{"id":112308,"date":"2023-12-19T03:10:22","date_gmt":"2023-12-19T01:10:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/terrapin-uyazvimost-v-protokole-ssh-pozvolyayushhaya-snizit-zashhitu-soedineniya"},"modified":"2023-12-19T03:10:22","modified_gmt":"2023-12-19T01:10:22","slug":"terrapin-uyazvimost-v-protokole-ssh-pozvolyayushhaya-snizit-zashhitu-soedineniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/terrapin-uyazvimost-v-protokole-ssh-pozvolyayushhaya-snizit-zashhitu-soedineniya","title":{"rendered":"Terrapin \u2014 o vulnerabilitate \u00een protocolul SSH care permite reducerea securit\u0103\u021bii conexiunii.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Universitatea Ruhr din Bochum (Germania) a prezentat o nou\u0103 tehnic\u0103 de atac MITM asupra SSH \u2014 Terrapin, care exploateaz\u0103 o vulnerabilitate (CVE-2023-48795) din protocol. Atacatorul, capabil s\u0103 organizeze un atac MITM, are capacitatea de a bloca trimiterea mesajului de configurare a extensiilor protocolului \u00een timpul negocierii conexiunii, pentru a reduce nivelul de protec\u021bie al acesteia. Prototipul instrumentarului pentru efectuarea atacului a fost publicat pe GitHub. <\/p>\n

\u00cen contextul OpenSSH, vulnerabilitatea, de exemplu, permite revenirea la utilizarea unor algoritmi de autentificare mai pu\u021bin securiza\u021bi \u0219i dezactivarea protec\u021biei \u00eempotriva atacurilor prin canale externe, care reproduc intrarea prin analiza \u00eent\u00e2rzierilor dintre ap\u0103s\u0103rile de taste de pe tastatur\u0103. \u00cen biblioteca Python AsyncSSH, \u00eempreun\u0103 cu vulnerabilitatea (CVE-2023-46446) \u00een implementarea ma\u0219inii de st\u0103ri interioare (internal state machine), atacul Terrapin permite infiltrarea \u00een sesiunea SSH. <\/p>\n

Vulnerabilitatea afecteaz\u0103 toate implement\u0103rile SSH care suport\u0103 ChaCha20-Poly1305 sau cifrele \u00een modul CBC \u00eempreun\u0103 cu modul ETM (Encrypt-then-MAC). De exemplu, astfel de capacit\u0103\u021bi sunt disponibile \u00een OpenSSH de peste 10 ani. Vulnerabilitatea a fost blocat\u0103 \u00een versiunea de ast\u0103zi a OpenSSH 9.6, precum \u0219i \u00een actualiz\u0103rile PuTTY 0.80, libssh 0.10.6\/0.9.8 \u0219i AsyncSSH 2.14.2. \u00cen Dropbear SSH, corec\u021bia a fost deja ad\u0103ugat\u0103 \u00een cod, dar o nou\u0103 versiune nu a fost \u00eenc\u0103 generat\u0103. <\/p>\n

Vulnerabilitatea este cauzat\u0103 de faptul c\u0103 un atacator, care controleaz\u0103 traficul conexiunii (de exemplu, proprietarul unui hotspot wireless mali\u021bios), poate ajusta numerele de ordine ale pachetelor \u00een timpul negocierii conexiunii \u0219i poate realiza eliminarea invizibil\u0103 a unui num\u0103r arbitrar de mesaje SSH de control trimise de client sau serverul<\/a>. Printre altele, atacatorul poate \u0219terge mesajele SSH_MSG_EXT_INFO, care sunt utilizate pentru configurarea extensiilor protocolului aplicate. Pentru a \u00eempiedica cealalt\u0103 parte s\u0103 detecteze dispari\u021bia unui pachet din cauza rupturii numerelor de ordine, atacatorul ini\u021biaz\u0103 trimiterea unui pachet fals cu acela\u0219i num\u0103r de ordine ca cel al pachetului eliminat. Pachetul fals con\u021bine un mesaj cu flag-ul SSH_MSG_IGNORE, care este ignorat \u00een timpul proces\u0103rii.

\"Terrapin<\/center> <\/p>\n

Atacarea nu poate fi realizat\u0103 \u00een cazul utiliz\u0103rii cifrurilor de flux \u0219i CTR, deoarece o \u00eenc\u0103lcare a integrit\u0103\u021bii va fi detectat\u0103 la nivel de aplica\u021bie. \u00cen practic\u0103, atacul este vulnerabil doar pentru cifra ChaCha20-Poly1305 (chacha20-poly1305@openssh.com), unde starea este urm\u0103rit\u0103 doar prin numerele de ordine ale mesajelor, \u0219i combina\u021bia din modul Encrypt-Then-MAC (*-etm@openssh.com) \u0219i cifrurile CBC. <\/p>\n

\u00cen OpenSSH 9.6 \u0219i \u00een alte implement\u0103ri, a fost implementat\u0103 o extensie de protocol \u201estrict KEX\u201d pentru a bloca atacul, care se activeaz\u0103 automat dac\u0103 exist\u0103 suport de partea adversarului. server<\/a> client. Extensia \u00eencheie conexiunea la primirea oric\u0103ror mesaje neobi\u0219nuite sau suplimentare (de exemplu, cu flag-ul SSH_MSG_IGNORE sau SSH2_MSG_DEBUG), primite \u00een timpul negocierii conexiunii, \u0219i resetaz\u0103 contorul MAC (Message Authentication Code) dup\u0103 finalizarea fiec\u0103rui schimb de chei.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0420\u0443\u0440\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0411\u043e\u0445\u0443\u043c\u0435 (\u0413\u0435\u0440\u043c\u0430\u043d\u0438\u044f) \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 MITM-\u0430\u0442\u0430\u043a\u0438 \u043d\u0430 SSH — Terrapin, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-48795) \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443, \u0438\u043c\u0435\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0434\u043b\u044f \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0440\u043e\u0432\u043d\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u041f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430 GitHub. \u0412 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 OpenSSH \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":112309,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112308","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Terrapin \u2014 o vulnerabilitate \u00een protocolul SSH care permite sl\u0103birea securit\u0103\u021bii conexiunii | ProHoster","description":"Un grup de cercet\u0103tori de la Universitatea Ruhr din Bochum (Germania) a prezentat o nou\u0103 tehnic\u0103 de atac MITM asupra SSH - Terrapin, care exploateaz\u0103 vulnerabilitatea (CVE-2023-48795) din protocol.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/terrapin-uyazvimost-v-protokole-ssh-pozvolyayushhaya-snizit-zashhitu-soedineniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Terrapin \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 SSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0442\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0420\u0443\u0440\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0411\u043e\u0445\u0443\u043c\u0435 (\u0413\u0435\u0440\u043c\u0430\u043d\u0438\u044f) \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 MITM-\u0430\u0442\u0430\u043a\u0438 \u043d\u0430 SSH - Terrapin, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-48795) \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/terrapin-uyazvimost-v-protokole-ssh-pozvolyayushhaya-snizit-zashhitu-soedineniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-19T01:10:22+00:00","article:modified_time":"2023-12-19T01:10:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112308","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:46:41","updated":"2026-02-22 15:30:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=112308"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112308\/revisions"}],"predecessor-version":[{"id":162280,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112308\/revisions\/162280"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/112309"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=112308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=112308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=112308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}