{"id":107780,"date":"2023-04-08T12:48:10","date_gmt":"2023-04-08T10:48:12","guid":{"rendered":"https:\/\/prohoster.info\/?p=107780"},"modified":"2023-04-10T11:12:07","modified_gmt":"2023-04-10T09:12:07","slug":"uyazvimost-v-besprovodnyh-tochkah-dostupa-pozvolyayushhaya-organizovat-perehvat-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-besprovodnyh-tochkah-dostupa-pozvolyayushhaya-organizovat-perehvat-trafika","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb pik\u00ebt e aksesit t\u00eb pa kabllo, q\u00eb mund\u00ebson kapjen e trafikut.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb grup studiuesish nga universitetet Tsinghua (Kina) dhe George Mason (SHBA) ka zbuluar nj\u00eb informacion mbi nj\u00eb vulnerabilitet (CVE-2022-25667) n\u00eb pik\u00eb-qasjet wireless, i cili lejon organizimin e interceptimit t\u00eb trafikut (MITM) n\u00eb rrjetet wireless t\u00eb mbrojtura duke p\u00ebrdorur protokollet WPA, WPA2 dhe WPA3. N\u00ebp\u00ebrmjet manipulimit t\u00eb paketave ICMP me flamurin \u00abredirect\u00bb, sulmuesi mund t\u00eb arrij\u00eb t\u00eb ridrejtoj\u00eb trafikun e viktim\u00ebs brenda rrjetit wireless p\u00ebrmes sistemit t\u00eb tij, \u00e7ka mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb kapur dhe z\u00ebvend\u00ebsuar sesionet e pa-enkriptuara (p.sh., k\u00ebrkesat ndaj faqeve pa HTTPS). <\/p>\n

Vulnerabiliteti shkaktohet nga mungesa e filtrimit t\u00eb duhur t\u00eb mesazheve ICMP t\u00eb falsifikuara me adres\u00ebn e d\u00ebrguesit t\u00eb manipuluar (spoofing) n\u00eb procesor\u00ebt rrjetor\u00eb (NPU, Nj\u00ebsia e Procesimit t\u00eb Rrjetit), t\u00eb cil\u00ebt sigurojn\u00eb trajtimin e ul\u00ebt t\u00eb paketave n\u00eb rrjetin wireless. Nd\u00ebr t\u00eb tjera, NPU ridrejtonte pa kontrollin e spoofing mesazhet ICMP t\u00eb falsifikuara me flamurin \u00abredirect\u00bb, t\u00eb cilat mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb ndryshuar parametrat e tabelave t\u00eb routing n\u00eb an\u00ebn e p\u00ebrdoruesit-viktim\u00eb. Sulmi p\u00ebrfshin d\u00ebrgimin e nj\u00eb pakete ICMP nga emri i pik\u00ebs s\u00eb qasjes me flamurin \u00abredirect\u00bb duke treguar t\u00eb dh\u00ebna t\u00eb falsifikuara n\u00eb krye t\u00eb paket\u00ebs. P\u00ebr shkak t\u00eb vulnerabilitetit, mesazhi ridrejtohet nga pika e qasjes dhe p\u00ebrpunohet nga steka rrjetore e viktim\u00ebs, e cila mendon se mesazhi \u00ebsht\u00eb d\u00ebrguar nga pika e qasjes.

\"Nj\u00eb<\/center> <\/p>\n

Sipas hulumtimeve, \u00ebsht\u00eb propozuar nj\u00eb metod\u00eb p\u00ebr t\u00eb anashkaluar verifikimet e paketimeve ICMP me flamurin \u00abredirect\u00bb n\u00eb an\u00ebn e p\u00ebrdoruesit p\u00ebrfundimtar dhe p\u00ebr t\u00eb ndryshuar tabel\u00ebn e routing-ut. P\u00ebr t\u00eb anashkaluar filtrimin, p\u00ebrpara sulmit, sulmuesi p\u00ebrcakton nj\u00eb port aktiv UDP n\u00eb an\u00ebn e viktim\u00ebs. Nd\u00ebrsa ndodhet n\u00eb t\u00eb nj\u00ebjt\u00ebn rrjet\u00eb wireless, sulmuesi mund t\u00eb kap\u00eb trafikun, por nuk mund ta dekriptoj\u00eb, pasi nuk e di \u00e7el\u00ebsin sesional q\u00eb p\u00ebrdoret kur viktima i qaset pik\u00ebs s\u00eb qasjes. Megjithat\u00eb, duke d\u00ebrguar paketa verifikuese viktim\u00ebs, sulmuesi, bazuar n\u00eb analiz\u00ebn e p\u00ebrgjigjeve ICMP q\u00eb vijn\u00eb me flamurin \u00abDestination Unreachable\u00bb, mund t\u00eb p\u00ebrcaktoj\u00eb portin aktiv UDP. M\u00eb pas, sulmuesi formon nj\u00eb mesazh ICMP me flamurin \u00abredirect\u00bb dhe nj\u00eb header t\u00eb falsifikuar UDP, n\u00eb t\u00eb cilin \u00ebsht\u00eb specifikuar porta UDP e hapur e zbuluar. Trajtimi i k\u00ebtij mesazhi \u00e7on n\u00eb shp\u00ebrndarjen e tabel\u00ebs s\u00eb routing-ut n\u00eb sistemin e viktim\u00ebs dhe n\u00eb ridrejtimin e trafikut me mund\u00ebsin\u00eb e kapjes s\u00eb tij n\u00eb m\u00ebnyr\u00eb t\u00eb qart\u00eb n\u00eb nivelin kanal.

\"Nj\u00eb<\/center> <\/p>\n

Problemi \u00ebsht\u00eb konfirmuar n\u00eb piketat e aksesit q\u00eb p\u00ebrdorin \u00e7ipet e prodhimit HiSilicon dhe Qualcomm. Studiimi i 55 modeleve t\u00eb ndryshme t\u00eb piketave t\u00eb aksesit nga 10 prodhues t\u00eb njohur (Cisco, NetGear, Xiaomi, Mercury, 360, Huawei, TP-Link, H3C, Tenda, Ruijie) tregoi se t\u00eb gjitha ato jan\u00eb t\u00eb ndjeshme ndaj cenueshm\u00ebris\u00eb dhe nuk bllokojn\u00eb paketat ICMP t\u00eb rreme. P\u00ebr m\u00eb tep\u00ebr, analiza e 122 rrjeteve ekzistuese wireless zbuloi mund\u00ebsin\u00eb e kryerjes s\u00eb nj\u00eb sulmi n\u00eb 109 rrjete (89%).

\"Nj\u00eb<\/center> <\/p>\n

P\u00ebr t\u00eb shfryt\u00ebzuar cenueshm\u00ebrin\u00eb, sulmuesi duhet t\u00eb ket\u00eb mund\u00ebsin\u00eb p\u00ebr t'u lidhur legjitimisht me rrjetin Wi-Fi, dmth. duhet t\u00eb dij\u00eb parametrat e hyrjes n\u00eb rrjetin wireless (cenueshm\u00ebria lejon kalimin e mekanizmave t\u00eb ndarjes s\u00eb trafikut t\u00eb p\u00ebrdoruesve q\u00eb aplikohet n\u00eb protokollet WPA*). Ndryshe nga sulmet tradicionale MITM n\u00eb rrjetet wireless, duke p\u00ebrdorur teknik\u00ebn e spikimit t\u00eb paketave ICMP, sulmuesi mund t\u00eb kaloj\u00eb pa instaluar pik\u00ebn e tij t\u00eb fikcionuar t\u00eb aksesit p\u00ebr t\u00eb kapur trafikun dhe t\u00eb p\u00ebrdor\u00eb piketat legjitime t\u00eb aksesit q\u00eb sh\u00ebrbejn\u00eb p\u00ebr rrjetin p\u00ebr t\u00eb drejtuar paketat ICMP t\u00eb p\u00ebrgatitura posa\u00e7\u00ebrisht p\u00ebr viktim\u00ebn.