{"id":84662,"date":"2020-06-10T01:42:15","date_gmt":"2020-06-09T23:42:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti"},"modified":"2020-06-10T01:42:15","modified_gmt":"2020-06-09T23:42:15","slug":"uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","title":{"rendered":"Zranite\u013enos\u0165 v UPnP, vhodn\u00e1 na zosilnenie DDoS \u00fatokov a skenovanie vn\u00fatornej siete","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zverejnen\u00e9<\/a><\/noindex> inform\u00e1cie o zranite\u013enosti<\/a><\/noindex> (CVE-2020-12695<\/a><\/noindex>) v protokole UPnP, ktor\u00fd umo\u017e\u0148uje organizova\u0165 posielanie prev\u00e1dzky \u013eubovo\u013en\u00e9mu pr\u00edjemcovi s vyu\u017eit\u00edm v \u0161tandarde predpokladanej oper\u00e1cie «SUBSCRIBE». Zranite\u013enosti bolo pridelen\u00e9 k\u00f3dov\u00e9 meno CallStranger<\/a><\/noindex>. Zranite\u013enos\u0165 m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 na extrakciu \u00fadajov z siet\u00ed chr\u00e1nen\u00fdch syst\u00e9mami na prevenciu \u00fanikov \u00fadajov (DLP), organizovanie skenovania portov po\u010d\u00edta\u010dov v internej sieti, ako aj na zosilnenie DDoS \u00fatokov pomocou mili\u00f3nov pripojen\u00fdch k glob\u00e1lnej sieti zariaden\u00ed UPnP, ako s\u00fa k\u00e1blov\u00e9 modemy, dom\u00e1ce smerova\u010de, hern\u00e9 konzoly, IP kamery, TV prij\u00edma\u010de, multimedia centr\u00e1 a tla\u010diarne.<\/p>\n

Probl\u00e9m je sp\u00f4soben\u00e1<\/a><\/noindex> t\u00fdm, \u017ee predpokladan\u00e1 funkcia «SUBSCRIBE» v \u0161pecifik\u00e1cii umo\u017e\u0148uje ak\u00e9muko\u013evek vonkaj\u0161iemu \u00fato\u010dn\u00edkovi posiela\u0165 HTTP pakety s hlavi\u010dkou Callback a pou\u017e\u00edva\u0165 zariadenie UPnP ako proxy na odosielanie po\u017eiadaviek na in\u00e9 hostite\u013esk\u00e9 slu\u017eby. Funkcia «SUBSCRIBE» je definovan\u00e1 v \u0161pecifik\u00e1cii UPnP a pou\u017e\u00edva sa na sledovanie zmien v in\u00fdch zariadeniach a slu\u017eb\u00e1ch. Pomocou HTTP hlavi\u010dky Callback je mo\u017en\u00e9 ur\u010di\u0165 \u013eubovo\u013en\u00fa URL adresu, na ktor\u00fa sa zariadenie pok\u00fasi pripoji\u0165. <\/p>\n

\"Zranite\u013enos\u0165<\/a><\/noindex><\/center><\/p>\n

Probl\u00e9mu s\u00fa vystaven\u00e9 takmer v\u0161etky implement\u00e1cie UPnP, zalo\u017een\u00e9 na \u0161pecifik\u00e1cie<\/a><\/noindex>, vydan\u00fdch pred 17. apr\u00edlom. Taktie\u017e bola potvrden\u00e1 existencia zranite\u013enosti potvrden\u00e9<\/a><\/noindex> v otvorenom bal\u00edku hostapd<\/a><\/noindex> s implement\u00e1ciou bezdr\u00f4tov\u00e9ho pr\u00edstupov\u00e9ho bodu (WPS AP). Oprava je zatia\u013e dostupn\u00e1 vo forme patche<\/a><\/noindex>. V distrib\u00faci\u00e1ch aktualiz\u00e1cie zatia\u013e neboli vydan\u00e9 (Debian<\/a><\/noindex>, OpenWRT<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, SUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, Arch<\/a><\/noindex>). Probl\u00e9m tie\u017e t\u00fdka<\/a><\/noindex> rie\u0161enia zalo\u017een\u00e9 na otvorenom UPnP stacku pupnp<\/a><\/noindex>, inform\u00e1ci\u00ed o oprav\u00e1ch, pre ktor\u00e9 zatia\u013e nie s\u00fa k dispoz\u00edcii.<\/p>\n

Protokol UPnP definuje mechanizmus na automatick\u00e9 objavovanie zariaden\u00ed v lok\u00e1lnej sieti a interakciu s nimi. Tento protokol bol p\u00f4vodne navrhnut\u00fd na pou\u017e\u00edvanie v intern\u00fdch lok\u00e1lnych sie\u0165ach a nepredpoklad\u00e1 \u017eiadne formy autentifik\u00e1cie a verifik\u00e1cie. Napriek tomu mili\u00f3ny zariaden\u00ed nevypli podporu UPnP na vonkaj\u0161\u00edch sie\u0165ov\u00fdch rozhraniach a zost\u00e1vaj\u00fa dostupn\u00e9<\/a><\/noindex> na po\u017eiadavky z glob\u00e1lnej siete. \u00datok m\u00f4\u017ee by\u0165 vykonan\u00fd cez ak\u00e9ko\u013evek podobn\u00e9 zariadenie UPnP.
\nNapr\u00edklad, konzoly Xbox One m\u00f4\u017eu by\u0165 napadnut\u00e9 cez sie\u0165ov\u00fd port 2869, nako\u013eko umo\u017e\u0148uj\u00fa sledova\u0165 cez pr\u00edkaz SUBSCRIBE tak\u00e9 zmeny, ako je poskytovanie zdie\u013eania obsahu.<\/p>\n

Organiz\u00e1cia Open Connectivity Foundation (OCF) bola o probl\u00e9me informovan\u00e1 koncom minul\u00e9ho roku, ale spo\u010diatku odmietla pova\u017eova\u0165 ho za zranite\u013enos\u0165 v \u0161pecifik\u00e1cii. Po podrobnej\u0161ej spr\u00e1ve bola pr\u00edtomnos\u0165 probl\u00e9mu uznan\u00e1 a do \u0161pecifik\u00e1cie bola pridan\u00e1 po\u017eiadavka na pou\u017e\u00edvanie UPnP len na LAN rozhraniach. Preto\u017ee probl\u00e9m je sp\u00f4soben\u00fd nedostatkom v \u0161tandarde, oprava zranite\u013enosti v jednotliv\u00fdch zariadeniach m\u00f4\u017ee trva\u0165 dlh\u00fd \u010das a pre star\u0161ie zariadenia aktualiz\u00e1cie firmv\u00e9ru nemusia by\u0165 k dispoz\u00edcii.<\/p>\n

Ako obch\u00e1dzanie obrann\u00fdch mechanizmov sa odpor\u00fa\u010da izolova\u0165 zariadenia UPnP od extern\u00fdch po\u017eiadaviek pomocou firewalla, blokova\u0165 extern\u00e9 HTTP po\u017eiadavky «SUBSCRIBE» a «NOTIFY» na syst\u00e9moch prevencie \u00fatokov alebo vypn\u00fa\u0165 protokol UPnP na vonkaj\u0161\u00edch sie\u0165ov\u00fdch rozhraniach. V\u00fdrobcovia s\u00fa odpor\u00fa\u010dan\u00ed deaktivova\u0165 funkciu SUBSCRIBE v predvo\u013eb\u00e1ch a obmedzi\u0165 jej aktiv\u00e1ciu iba na prij\u00edmanie po\u017eiadaviek z vn\u00fatornej siete.
\nNa testovanie zranite\u013enosti svojich zariaden\u00ed bol zverejnen\u00fd<\/a><\/noindex> \u0161peci\u00e1lny n\u00e1stroj, nap\u00edsan\u00fd v jazyku Python a distribuovan\u00fd pod licenciou MIT. <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-12695) \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 UPnP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u044e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u043d\u0443\u044e \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044e «SUBSCRIBE». \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f CallStranger. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0441\u0435\u0442\u0435\u0439, \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445 (DLP), \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84663,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-84662","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v UPnP vhodn\u00e1 na zosilnenie DDoS \u00fatokov a skenovanie vn\u00fatornej siete | ProHoster","description":"Boli zverejnen\u00e9 inform\u00e1cie o","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 UPnP, \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a \u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-upnp-podhodyashhaya-dlya-usileniya-ddos-atak-i-skanirovaniya-vnutrennej-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-09T23:42:15+00:00","article:modified_time":"2020-06-09T23:42:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84662","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:53:24","updated":"2022-09-27 14:10:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/84662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=84662"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/84662\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/84663"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=84662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=84662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=84662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}