{"id":84662,"date":"2020-06-10T01:42:15","date_gmt":"2020-06-09T23:42:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti"},"modified":"2020-06-10T01:42:15","modified_gmt":"2020-06-09T23:42:15","slug":"uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","title":{"rendered":"Uma vulnerabilidade no UPnP, adequada para amplifica\u00e7\u00e3o de ataques DDoS e varredura de redes internas","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Revelado<\/a><\/noindex> informa\u00e7\u00f5es sobre no aplicativo para Windows, que permitia ao usu\u00e1rio elevar seus privil\u00e9gios no sistema para administrador (a vulnerabilidade foi causada pela intera\u00e7\u00e3o inadequada entre o cliente GUI sem privil\u00e9gios e o servi\u00e7o de sistema).<\/a><\/noindex> (CVE-2020-12695<\/a><\/noindex>) no protocolo UPnP, permitindo que o tr\u00e1fego seja enviado a qualquer destinat\u00e1rio, usando a opera\u00e7\u00e3o de «SUBSCRIBE» prevista no padr\u00e3o. A vulnerabilidade recebeu o nome de c\u00f3digo CallStranger<\/a><\/noindex>. A vulnerabilidade pode ser utilizada para extra\u00e7\u00e3o de dados de redes protegidas por sistemas de preven\u00e7\u00e3o de vazamento de dados (DLP), organiza\u00e7\u00e3o de varreduras de portas em computadores na rede interna, bem como para aumentar ataques DDoS por meio de milh\u00f5es de dispositivos UPnP conectados \u00e0 rede global, como modems a cabo, roteadores dom\u00e9sticos, consoles de jogos, c\u00e2meras IP, set-top boxes, centros de m\u00eddia e impressoras.<\/p>\n

O problema \u00e9 causado<\/a><\/noindex> pois a fun\u00e7\u00e3o «SUBSCRIBE» especificada permite que qualquer atacante externo envie pacotes HTTP com o cabe\u00e7alho Callback e utilize o dispositivo UPnP como um proxy para enviar solicita\u00e7\u00f5es a outros hosts. A fun\u00e7\u00e3o «SUBSCRIBE» est\u00e1 definida na especifica\u00e7\u00e3o UPnP e \u00e9 usada para monitorar altera\u00e7\u00f5es em outros dispositivos e servi\u00e7os. Com o cabe\u00e7alho HTTP Callback, \u00e9 poss\u00edvel definir uma URL arbitr\u00e1ria \u00e0 qual o dispositivo tentar\u00e1 se conectar. <\/p>\n

\"Uma<\/a><\/noindex><\/center><\/p>\n

O problema afeta quase todas as implementa\u00e7\u00f5es do UPnP, baseadas em especifica\u00e7\u00f5es<\/a><\/noindex>, lan\u00e7adas antes de 17 de abril. A presen\u00e7a da vulnerabilidade confirmada<\/a><\/noindex> no pacote aberto hostapd<\/a><\/noindex> com a implementa\u00e7\u00e3o de ponto de acesso sem fio (WPS AP). A corre\u00e7\u00e3o est\u00e1 dispon\u00edvel atualmente como de patches<\/a><\/noindex>. As distribui\u00e7\u00f5es de atualiza\u00e7\u00e3o ainda n\u00e3o foram lan\u00e7adas (Debian<\/a><\/noindex>, OpenWRT<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>). O problema tamb\u00e9m afeta<\/a><\/noindex> solu\u00e7\u00f5es baseadas na pilha UPnP aberta pupnp<\/a><\/noindex>, informa\u00e7\u00f5es sobre corre\u00e7\u00f5es para as quais ainda est\u00e3o ausentes.<\/p>\n

O protocolo UPnP define um mecanismo para a descoberta autom\u00e1tica de dispositivos na rede local e intera\u00e7\u00e3o com eles. O protocolo foi inicialmente projetado para uso em redes locais internas e n\u00e3o prev\u00ea formas de autentica\u00e7\u00e3o e verifica\u00e7\u00e3o. Apesar disso, milh\u00f5es de dispositivos n\u00e3o desativam o suporte ao UPnP nas interfaces de rede externas e permanecem acess\u00edveis<\/a><\/noindex> a requisi\u00e7\u00f5es da rede global. Um ataque pode ser realizado atrav\u00e9s de qualquer dispositivo UPnP semelhante.
\nPor exemplo, os consoles Xbox One podem ser atacados atrav\u00e9s da porta de rede 2869, j\u00e1 que permitem monitorar atrav\u00e9s do comando SUBSCRIBE altera\u00e7\u00f5es como o compartilhamento de conte\u00fado.<\/p>\n

A organiza\u00e7\u00e3o Open Connectivity Foundation (OCF) foi notificada sobre o problema no final do ano passado, mas inicialmente se recusou a consider\u00e1-lo uma vulnerabilidade na especifica\u00e7\u00e3o. Ap\u00f3s um relat\u00f3rio mais detalhado, a exist\u00eancia do problema foi reconhecida e uma diretriz para o uso de UPnP apenas em interfaces LAN foi adicionada \u00e0 especifica\u00e7\u00e3o. Como o problema \u00e9 causado por uma falha na norma, a corre\u00e7\u00e3o da vulnerabilidade em dispositivos individuais pode levar muito tempo, e para dispositivos mais antigos, as atualiza\u00e7\u00f5es de firmware podem n\u00e3o ser disponibilizadas.<\/p>\n

Como medidas de prote\u00e7\u00e3o, recomenda-se isolar os dispositivos UPnP de solicita\u00e7\u00f5es externas atrav\u00e9s de firewall, bloquear solicita\u00e7\u00f5es HTTP externas «SUBSCRIBE» e «NOTIFY» em sistemas de preven\u00e7\u00e3o de ataques, ou desativar o protocolo UPnP nas interfaces de rede externas. Os fabricantes s\u00e3o aconselhados a desativar a fun\u00e7\u00e3o SUBSCRIBE nas configura\u00e7\u00f5es padr\u00e3o e permitir sua ativa\u00e7\u00e3o apenas para solicita\u00e7\u00f5es provenientes da rede interna.
\nPara testar a suscetibilidade de seus dispositivos \u00e0 vulnerabilidade foi publicado<\/a><\/noindex> uma ferramenta especial, escrita na linguagem Python e distribu\u00edda sob a licen\u00e7a MIT. <\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-12695) \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 UPnP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u044e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u043d\u0443\u044e \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044e «SUBSCRIBE». \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f CallStranger. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0441\u0435\u0442\u0435\u0439, \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445 (DLP), \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84663,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-84662","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidade em UPnP, adequada para amplifica\u00e7\u00e3o de ataques DDoS e escaneamento de rede interna | ProHoster","description":"Foram reveladas informa\u00e7\u00f5es sobre","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 UPnP, \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a \u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-09T23:42:15+00:00","article:modified_time":"2020-06-09T23:42:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84662","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:53:24","updated":"2022-09-27 14:10:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/84662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=84662"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/84662\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/84663"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=84662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=84662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=84662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}