{"id":112410,"date":"2023-12-22T03:10:14","date_gmt":"2023-12-22T01:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij"},"modified":"2023-12-22T03:10:14","modified_gmt":"2023-12-22T01:10:16","slug":"smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","title":{"rendered":"SMTP Smuggling \u2014 o nou\u0103 tehnic\u0103 de spoofing al mesajelor po\u0219tale","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la SEC Consult au publicat o nou\u0103 tehnic\u0103 de spoofing, cauzat\u0103 de discrepan\u021bele \u00een respectarea specifica\u021biei \u00een diverse implement\u0103ri ale protocolului SMTP. Tehnica de atac propus\u0103 permite divizarea unui mesaj \u00eentr-o serie de mesaje diferite atunci c\u00e2nd este transmis de un server SMTP ini\u021bial c\u0103tre un alt server SMTP, care interpreteaz\u0103 diferit secven\u021ba pentru divizarea mesajelor transmise printr-o singur\u0103 conexiune. Metoda poate fi utilizat\u0103 pentru a trimite mesaje false \u00een numele altor expeditori \u00een serviciile de e-mail care verific\u0103 expeditorul ini\u021bial. <\/p>\n

Problema este cauzat\u0103 de faptul c\u0103 diferite servere SMTP interpreteaz\u0103 diferit secven\u021ba de sf\u00e2r\u0219it a datelor, ceea ce poate duce la \u00eemp\u0103r\u021birea unui singur mesaj \u00een mai multe \u00een cadrul unei sesiuni la serverul SMTP. \u00cen specifica\u021bia pentru marcarea sf\u00e2r\u0219itului transmiterii mesajului este definit\u0103 secven\u021ba «\r\n.\r\n» (punct, \u00eenconjurat de caractere de returnare a cursei \u0219i salt de linie). Dup\u0103 aceast\u0103 secven\u021b\u0103 pot urma comenzi pentru a trimite un alt mesaj f\u0103r\u0103 a \u00eentrerupe conexiunea. Unele servere SMTP respect\u0103 strict reglement\u0103rile, dar altele, pentru a asigura compatibilitatea cu anumite clien\u021bi de e-mail mai rari, trateaz\u0103 ca separator \u0219i secven\u021be precum «\n.\n», «\n.\r\n», «\r\n.\n», «\r.\r», «\r\n\null.\r\n» \u0219i «\r\n\null.\r\n». <\/p>\n

Atacul const\u0103 \u00een faptul c\u0103 pe primul serverul<\/a>, care trateaz\u0103 doar separatorul «\r\n.\r\n» trimite un mesaj al c\u0103rui corp con\u021bine un separator alternativ, de exemplu, «\r.\r», urmat de comenzi pentru a trimite al doilea mesaj. Deoarece primul server respect\u0103 strict specifica\u021bia, el proceseaz\u0103 secven\u021ba primit\u0103 ca un singur mesaj. Dac\u0103 ulterior mesajul este trimis la un server de tranzit sau serverul destinatar, care percepe \u00een plus secven\u021ba «\r.\r» ca separator, acesta va fi procesat ca dou\u0103 mesaje trimise separat (al doilea mesaj poate fi trimis \u00een numele unui utilizator care nu este autentificat prin «AUTH LOGIN», dar va ap\u0103rea corect din partea destinatarului).

\"SMTP<\/center>
\"SMTP<\/center> <\/p>\n

Ca exemple de servere \u0219i servicii SMTP care permit separatoare alternative, sunt men\u021bionate Postfix, Sendmail, MS Exchange Online \u0219i Cisco Secure Email Gateway, iar printre serviciile de e-mail care nu filtreaz\u0103 separatoarele incorecte din mesaje atunci c\u00e2nd se adreseaz\u0103 altor servere se num\u0103r\u0103 GMX, iCloud \u0219i Microsoft Outlook. <\/p>\n

Pentru a bloca problema \u00een Postfix \u00een versiunile 3.8.1, 3.7.6, 3.6.10 \u0219i 3.5.20, a fost ad\u0103ugat\u0103 op\u021biunea «smtpd_forbid_unauth_pipelining», care provoac\u0103 deconectarea \u00een cazul utiliz\u0103rii delimitatorilor care nu respect\u0103 RFC 2920 \u0219i RFC 5321. \u00cen prezent, aceast\u0103 op\u021biune este dezactivat\u0103 \u00een mod implicit, dar se preconizeaz\u0103 activarea ei implicit\u0103 \u00een ramura Postfix 3.9, care se a\u0219teapt\u0103 s\u0103 fie lansat\u0103 \u00een prim\u0103vara anului 2024. \u00cen ramura 3.9 va fi inclus\u0103 \u0219i op\u021biunea smtpd_forbid_bare_newline, care va genera o eroare \u00een cazul folosirii doar a caracterului de sf\u00e2r\u0219it de linie («\n») pentru a separa liniile, ceea ce contravine RFC 5321. <\/p>\n

\u00cen viitoarea versiune Sendmail 8.18.0.2, pentru a proteja \u00eempotriva atacului, \u00een srv_features a fost propus\u0103 op\u021biunea ‘o’, care activeaz\u0103 procesarea doar a secven\u021bei «\r\n.\r\n». Se observ\u0103 c\u0103 dezactivarea suportului pentru delimitatori alternativi poate afecta func\u021bionarea unor clien\u021bi de email rari, care nu respect\u0103 pe deplin specifica\u021bia SMTP.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SEC Consult \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMTP. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0440\u0430\u0441\u0449\u0435\u043f\u0438\u0442\u044c \u043e\u0434\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043f\u0440\u0438 \u0435\u0433\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c SMTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 SMTP-\u0441\u0435\u0440\u0432\u0435\u0440, \u043f\u043e \u0438\u043d\u043e\u043c\u0443 \u0442\u0440\u0430\u043a\u0442\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0438\u0441\u0435\u043c, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043e\u0434\u043d\u043e \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":112411,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112410","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SMTP Smuggling \u2014 o nou\u0103 tehnic\u0103 de spionare a mesajelor de email | ProHoster","description":"Cercet\u0103torii de la SEC Consult au publicat o nou\u0103 tehnic\u0103 de spionare, cauzat\u0103 de discrepan\u021be \u00een respectarea specifica\u021biei \u00een diferitele implement\u0103ri ale protocolului SMTP.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SMTP Smuggling \u2014 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SEC Consult \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMTP.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-22T01:10:16+00:00","article:modified_time":"2023-12-22T01:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=112410"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112410\/revisions"}],"predecessor-version":[{"id":172924,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/112410\/revisions\/172924"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/112411"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=112410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=112410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=112410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}