{"id":117239,"date":"2024-07-10T15:43:03","date_gmt":"2024-07-10T13:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii"},"modified":"2024-07-10T15:43:03","modified_gmt":"2024-07-10T13:43:04","slug":"uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","title":{"rendered":"Vulnerabilitate \u00een protocolul RADIUS, care permite falsificarea r\u0103spunsului la autentificare","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la mai multe universit\u0103\u021bi \u0219i companii americane, Cloudflare \u0219i Microsoft, a dezvoltat o nou\u0103 tehnic\u0103 de atac asupra protocolului RADIUS, utilizat de operatorii de telecomunica\u021bii, serviciile cloud \u0219i furnizorii de VPN pentru autentificarea, autorizarea \u0219i contabilizarea utilizatorilor. Atacul, care a primit numele de cod Blast-RADIUS, permite falsificarea r\u0103spunsului serverului RADIUS \u00een timpul autentific\u0103rii \u0219i realizarea unei conexiuni a utilizatorului f\u0103r\u0103 a cunoa\u0219te parola de acces. <\/p>\n

Pentru a exploata vulnerabilitatea (CVE-2024-3596), atacatorul trebuie s\u0103 aib\u0103 capacitatea de a intercepta traficul \u00een tranzit \u0219i de a efectua un atac MITM complet, permi\u021b\u00e2nd citirea, interceptarea, blocarea \u0219i modificarea pachetelor UDP \u00een tranzit, trimise de punctele de acces pentru a solicita autentificarea clien\u021bilor (Access-Request) \u0219i returnate de serverul RADIUS cu confirmarea sau respingerea opera\u021biunii. Odat\u0103 interceptat cererea de autentificare, atacatorul poate trimite un r\u0103spuns falsificator, specific\u00e2nd un alt tip de rezultat (de exemplu, Access-Accept \u00een loc de Access-Reject). De asemenea, atacatorul poate intercepta r\u0103spunsul Access-Challenge, utilizat \u00een autentificarea cu dou\u0103 factori, \u0219i \u00eel poate \u00eenlocui cu un r\u0103spuns Access-Accept pentru a ocoli trecerea prin etapa suplimentar\u0103 de verificare.

\"Vulnerabilitate<\/center> <\/p>\n

Atacul se bazeaz\u0103 pe faptul c\u0103 protocolul RADIUS folose\u0219te UDP ca transport \u0219i verific\u0103 integritatea mesajelor transmise prin algoritmul MD5. Pentru a verifica mesajele transmise \u00eentre serverul<\/a> punctele de acces \u0219i serverul RADIUS, se aplic\u0103 o cheie secret\u0103, cunoscut\u0103 de punctul de acces \u0219i serverul RADIUS, dar necunoscut\u0103 atacatorului. Ca r\u0103spuns la cererea de autentificare, serverul RADIUS genereaz\u0103 un hash MD5, prin care serverul de acces poate verifica c\u0103 mesajul a fost trimis de un server autorizat. Hash-ul MD5 acoper\u0103 valoarea aleatorie trimis\u0103 \u00een cerere, identificatorul cererii, atributele returnate \u0219i cheia secret\u0103. <\/p>\n

Atacatorul \u00een cadrul unui atac MITM poate intercepta identificatorul \u0219i valoarea aleatorie transmise \u00een cerere, precum \u0219i poate prezice codul opera\u021biei, dimensiunea \u0219i atributele. Sarcina const\u0103 \u00een formarea unui hash de verificare corect care s\u0103 corespund\u0103 rezultatului modificat al opera\u021biei \u0219i s\u0103 treac\u0103 verificarea prin hashing utiliz\u00e2nd cheia secret\u0103. Algoritmul MD5 nu este rezistent la coliziuni, ceea ce \u00eei permite atacatorului s\u0103 manipuleze cu completarea suplimentar\u0103 nesemnificativ\u0103 pentru a g\u0103si o combina\u021bie de date cu parametrii doriti, al c\u0103rei hash MD5 va corespunde cu hash-ul MD5 al r\u0103spunsului ini\u021bial, \u0219i s\u0103 trimit\u0103 un r\u0103spuns fals cu un cod de succes al autentific\u0103rii (Access-Accept) \u00een loc de un mesaj cu informa\u021bii despre eroare.

\"Vulnerabilitate<\/center> <\/p>\n

Dat fiind c\u0103 \u00een procesarea pachetelor cu cererea de acces (Access-Request) nu se aplic\u0103 autentificarea \u0219i verificarea integrit\u0103\u021bii, \u00een timpul atacului \u00een cererea ini\u021bial\u0103 de server<\/a> Un atacant poate ad\u0103uga un atribut suplimentar «Proxy-State», care va fi reflectat de serverul RADIUS \u00een r\u0103spunsul s\u0103u. Con\u021binutul «Proxy-State» este ales astfel \u00eenc\u00e2t valoarea hash-ului MD5 \u00een r\u0103spunsurile reale \u0219i falsificate s\u0103 fie identic\u0103. \u00cen timpul experimentului, c\u0103utarea coliziunilor \u00een MD5 pentru a efectua un atac a durat \u00eentre 3 \u0219i 6 minute, ceea ce dep\u0103\u0219e\u0219te timpul tipic de a\u0219teptare de 30-60 de secunde, \u00eens\u0103 timpul de c\u0103utare a coliziunii poate fi redus prin utilizarea unui hardware mai puternic, apelarea la GPU-uri \u0219i paralelizarea opera\u021biunilor. <\/p>\n

Ca m\u0103sur\u0103 principal\u0103 de protec\u021bie \u00eempotriva vulnerabilit\u0103\u021bii, se recomand\u0103 utilizarea protocolului EAP (Extensible Authentication Protocol, RFC 3579), \u00een care pentru verificarea suplimentar\u0103 a mesajelor se folose\u0219te atributul Message-Authenticator. Pentru a preveni atacul, se pot utiliza, de asemenea, extensii ale protocolului (RadSec), care includ transmiterea mesajelor RADIUS prin canale criptate bazate pe TLS sau DTLS. \u00cen plus, valorile timeout-urilor pentru primirea r\u0103spunsului pot fi reduse la minimum \u0219i se pot bloca r\u0103spunsurile cu atributul Proxy-State. Transmiterea mesajelor RADIUS peste TCP complic\u0103 atacul, dar nu \u00eel exclude. <\/p>\n

Codul pentru realizarea atacului nu a fost publicat \u00eenc\u0103 \u00een accesul public, dar proiectului hashclash i s-au transmis modific\u0103ri care \u00eembun\u0103t\u0103\u021besc g\u0103sirea coliziunilor \u00een MD5 lu\u00e2nd \u00een considerare specificul atacului. \u00cen serverul RADIUS FreeRADIUS, problema a fost rezolvat\u0103 \u00een versiunile 3.0.27 \u0219i 3.2.5 prin activarea aplic\u0103rii obligatorii a atributului Message-Authenticator \u0219i ad\u0103ugarea unei configura\u021bii pentru a limita procesarea pachetelor cu atributul Proxy-State.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Cloudflare \u0438 Microsoft \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b RADIUS, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430\u043c\u0438 \u0441\u0432\u044f\u0437\u0438, \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 \u0438 VPN-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c\u0438 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0438\u043d\u0433\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0410\u0442\u0430\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Blast-RADIUS, \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0442\u0432\u0435\u0442 RADIUS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u0430 \u0431\u0435\u0437 \u0437\u043d\u0430\u043d\u0438\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117240,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117239","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een protocolul RADIUS care permite falsificarea r\u0103spunsului \u00een timpul autentific\u0103rii | ProHoster","description":"Un grup de cercet\u0103tori de la mai multe universit\u0103\u021bi americane \u0219i companiile Cloudflare \u0219i Microsoft a dezvoltat o nou\u0103 tehnic\u0103 de atac asupra protocolului RADIUS, utilizat de operatorii de telecomunica\u021bii \u0219i serviciile cloud.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 RADIUS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0442\u0432\u0435\u0442 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Cloudflare \u0438 Microsoft \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b RADIUS, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430\u043c\u0438 \u0441\u0432\u044f\u0437\u0438, \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 \u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-protokole-radius-pozvolyayushhaya-poddelat-otvet-pri-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-10T13:43:04+00:00","article:modified_time":"2024-07-10T13:43:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117239","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:44:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:56:19","updated":"2026-02-22 15:44:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/117239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=117239"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/117239\/revisions"}],"predecessor-version":[{"id":162456,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/117239\/revisions\/162456"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/117240"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=117239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=117239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=117239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}