{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"Posodobite RouterOS na svojem MikroTik-u","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Posodobite
\nVe\u010der 10. marca je podpora Mail.ru za\u010dela prejemati prito\u017ebe uporabnikov o nemogo\u010dem povezovanju s IMAP\/SSMTP stre\u017eniki Mail.ru prek e-po\u0161tnih programov. Pri tem del povezav ni deloval, del pa je prikazoval napako certifikata. Napako je povzro\u010dil dejstvo, da \u00abstre\u017enik\u00bb izda samopodpisan certifikat TLS.
\n<\/a><\/noindex>\u00a0
\n\"Posodobite
\nV dveh dneh je pri\u0161lo ve\u010d kot 10 prito\u017eb uporabnikov iz razli\u010dnih omre\u017eij in z razli\u010dnimi napravami, kar je naredilo malo verjetnim, da gre za te\u017eavo v omre\u017eju enega samega ponudnika. Podrobnej\u0161a analiza problema je razkrila, da se na ravni DNS dogaja zamenjava stre\u017enika imap.mail.ru (pa tudi drugih e-po\u0161tnih stre\u017enikov in storitev). Kasneje smo ob aktivni pomo\u010di na\u0161ih uporabnikov ugotovili, da je vzrok v napa\u010dni zapisani ke\u0161irni datoteki njihovega usmerjevalnika, ki obenem slu\u017ei kot lokalni DNS resolver, pri \u010demer je v mnogih (a ne vseh) primerih to naprava MikroTik, zelo priljubljena v majhnih podjetni\u0161kih omre\u017ejih in med malimi internetnimi ponudniki.<\/p>\n

Kak\u0161en je problem<\/h2>\n

\nU septembru 2019. istra\u017eiva\u010di odkrili <\/a><\/noindex>nekatere ranljivosti v MikroTik RouterOS (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979), ki so omogo\u010dale napad z zastrupljanjem DNS predpomnilnika, tj. mo\u017enost zamenjave DNS zapisov v DNS predpomnilniku usmerjevalnika, pri \u010demer CVE-2019-3978 napadalcu omogo\u010da, da ne \u010daka, da se kdo iz notranjega omre\u017eja obrne na njegov DNS stre\u017enik, da bi zastrupil predpomnilnik resolverja, temve\u010d lahko spro\u017ei to zahtevo sam preko vrat 8291 (UDP in TCP). Ranljivost so popravili pri MikroTik v razli\u010dicah RouterOS 6.45.7 (stabilno) in 6.44.6 (dolgo obdobje) 28. oktobra 2019, vendar je po navedbah raziskav <\/a><\/noindex>ve\u010dina uporabnikov trenutno ni namestila popravkov.<\/p>\n

O\u010ditno je, da se ta te\u017eava trenutno aktivno izkori\u0161\u010da v \u00bb\u017eivem\u00ab okolju.<\/p>\n

Zakaj je to nevarno<\/h2>\n

\nNapadalec lahko zamenja DNS zapis katerega koli gostitelja, ki ga kli\u010de uporabnik notranjega omre\u017eja, in tako ujame promet do njega. \u010ce se ob\u010dutljive informacije prena\u0161ajo brez \u0161ifriranja (na primer preko http:\/\/ brez TLS) ali \u010de uporabnik privoli v sprejem la\u017enega certifikata, lahko napadalec pridobi vse podatke, ki se prenesejo preko povezave, na primer prijavno ime ali geslo. Na \u017ealost praksa ka\u017ee, da \u010de ima uporabnik mo\u017enost sprejeti la\u017eni certifikat, jo bo izkoristil.<\/p>\n

Zakaj prav SMTP in IMAP stre\u017eniki, in kaj je re\u0161ilo uporabnike<\/h2>\n

\nZakaj so napadalci posku\u0161ali prestre\u010di prav SMTP\/IMAP promet e-po\u0161tnih aplikacij in ne spletni promet, kljub temu da ve\u010dina uporabnikov dostopa do e-po\u0161te prek brskalnika po HTTPS?<\/p>\n

Ne vse e-po\u0161tne aplikacije, ki delujejo prek SMTP in IMAP\/POP3, za\u0161\u010ditijo uporabnika pred napakami, tako da mu prepre\u010dijo po\u0161iljanje prijavnimi podatki prek nezavarovane ali kompromitirane povezave, \u010deprav po standardu RFC 8314<\/a><\/noindex>, sprejetem \u017ee leta 2018 (in implementiranem v Mail.ru precej prej), bi morale za\u0161\u010dititi uporabnika pred prestrezanjem gesla prek katerekoli neza\u0161\u010ditene povezave. Poleg tega se protokol OAuth v e-po\u0161tnih odjemalcih redko uporablja (podpirajo ga e-po\u0161tni stre\u017eniki Mail.ru), brez njega pa se prijavni podatki prena\u0161ajo v vsakem sejmu.<\/p>\n

Brskalniki so nekoliko bolje za\u0161\u010diteni pred napadi Man-in-the-Middle. Na vseh kriti\u010dnih domenah mail.ru je poleg HTTPS vklju\u010dena tudi politika HSTS (HTTP stroga varnost prevoza). Ob vklopljenem HSTS modereren brskalnik ne omogo\u010da uporabniku enostavne mo\u017enosti sprejema ponarejenega certifikata, tudi \u010de si to uporabnik \u017eeli. Poleg HSTS so uporabnike re\u0161evale tudi dejstvo, da od leta 2017 stre\u017eniki SMTP, IMAP in POP3 Mail.ru prepovedujejo prenos gesla prek neza\u0161\u010ditene povezave, vsi na\u0161i uporabniki pa so uporabljali TLS za dostop prek SMTP, POP3 in IMAP, zato so prijavni podatki lahko bili prestre\u017eeni le, \u010de se uporabnik sam strinja s sprejemom ponarejenega certifikata.<\/p>\n

Za mobilne uporabnike vedno priporo\u010damo uporabo aplikacij Mail.ru za dostop do e-po\u0161te, saj je delo z e-po\u0161to v njih varnej\u0161e kot v brskalnikih ali v vgrajenih SMTP\/IMAP odjemalcih.<\/p>\n

Kaj je treba storiti<\/h2>\n

\nPotrebno je posodobiti programsko opremo MikroTik RouterOS na varno razli\u010dico. \u010ce to iz kakr\u0161nega koli razloga ni mogo\u010de, je treba filtrirati promet po prenosnem portu 8291 (tcp in udp), kar ote\u017euje re\u0161evanje te\u017eave, ne odpravi pa mo\u017enosti pasivne injekcije v DNS predpomnilnik. Internetni ponudniki naj filtrirajo ta port v svojih omre\u017ejih, da za\u0161\u010ditijo poslovne uporabnike.\u00a0<\/p>\n

Vsem uporabnikom, ki so sprejeli ponarejen certifikat, je nujno treba spremeniti geslo za e-po\u0161to in druge storitve, za katere je bil ta certifikat sprejet. S svoje strani bomo obvestili uporabnike, ki dostopajo do e-po\u0161te prek ranljivih naprav.<\/p>\n

P.S. Obstaja \u0161e ena povezana ranljivost, opisana v objavi LukaSafonov<\/a><\/noindex> \"Backport ranljivosti v RouterOS ogro\u017ea na tiso\u010de naprav<\/a><\/noindex>\".
\n
Izvor: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Posodobite RouterOS na va\u0161em MikroTik | ProHoster","description":"10. marca zve\u010der je slu\u017eba za podporo Mail.ru za\u010dela.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}