-mail administratora hosta i wskazywa\u0142 go przy uruchomieniu polecenia mail bez odpowiedniego escapowania znak\u00f3w specjalnych). <\/p>\n

Drugi atak opiera si\u0119 na tym, \u017ce niekt\u00f3re centra uwierzytelniania oferuj\u0105 mo\u017cliwo\u015b\u0107 weryfikacji posiadania domeny przez email podany w bazie rejestratora domeny, dost\u0119pnej przez protok\u00f3\u0142 WHOIS. Okaza\u0142o si\u0119, \u017ce kilka centr\u00f3w uwierzytelniania obs\u0142uguj\u0105cych t\u0119 metod\u0119 weryfikacji nadal korzysta ze starego serwera WHOIS dla strefy domenowej «.MOBI». <\/p>\n

W ten spos\u00f3b, przejmuj\u0105c kontrol\u0119 nad nazw\u0105 whois.dotmobiregistry.net, atakuj\u0105cy mog\u0105 zwr\u00f3ci\u0107 swoje dane, przeprowadzi\u0107 potwierdzenie i uzyska\u0107 TLS certificate<\/a> dla ka\u017cdej domeny w strefie .MOBI». Na przyk\u0142ad, podczas eksperymentu badacze wyst\u0105pili do rejestratora GlobalSign o certyfikat TLS dla domeny microsoft.mobi, a zwr\u00f3cony przez fikcyjny serwis WHOIS email «whois@watchTowr.com» zosta\u0142 pokazany w interfejsie jako dost\u0119pny do wysy\u0142ki kodu potwierdzaj\u0105cego posiadanie domeny.

\"Pr\u00f3ba<\/center>
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0433\u043e WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b «.MOBI». \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0443\u0436\u0438\u043b\u043e \u0442\u043e, \u0447\u0442\u043e \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u043f\u043e\u043c\u0435\u043d\u044f\u043b \u0430\u0434\u0440\u0435\u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u043f\u0435\u0440\u0435\u043c\u0435\u0441\u0442\u0438\u0432 \u0435\u0433\u043e \u0441 \u0434\u043e\u043c\u0435\u043d\u0430 whois.dotmobiregistry.net \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0445\u043e\u0441\u0442 whois.nic.mobi. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043e\u043c\u0435\u043d dotmobiregistry.net \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438 \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2023 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d \u0438 \u0441\u0442\u0430\u043b \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0440\u0430\u0442\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":119767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Pr\u00f3ba uzyskania certyfikat\u00f3w TLS dla cudzych domen mobi, wykorzystuj\u0105c wygas\u0142\u0105 domen\u0119 z serwisem WHOIS | ProHoster","description":"Badacze z firmy watchTowr Labs opublikowali wyniki eksperymentu z przejmowaniem przestarza\u0142ego serwisu WHOIS rejestratora strefy domenowej \".MOBI\".","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043b\u044f \u0447\u0443\u0436\u0438\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 mobi, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u043e\u0441\u0440\u043e\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u043c\u0435\u043d \u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0433\u043e WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b ".MOBI".","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-09-12T01:43:01+00:00","article:modified_time":"2024-09-12T01:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:33:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:28:23","updated":"2026-02-09 17:33:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/119766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=119766"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/119766\/revisions"}],"predecessor-version":[{"id":159214,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/119766\/revisions\/159214"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/119767"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=119766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=119766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=119766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}