{"id":117814,"date":"2024-07-18T15:43:01","date_gmt":"2024-07-18T13:43:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi"},"modified":"2024-07-18T15:43:01","modified_gmt":"2024-07-18T13:43:04","slug":"ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","title":{"rendered":"Atacul Port Shadow, care permite redirec\u021bionarea conexiunilor altor utilizatori VPN \u0219i Wi-Fi.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori din universit\u0103\u021bile canadiene \u0219i americane a dezvoltat o tehnic\u0103 de atac denumit\u0103 Port Shadow, care permite, prin manipularea tabelelor de traducere a adreselor pe serverul VPN, trimiterea r\u0103spunsului la o cerere altui utilizator conectat la acela\u0219i server VPN. Aceast\u0103 metod\u0103 poate fi utilizat\u0103 pentru interceptarea sau redirec\u021bionarea traficului criptat, efectuarea de scan\u0103ri de porturi \u0219i deanonimizarea utilizatorilor VPN. Ca exemplu, este ar\u0103tat cum poate fi folosit\u0103 metoda pentru redirec\u021bionarea cererilor DNS ale unui utilizator care lucreaz\u0103 printr-un server VPN, la care atacatorul are posibilitatea de a se conecta ca client. <\/p>\n

Pentru a efectua atacul, atacatorul trebuie s\u0103 aib\u0103 posibilitatea de conectare la acela\u0219i VPN<\/a>-server cu victima, ceea ce este posibil, de exemplu, prin utilizarea operatorilor VPN standard \u0219i a serviciilor VPN publice, care ofer\u0103 acces tuturor doritorilor. Vulnerabilitatea afecteaz\u0103 serverele VPN care utilizeaz\u0103 traducerea adreselor (NAT) pentru a organiza accesul clien\u021bilor la resurse externe, \u00een condi\u021biile \u00een care pentru primirea traficului de la clien\u021bi \u0219i trimiterea cererilor c\u0103tre site-uri externe pe server<\/a> trebuie folosit\u0103 aceea\u0219i adres\u0103 IP. <\/p>\n

Atacul se bazeaz\u0103 pe faptul c\u0103, prin trimiterea de cereri special concepute, atacatorul, conectat la acela\u0219i server VPN \u0219i folosind un NAT comun, poate provoca distorsionarea con\u021binutului tabelelor de traducere a adreselor, ceea ce va face ca pachetele destinate unui utilizator s\u0103 fie trimise altui utilizator. \u00cen tabelele de traducere a adreselor, informa\u021bia despre ce adres\u0103 IP intern\u0103 este asociat\u0103 cu cererea trimis\u0103 este determinat\u0103 pe baza num\u0103rului portului de re\u021bea de origine utilizat la trimiterea cererii. Atacatorul, prin trimiterea de pachete SYN \u0219i ACK specifice \u0219i prin manipul\u0103ri simultane din partea conexiunii client c\u0103tre serverul VPN \u0219i din partea serverului extern controlat de atacator, poate provoca o coliziune \u00een tabela NAT \u0219i ad\u0103ugarea unei \u00eenregistr\u0103ri cu acela\u0219i num\u0103r de port de origine, dar asociat\u0103 cu adresa sa local\u0103, ceea ce va duce la trimiterea r\u0103spunsurilor la cererea altuia pe adresa atacatorului.

\"Atacul<\/center> <\/p>\n

\u00cen cadrul cercet\u0103rii, au fost testate sistemele de translatare a adreselor Linux \u0219i FreeBSD \u00een combina\u021bie cu VPN-urile OpenVPN, OpenConnect \u0219i WireGuard. Platforma FreeBSD s-a dovedit a fi imune la metodele de atac prin redirec\u021bionarea cererilor, efectuate de al\u021bi utilizatori conecta\u021bi la acela\u0219i VPN. Substitu\u021bia \u00een tabelele NAT a putut fi realizat\u0103 doar \u00een timpul atacului ATIP (Adjacent-to-In-Path), \u00een care atacatorul poate interfera cu traficul \u00eentre utilizator \u0219i serverul VPN (de exemplu, atunci c\u00e2nd utilizatorul se conecteaz\u0103 la o re\u021bea Wi-Fi controlat\u0103 de atacator) sau \u00eentre serverul VPN \u0219i site-ul \u021bint\u0103. De asemenea, NAT-ul FreeBSD a fost afectat de un atac care permite determinarea conect\u0103rii utilizatorului la un anumit site (Connection Inference). <\/p>\n

\u00cen ceea ce prive\u0219te Linux, subsistemul Netfilter s-a dovedit a fi vulnerabil la atacuri prin substitu\u021bia \u00een tabela de translatare a adreselor, care permit redirec\u021bionarea pachetelor de intrare c\u0103tre alt utilizator, trimiterea pachetelor \u00een afara canalului VPN criptat (Decapsulation) sau determinarea porturilor de re\u021bea deschise pe partea clientului.

\"Atacul<\/center> <\/p>\n

Ca m\u0103suri pentru blocarea atacului, se recomand\u0103 furnizorilor de VPN s\u0103 utilizeze metode adecvate de randomizare a numerelor porturilor de origine \u00een NAT, s\u0103 limiteze num\u0103rul de conexiuni simultane permise la serverul VPN din partea unui singur utilizator, precum \u0219i s\u0103 blocheze posibilitatea ca clientul s\u0103 aleg\u0103 portul de re\u021bea care accept\u0103 cereri pe serverul VPN. <\/p>\n

Potrivit unui reprezentant al companiei Proton AG, atacul nu afecteaz\u0103 serviciile VPN care folosesc IP-uri separate pentru cereri de intrare \u0219i ie\u0219ire. \u00cen plus, exist\u0103 \u00eendoieli cu privire la aplicabilitatea atacului asupra serviciilor VPN reale, deoarece atacul a fost demonstrat cu succes doar \u00een teste de laborator, iar pentru apoi s\u0103 se realizeze necesit\u0103 \u00eendeplinirea unor condi\u021bii specifice pe serverul VPN \u0219i pe clientul atacat. \u00cen plus, atacul ar putea fi util doar pentru manipularea cererilor necriptate, cum ar fi apelurile DNS, \u00een timp ce utilizarea TLS \u0219i HTTPS la nivel de aplica\u021bie face redirec\u021bionarea traficului inutil\u0103. <\/p>\n

Manipul\u0103rile cu tabelele de traducere a adreselor de atac se aplic\u0103 nu doar VPN-urilor, ci \u0219i re\u021belelor wireless, unde NAT-ul este folosit pentru a conecta utilizatorii la resurse externe printr-un punct de acces. Luna trecut\u0103 au fost publicate rezultatele unei cercet\u0103ri privind posibilitatea de a efectua un atac similar de interceptare a conexiunilor TCP ale altor utilizatori din re\u021beaua wireless. Metoda de atac s-a dovedit a fi aplicabil\u0103 la 24 din cele 33 de puncte de acces wireless testate.

\"Atacul<\/center> <\/p>\n

Atacul propus pentru Wi-Fi s-a dovedit a fi semnificativ mai simplu dec\u00e2t metoda men\u021bionat\u0103 anterior pentru VPN, deoarece, datorit\u0103 optimiz\u0103rilor, multe puncte de acces nu verific\u0103 corectitudinea numerelor de secven\u021b\u0103 \u00een pachetele TCP. Astfel, pentru atac a fost suficient s\u0103 se trimit\u0103 un pachet RST fals pentru a cur\u0103\u021ba \u00eenregistrarea din tabela de traducere a adreselor, iar apoi s\u0103 se ob\u021bin\u0103 r\u0103spunsul pe gazda atacatorului pentru a determina numerele de secven\u021b\u0103 (SEQ) \u0219i de confirmare (ACK) necesare pentru interceptarea conexiunii TCP.

\"Atacul<\/center>
\"Atacul<\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0445 \u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441 \u0434\u0440\u0443\u0433\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c\u0443 \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0443. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u0434\u0435\u0430\u043d\u043e\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117815,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117814","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atacul Port Shadow, care permite redirec\u021bionarea conexiunilor altor utilizatori VPN \u0219i Wi-Fi | ProHoster","description":"Un grup de cercet\u0103tori din universit\u0103\u021bi canadiene \u0219i americane a dezvoltat tehnica de atac Port Shadow, care permite prin manipularea tabelelor de traducere a adreselor pe serverul VPN s\u0103 se obtin\u0103 trimiterea unui r\u0103spuns c\u0103tre.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 VPN \u0438 Wi-Fi | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u043a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0445 \u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 Port Shadow, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-port-shadow-pozvolyayushhaya-perenapravlyat-soedineniya-drugih-polzovatelej-vpn-i-wi-fi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-18T13:43:04+00:00","article:modified_time":"2024-07-18T13:43:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117814","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:00:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 04:28:19","updated":"2026-02-09 22:00:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/117814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=117814"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/117814\/revisions"}],"predecessor-version":[{"id":160055,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/117814\/revisions\/160055"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/117815"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=117814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=117814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=117814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}