{"id":53634,"date":"2019-12-06T00:00:00","date_gmt":"2019-12-05T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli"},"modified":"2020-02-18T14:01:34","modified_gmt":"2020-02-18T11:01:34","slug":"uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","title":{"rendered":"O vulnerabilitate care permite interferen\u021ba \u00een conexiunile TCP realizate prin tuneluri VPN.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Publicat<\/a><\/noindex> tehnica atacului (CVE-2019-14899), care permite \u00eenlocuirea, modificarea sau inserarea de pachete \u00een conexiunile TCP, transmise prin tuneluri VPN. Problema afecteaz\u0103 Linux, FreeBSD, OpenBSD, Android, macOS, iOS \u0219i alte sisteme de operare similare Unix. Linux suport\u0103 mecanismul rp_filter (filtrarea c\u0103ii inverse) pentru IPv4, activarea acestuia \u00een modul \u201eStrict\u201d neutralizeaz\u0103 aceast\u0103 problem\u0103. <\/p>\n

Metoda permite substituirea pachetelor la nivelul conexiunilor TCP care trec printr-un tunel criptat, dar nu permite interferen\u021ba \u00een conexiuni care folosesc straturi suplimentare de criptare (de exemplu, TLS, HTTPS, SSH). Algoritmii de criptare folosi\u021bi \u00een VPN nu conteaz\u0103, deoarece pachetele falsificate provin din interfa\u021ba extern\u0103 \u0219i sunt tratate de nucleu ca pachete din interfa\u021ba VPN. Cea mai probabil\u0103 \u021bint\u0103 a atacului este interven\u021bia asupra conexiunilor HTTP necriptate, dar nu este exclus<\/a><\/noindex> \u0219i utilizarea atacului pentru manipularea r\u0103spunsurilor DNS. <\/p>\n

\u00cenlocuirea cu succes a pachetelor a fost demonstrat\u0103 pentru tunelurile create folosind OpenVPN, WireGuard \u0219i IKEv2\/IPSec. Tor nu este afectat de problem\u0103, deoarece utilizeaz\u0103 SOCKS pentru redirec\u021bionarea traficului \u0219i leg\u0103tura cu interfa\u021ba loopback. Pentru IPv4, atacul este posibil \u00een cazul \u00een care rp_filter este setat \u00een modul \u201eLoose\u201d (sysctl net.ipv4.conf.all.rp_filter = 2). Ini\u021bial, \u00een majoritatea sistemelor se aplica modul \u201eStrict\u201d, dar \u00eencep\u00e2nd cu systemd 240<\/a><\/noindex>, lansat \u00een decembrie anul trecut, modul de lucru implicit a fost modificat \u00een \u201eLoose\u201d \u0219i aceast\u0103 schimbare s-a reflectat \u00een set\u0103rile implicite ale multor distribu\u021bii Linux.<\/p>\n

Mecanismul rp_filter folosim<\/a><\/noindex> pentru o verificare suplimentar\u0103 a c\u0103ilor de trecere a pachetelor pentru a preveni spoofing-ul adresei surs\u0103. Atunci c\u00e2nd este setat la 0, nu se efectueaz\u0103 verificarea adresei surs\u0103, iar orice pachet poate fi redirec\u021bionat f\u0103r\u0103 restric\u021bii \u00eentre interfe\u021bele de re\u021bea. Modul 1 \u201eStrict\u201d include verificarea fiec\u0103rui pachet care vine din exterior \u00een raport cu tabelul de rutare, iar dac\u0103 interfa\u021ba de re\u021bea prin care a fost primit pachetul nu este asociat\u0103 cu calea optim\u0103 de livrare a r\u0103spunsului, pachetul este respins. Modul 2 \u201eLoose\u201d reduce rigurozitatea verific\u0103rii, pentru a permite func\u021bionarea atunci c\u00e2nd se utilizeaz\u0103 echilibratoare de sarcin\u0103 sau rutare asimetric\u0103, \u00een care
\nruta r\u0103spunsului poate trece printr-o interfa\u021b\u0103 de re\u021bea different\u0103 fa\u021b\u0103 de cea prin care a sosit pachetul ini\u021bial.<\/p>\n

\u00cen modul \u201eLoose\u201d, pachetul intrant este verificat pentru a se conforma tabelului de rutare, dar este considerat acceptabil dac\u0103 adresa surs\u0103 este accesibil\u0103 prin orice interfa\u021b\u0103 de re\u021bea existent\u0103. Atacul propus se bazeaz\u0103 pe faptul c\u0103 atacatorul poate trimite un pachet cu o adres\u0103 surs\u0103 falsificat\u0103, corespunz\u0103toare interfe\u021bei VPN, \u0219i, de\u0219i acest pachet va ajunge \u00een sistem prin intermediul unei interfe\u021be de re\u021bea externe, \u0219i nu prin VPN, \u00een modul rp_filter \u201eLoose\u201d, un astfel de pachet nu va fi respins. <\/p>\n

Pentru a realiza atacul, atacatorul trebuie s\u0103 controleze gateway-ul prin care utilizatorul se conecteaz\u0103 la re\u021bea (de exemplu, printr-o organiza\u021bie MITM, atunci c\u00e2nd victima se conecteaz\u0103 la un hotspot controlat de atacator sau prin hacking-ul routerului<\/a><\/noindex>). Control\u00e2nd gateway-ul prin care utilizatorul este conectat la re\u021bea, atacatorul poate trimite pachete false, care vor fi percepute \u00een contextul interfe\u021bei de re\u021bea VPN, dar r\u0103spunsurile vor fi direc\u021bionate prin tunel.<\/p>\n

Prin generarea unui flux de pachete false, \u00een care se injecteaz\u0103 adresa IP a interfe\u021bei VPN, se fac \u00eencerc\u0103ri de a afecta conexiunea stabilit\u0103 de client, dar efectul acestor pachete poate fi observat doar prin analiza pasiv\u0103 a fluxului de trafic criptat asociat cu activitatea tunelului. Pentru a desf\u0103\u0219ura atacul, este necesar s\u0103 se cunoasc\u0103 adresa IP a interfe\u021bei de re\u021bea a tunelului desemnat\u0103 de serverul VPN \u0219i s\u0103 se determine c\u0103, \u00een acel moment, exist\u0103 o conexiune activ\u0103 prin tunel la un anumit host. <\/p>\n

Pentru a determina IP-ul interfe\u021bei de re\u021bea virtuale VPN, se trimit la sistemul victimei pachete SYN-ACK, parcurg\u00e2nd secven\u021bial \u00eentreaga gam\u0103 de adrese virtuale (\u00een special, se testeaz\u0103 mai \u00eent\u00e2i adreselor utilizate \u00een mod implicit \u00een VPN, de exemplu, \u00een OpenVPN se folose\u0219te subnet-ul 10.8.0.0\/24). Existen\u021ba unei adrese poate fi judecat\u0103 pe baza primirii unui r\u0103spuns cu flag RST.<\/p>\n

\u00cen mod similar, se determin\u0103 prezen\u021ba unei conexiuni cu un anumit site \u0219i num\u0103rul de port pe partea clientului \u2014 iter\u00e2nd numerele de port, se trimite un pachet SYN, av\u00e2nd ca adres\u0103 surs\u0103 IP-ul site-ului, iar adresa de destina\u021bie este IP-ul virtual VPN. Portul serverului poate fi anticipat (80 pentru HTTP), iar num\u0103rul de port pe partea clientului poate fi calculat prin itera\u021bie, analiz\u00e2nd pentru diferite numere modific\u0103rile intensit\u0103\u021bii r\u0103spunsurilor ACK \u00een combina\u021bie cu absen\u021ba pachetului cu flag-ul RST.<\/p>\n

\u00cen aceast\u0103 etap\u0103, atacatorul cunoa\u0219te toate cele patru elemente ale conexiunii (adresele\/porturile IP ale sursei \u0219i adresa\/portul IP al destina\u021biei), dar pentru a genera un pachet fals care va fi acceptat de sistemul victimei, atacatorul trebuie s\u0103 determine numerele de secven\u021b\u0103 \u0219i confirmare (seq \u0219i ack) ale conexiunii TCP. Pentru a determina ace\u0219ti parametri, atacatorul trimite continuu pachete RST false, iter\u00e2nd diferite numere de secven\u021b\u0103, p\u00e2n\u0103 c\u00e2nd \u00eenregistreaz\u0103 un pachet de r\u0103spuns ACK, primirea c\u0103ruia indic\u0103 faptul c\u0103 num\u0103rul se \u00eencadreaz\u0103 \u00een fereastra TCP. <\/p>\n

Apoi, atacatorul verific\u0103 corectitudinea determin\u0103rii prin trimiterea de pachete cu acela\u0219i num\u0103r \u0219i observ\u00e2nd sosirea r\u0103spunsurilor ACK, dup\u0103 care descoper\u0103 num\u0103rul exact al secven\u021bei curente. Sarcina este complicat\u0103 de faptul c\u0103 r\u0103spunsurile sunt trimise \u00een interiorul unui tunel criptat, iar analiza prezen\u021bei acestora \u00een fluxul de trafic interceptat poate fi realizat\u0103 doar prin metode indirecte. Faptul c\u0103 un pachet ACK adresat serverului VPN este trimis de client este determinat pe baza dimensiunii \u0219i \u00eent\u00e2rzierii r\u0103spunsurilor criptate, corel\u00e2ndu-se cu trimiterea pachetelor false. De exemplu, pentru OpenVPN, un pachet criptat de dimensiune 79 permite evaluarea exact\u0103 c\u0103 \u00een interior se afl\u0103 o confirmare ACK.<\/p>\n

\u00cenainte ca protec\u021bia \u00eempotriva atacului s\u0103 fie ad\u0103ugat\u0103 \u00een nucleul sistemului de operare, ca o metod\u0103 temporar\u0103 de blocare a problemei se recomand\u0103<\/a><\/noindex> folosind un filtru de pachete \u00een lan\u021bul \u201epreroute\u201d pentru a bloca trecerea pachetelor, \u00een care ca adres\u0103 de destina\u021bie este specificat IP-ul virtual al tunelului.<\/p>\n

iptables -t raw -I PREROUTING ! -i wg0 -d 10.182.12.8 -m addrtype ! --src-type LOCAL -j DROP<\/p>\n

sau pentru nftables<\/p>\n

nft add table ip raw
\n nft add chain ip raw prerouting \u2018{ type filter hook prerouting priority 0; }\u2019
\n nft add rule ip raw prerouting \u2018iifname != \u201ewg0\u201d ip daddr 10.182.12.8 fib saddr type != local drop\u2019<\/p>\n

Pentru protec\u021bie \u00een utilizarea tunelurilor cu adrese IPv4, este suficient s\u0103 se schimbe rp_filter \u00een modul \u201eStrict\u201d (\u201esysctl net.ipv4.conf.all.rp_filter = 1\u201d). Din partea VPN, metoda de determinare a num\u0103rului de secven\u021b\u0103 poate fi blocat\u0103 prin ad\u0103ugarea de umplutur\u0103 suplimentar\u0103 pachetelor criptate, f\u0103c\u00e2nd dimensiunea tuturor pachetelor uniform\u0103. <\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-14899), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0432 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043f\u0440\u043e\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Linux, FreeBSD, OpenBSD, Android, macOS, iOS \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 Unix-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. Linux \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c rp_filter (reverse path filtering) \u0434\u043b\u044f IPv4, \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u0436\u0438\u043c «Strict» \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u041c\u0435\u0442\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432\u043d\u0443\u0442\u0440\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53634","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate care permite interceptarea conexiunilor TCP realizate prin tuneluri VPN | ProHoster","description":"A fost publicat\u0103 o tehnic\u0103 de atac (CVE-2019-14899), care permite substituirea, modificarea sau injectarea pachetelor.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043a\u043b\u0438\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-14899), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-05T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53634","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 08:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:21:20","updated":"2026-01-24 08:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=53634"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53634\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=53634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=53634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=53634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}