{"id":112410,"date":"2023-12-22T03:10:14","date_gmt":"2023-12-22T01:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij"},"modified":"2023-12-22T03:10:14","modified_gmt":"2023-12-22T01:10:16","slug":"smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","title":{"rendered":"SMTP Smuggling — nj\u00eb teknik\u00eb e re spoofing p\u00ebr mesazhet e email-it","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hulumtuesit nga kompania SEC Consult publikuan nj\u00eb teknik\u00eb t\u00eb re t\u00eb spufingut, e shkaktuar nga dallimet n\u00eb ndjekjen e specifikimeve n\u00eb implementime t\u00eb ndryshme t\u00eb protokollit SMTP. Teknikat e propozuara t\u00eb sulmit lejojn\u00eb ndarjen e nj\u00eb mesazhi n\u00eb disa mesazhe t\u00eb ndryshme gjat\u00eb kalimit nga serveri i origjin\u00ebs SMTP n\u00eb nj\u00eb server tjet\u00ebr SMTP, i cili interpreton ndryshe sekuenc\u00ebn p\u00ebr ndarjen e letrave, t\u00eb cilat transmetohen p\u00ebrmes nj\u00eb koneksioni. Metoda mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb d\u00ebrguar mesazhe fals nga emisor\u00eb t\u00eb tjer\u00eb n\u00eb sh\u00ebrbimet e post\u00ebs q\u00eb verifikojn\u00eb emisorin origjinal. <\/p>\n

Problemi shkaktohet nga fakti q\u00eb server\u00eb t\u00eb ndrysh\u00ebm SMTP interpretojn\u00eb ndryshe sekuenc\u00ebn e p\u00ebrfundimit t\u00eb t\u00eb dh\u00ebnave, e cila mund t\u00eb \u00e7oj\u00eb n\u00eb ndarjen e nj\u00eb emaili n\u00eb disa brenda nj\u00eb seance me serverin SMTP. N\u00eb specifikimin p\u00ebr etiketimin e p\u00ebrfundimit t\u00eb d\u00ebrgimit t\u00eb emailit, \u00ebsht\u00eb e p\u00ebrcaktuar sekuenca «\r\n.\r\n» (pik\u00eb, e rrethuar nga simbolet e kthimit t\u00eb kariges dhe rreshtimit t\u00eb ri). Pas k\u00ebsaj sekuence mund t\u00eb pasojn\u00eb komanda p\u00ebr d\u00ebrgimin e nj\u00eb emaili tjet\u00ebr pa nd\u00ebrprer\u00eb lidhjen. Nj\u00eb grup serverash SMTP ndjekin rigorozisht k\u00ebt\u00eb rregullore, nd\u00ebrsa t\u00eb tjer\u00eb, p\u00ebr t\u00eb siguruar kompatibilitet me disa klient\u00eb t\u00eb rrall\u00eb t\u00eb post\u00ebs, e trajtojn\u00eb si ndar\u00ebsula sekuenca t\u00eb tilla si «\n.\n», «\n.\r\n», «\r\n.\n», «\r.\r», «\r\n0.\r\n» dhe «\r\n0.\r\n». <\/p>\n

Sulmi konsiston n\u00eb d\u00ebrgimin e nj\u00eb letre p\u00ebr serverin e par\u00eb server<\/a>, i cili p\u00ebrpunon vet\u00ebm ndar\u00ebsin «\r\n.\r\n» d\u00ebrgohet nj\u00eb email, n\u00eb trupin e t\u00eb cilit \u00ebsht\u00eb e pranishme nj\u00eb ndar\u00ebs alternativ, p\u00ebr shembull, «\r.\r», pas t\u00eb cilit ndodhin komandat p\u00ebr d\u00ebrgimin e mesazhit t\u00eb dyt\u00eb. Duke qen\u00eb se serveri i par\u00eb ndjek rigorozisht specifikimin, ai e trajton sekuenc\u00ebn e marr\u00eb si nj\u00eb email t\u00eb vetme. N\u00ebse m\u00eb pas emaili d\u00ebrgohet n\u00eb nj\u00eb server tranzit apo nj\u00eb server pranues, i cili gjithashtu e percepton sekuenc\u00ebn «\r.\r» si ndar\u00ebs, do t\u00eb p\u00ebrpunohet si dy emaila t\u00eb d\u00ebrguar ndaras (emaili i dyt\u00eb mund t\u00eb d\u00ebrgohet n\u00eb em\u00ebr t\u00eb nj\u00eb p\u00ebrdoruesi, i cili nuk \u00ebsht\u00eb autentikuar p\u00ebrmes «AUTH LOGIN», por duket si i sakt\u00eb nga ana e marr\u00ebsit).

\"SMTP<\/center>
\"SMTP<\/center> <\/p>\n

Si shembuj t\u00eb server\u00ebve dhe sh\u00ebrbimeve SMTP q\u00eb pranojn\u00eb ndar\u00ebs alternativ\u00eb jan\u00eb Postfix, Sendmail, MS Exchange Online dhe Cisco Secure Email Gateway, nd\u00ebrsa mes sh\u00ebrbimeve t\u00eb post\u00ebs q\u00eb nuk filtrojn\u00eb ndar\u00ebs t\u00eb pap\u00ebrshtatsh\u00ebm nga emailat kur b\u00ebhet fjal\u00eb p\u00ebr server\u00eb t\u00eb tjer\u00eb \u2014 jan\u00eb GMX, iCloud dhe Microsoft Outlook. <\/p>\n

P\u00ebr t\u00eb bllokuar problemin n\u00eb Postfix n\u00eb versionet 3.8.1, 3.7.6, 3.6.10 dhe 3.5.20 \u00ebsht\u00eb shtuar konfigurimi «smtpd_forbid_unauth_pipelining», i cili \u00e7on n\u00eb prishjen e lidhjes n\u00eb rast se p\u00ebrdoren ndar\u00ebs, t\u00eb cilat nuk p\u00ebrputhen me k\u00ebrkesat e RFC 2920 dhe RFC 5321. Aktualisht, ky konfigurim \u00ebsht\u00eb i \u00e7aktivizuar si parazgjedhje, por planifikohet t\u00eb aktivizohet si parazgjedhje n\u00eb deg\u00ebn Postfix 3.9, e cila pritet n\u00eb pranver\u00ebn e vitit 2024. N\u00eb versionin 3.9 do t\u00eb p\u00ebrfshihet gjithashtu konfigurimi smtpd_forbid_bare_newline, i cili do t\u00eb tregoj\u00eb nj\u00eb gabim kur p\u00ebrdoret vet\u00ebm simboli i transferimit t\u00eb rreshtit («\n») p\u00ebr ndarjen e rreshtave, gj\u00eb q\u00eb shkel RFC 5321. <\/p>\n

N\u00eb versionin e ardhsh\u00ebm t\u00eb Sendmail 8.18.0.2 p\u00ebr mbrojtjen nga sulmi, n\u00eb srv_features \u00ebsht\u00eb propozuar opsioni ‘o’, i cili p\u00ebrfshin p\u00ebrpunimin vet\u00ebm t\u00eb sekuenc\u00ebs «\r\n.\r\n». Theksohet se \u00e7aktivizimi i mb\u00ebshtetjes p\u00ebr ndar\u00ebs alternativ mund t\u00eb d\u00ebmtoj\u00eb funksionimin e disa klient\u00ebve t\u00eb rrall\u00eb t\u00eb post\u00ebs, t\u00eb cil\u00ebt nuk i p\u00ebrmbahen plot\u00ebsisht specifikave t\u00eb SMTP.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SEC Consult \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMTP. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0440\u0430\u0441\u0449\u0435\u043f\u0438\u0442\u044c \u043e\u0434\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043f\u0440\u0438 \u0435\u0433\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c SMTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 SMTP-\u0441\u0435\u0440\u0432\u0435\u0440, \u043f\u043e \u0438\u043d\u043e\u043c\u0443 \u0442\u0440\u0430\u043a\u0442\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0438\u0441\u0435\u043c, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043e\u0434\u043d\u043e \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":112411,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112410","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SMTP Smuggling \u2014 nj\u00eb teknik\u00eb e re e spufimit t\u00eb mesazheve t\u00eb post\u00ebs elektronike | ProHoster","description":"K\u00ebrkuesit nga kompania SEC Consult publikuan nj\u00eb teknik\u00eb t\u00eb re spufimi, e shkaktuar nga dallimet n\u00eb ndjekjen e specifikimeve n\u00eb realizime t\u00eb ndryshme t\u00eb protokollit SMTP.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SMTP Smuggling \u2014 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SEC Consult \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMTP.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-22T01:10:16+00:00","article:modified_time":"2023-12-22T01:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/112410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=112410"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/112410\/revisions"}],"predecessor-version":[{"id":172924,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/112410\/revisions\/172924"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/112411"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=112410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=112410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=112410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}