{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"Actualiza\u021bi RouterOS pe MikroTik-ul dvs.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Actualiza\u021bi
\n\u00cen seara zilei de 10 martie, serviciul de suport Mail.ru a \u00eenceput s\u0103 primeasc\u0103 pl\u00e2ngeri de la utilizatori cu privire la imposibilitatea de a se conecta la serverele IMAP\/SMTP Mail.ru prin intermediul aplica\u021biilor de e-mail. Unele conexiuni nu reu\u0219eau s\u0103 treac\u0103, \u00een timp ce altele afi\u0219au o eroare de certificat. Eroarea a fost cauzat\u0103 de faptul c\u0103 \u201eserverul\u201d returna un certificat TLS auto-semnat.
\n<\/a><\/noindex>\u00a0
\n\"Actualiza\u021bi
\n\u00cen decurs de dou\u0103 zile, au sosit peste 10 pl\u00e2ngeri de la utilizatori din cele mai diverse re\u021bele \u0219i cu dispozitive variate, ceea ce f\u0103cea pu\u021bin probabil ca problema s\u0103 fie legat\u0103 de re\u021beaua unui anumit furnizor. O analiz\u0103 mai detaliat\u0103 a problemei a relevat c\u0103 serverul imap.mail.ru (\u0219i alte servere \u0219i servicii de e-mail) era \u00eenlocuit la nivel DNS. Ulterior, cu ajutorul activ al utilizatorilor no\u0219tri, am descoperit c\u0103 problema se afla \u00eentr-o \u00eenregistrare gre\u0219it\u0103 \u00een cache-ul routerului lor, care este de asemenea un rezolvator DNS local, iar \u00een multe (dar nu toate) cazuri, dispozitivul era MikroTik, foarte popular \u00een re\u021belele mici de afaceri \u0219i la furnizorii de internet mici.<\/p>\n

Care este problema<\/h2>\n

\n\u00cen septembrie 2019, cercet\u0103torii am g\u0103sit <\/a><\/noindex>c\u00e2teva vulnerabilit\u0103\u021bi \u00een MikroTik RouterOS (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979), care permiteau atacuri de tip DNS cache poisoning, adic\u0103 posibilitatea de a \u00eenlocui \u00eenregistr\u0103rile DNS \u00een cache-ul routerului; \u00een plus, CVE-2019-3978 permite atacatorului s\u0103 nu a\u0219tepte ca cineva din re\u021beaua intern\u0103 s\u0103 solicite o \u00eenregistrare de la serverul s\u0103u DNS, ci s\u0103 ini\u021bieze el \u00eensu\u0219i o astfel de solicitare prin portul 8291 (UDP \u0219i TCP). Vulnerabilitatea a fost corectat\u0103 de MikroTik \u00een versiunile RouterOS 6.45.7 (stabil) \u0219i 6.44.6 (pe termen lung) pe 28 octombrie 2019, \u00eens\u0103, conform cercet\u0103rilor <\/a><\/noindex>majoritatea utilizatorilor \u00een prezent nu au aplicat patch-urile.<\/p>\n

Este evident c\u0103 acum aceast\u0103 problem\u0103 este exploatat\u0103 activ \u201elive\u201d.<\/p>\n

De ce este aceasta periculoas\u0103<\/h2>\n

\nAtacatorul poate modifica \u00eenregistrarea DNS a oric\u0103rui host la care se conecteaz\u0103 un utilizator din re\u021beaua intern\u0103, intercept\u00e2nd astfel traficul c\u0103tre acel host. Dac\u0103 informa\u021bii sensibile sunt transmise f\u0103r\u0103 criptare (de exemplu, prin http:\/\/ f\u0103r\u0103 TLS) sau utilizatorul accept\u0103 un certificat fals, atacatorul poate ob\u021bine toate datele transmise prin conexiune, cum ar fi numele de utilizator sau parola. Din p\u0103cate, practica arat\u0103 c\u0103, dac\u0103 utilizatorul are op\u021biunea de a accepta un certificat fals, acest lucru va fi folosit.<\/p>\n

De ce anume serverele SMTP \u0219i IMAP, \u0219i ce i-a protejat pe utilizatori<\/h2>\n

\nDe ce atacatorii au \u00eencercat s\u0103 intercepteze traficul SMTP\/IMAP al aplica\u021biilor de email \u0219i nu traficul web, de\u0219i cea mai mare parte a utilizatorilor acceseaz\u0103 emailul prin browser folosind HTTPS?<\/p>\n

Nu toate programele de email care func\u021bioneaz\u0103 pe baza SMTP \u0219i IMAP\/POP3 protejeaz\u0103 utilizatorul de eroare, permi\u021b\u00e2ndu-i s\u0103-\u0219i trimit\u0103 loginul \u0219i parola printr-o conexiune nesigur\u0103 sau compromis\u0103, de\u0219i conform standardului RFC 8314<\/a><\/noindex>, adoptat \u00een 2018 (\u0219i implementat \u00een Mail.ru mult mai devreme), acestea ar trebui s\u0103 protejeze utilizatorul de interceptarea parolei prin orice conexiune nesecurizat\u0103. \u00cen plus, \u00een prezent, \u00een clien\u021bii de email se folose\u0219te foarte rar protocolul OAuth (acesta este suportat de serverele de email Mail.ru), iar f\u0103r\u0103 acesta, loginul \u0219i parola sunt transmise \u00een fiecare sesiune.<\/p>\n

Broserele pot fi pu\u021bin mai bine protejate \u00eempotriva atacurilor Man-in-the-Middle. Pe toate domeniile critice mail.ru, pe l\u00e2ng\u0103 HTTPS, este activat\u0103 politica HSTS (HTTP strict transport security). C\u00e2nd HSTS este activat, un browser modern nu permite utilizatorului o op\u021biune simpl\u0103 de a accepta un certificat fals, chiar dac\u0103 utilizatorul dore\u0219te acest lucru. Pe l\u00e2ng\u0103 HSTS, utilizatorii au fost salva\u021bi de faptul c\u0103, \u00eencep\u00e2nd cu 2017, serverele SMTP, IMAP \u0219i POP3 Mail.ru interzic transmiterea parolei printr-o conexiune nesecurizat\u0103; to\u021bi utilizatorii no\u0219tri au utilizat TLS pentru accesul prin SMTP, POP3 \u0219i IMAP, iar prin urmare, loginul \u0219i parola pot fi interceptate doar dac\u0103 utilizatorul \u00eensu\u0219i este de acord s\u0103 accepte un certificat falsificat.<\/p>\n

Pentru utilizatorii mobili, \u00eentotdeauna recomand\u0103m s\u0103 foloseasc\u0103 aplica\u021biile Mail.ru pentru accesul la email, deoarece lucrul cu emailul \u00een acestea este mai sigur dec\u00e2t \u00een browsere sau \u00een clien\u021bii SMTP\/IMAP \u00eencorpora\u021bi.<\/p>\n

Ce trebuie f\u0103cut<\/h2>\n

\nEste necesar\u0103 actualizarea firmware-ului MikroTik RouterOS la o versiune sigur\u0103. Dac\u0103 din orice motiv aceasta nu este posibil\u0103, este necesar s\u0103 se filtreze traficul pe portul 8291 (tcp \u0219i udp), acest lucru va \u00eengreuna exploatarea problemei, de\u0219i nu va elimina posibilitatea de injec\u021bie pasiv\u0103 \u00een cache-ul DNS. Furnizorii de internet ar trebui s\u0103 filtreze acest port \u00een re\u021belele lor pentru a proteja utilizatorii corporativi.\u00a0<\/p>\n

To\u021bi utilizatorii care au acceptat certificatul falsificat ar trebui s\u0103 schimbe urgent parola de email \u0219i a altor servicii pentru care acest certificat a fost acceptat. Din partea noastr\u0103, vom informa utilizatorii care acceseaz\u0103 emailul prin dispozitive vulnerabile.<\/p>\n

P.S. Exist\u0103 o vulnerabilitate asociat\u0103, descris\u0103 \u00een postare LukaSafonov<\/a><\/noindex> \"Vulnerabilitatea Backport \u00een RouterOS pune \u00een pericol sute de mii de dispozitive<\/a><\/noindex>\".
\n
Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Actualiza\u021bi RouterOS pe MikroTik-ul dumneavoastr\u0103 | ProHoster","description":"Seara, pe 10 martie, echipa de suport Mail.ru a \u00eenceput.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}