{"id":37225,"date":"2019-10-31T22:16:26","date_gmt":"2019-10-31T19:16:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ataka-knob-pozvolyayushhaya-perehvatit-zashifrovannyj-trafik-bluetooth\/"},"modified":"2019-10-31T22:16:26","modified_gmt":"2019-10-31T19:16:26","slug":"ataka-knob-pozvolyayushhaya-perehvatit-zashifrovannyj-trafik-bluetooth","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-knob-pozvolyayushhaya-perehvatit-zashifrovannyj-trafik-bluetooth","title":{"rendered":"Sulmi KNOB, q\u00eb lejon kapjen e trafikut t\u00eb enkriptuar Bluetooth","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zbulimi<\/a><\/noindex> informacion<\/a><\/noindex> mbi sulmin KNOB<\/a><\/noindex> (Negocimi i \u00c7el\u00ebsit t\u00eb Bluetooth), i cili lejon organizimin e kapjes dhe z\u00ebvend\u00ebsimit t\u00eb informacionit n\u00eb trafik t\u00eb kriptuar Bluetooth. Duke pasur mund\u00ebsin\u00eb p\u00ebr t\u00eb bllokuar transmetimin direkt t\u00eb paketave gjat\u00eb procesit t\u00eb negociat\u00ebs s\u00eb lidhjes s\u00eb pajisjeve Bluetooth, sulmuesi mund t\u00eb arrij\u00eb t\u00eb p\u00ebrdor\u00eb \u00e7el\u00ebsa q\u00eb p\u00ebrmbajn\u00eb vet\u00ebm 1 byte entropi p\u00ebr seanc\u00ebn, duke lejuar p\u00ebrdorimin e metod\u00ebs s\u00eb prov\u00ebs s\u00eb drejtp\u00ebrdrejt\u00eb (brute-force) p\u00ebr t\u00eb p\u00ebrcaktuar \u00e7el\u00ebsin e kriptimit. <\/p>\n

Problemi shkaktohet nga mang\u00ebsit\u00eb (CVE-2019-9506) n\u00eb spesifikimin e Bluetooth BR\/EDR Core 5.1 dhe versione m\u00eb t\u00eb hershme, t\u00eb cilat lejojn\u00eb p\u00ebrdorimin e \u00e7el\u00ebsave shum\u00eb t\u00eb shkurt\u00ebr dhe nuk pengojn\u00eb nd\u00ebrhyrjen e sulmuesit n\u00eb faz\u00ebn e negociat\u00ebs s\u00eb lidhjes p\u00ebr t\u00eb kaluar n\u00eb k\u00ebto \u00e7el\u00ebsa t\u00eb pap\u00ebrshtatsh\u00ebm (\u00ebsht\u00eb e mundur z\u00ebvendosja e paketave nga nj\u00eb sulmues i paautorizuar). Sulmi mund t\u00eb b\u00ebhet gjat\u00eb negociat\u00ebs s\u00eb lidhjes s\u00eb pajisjeve (seancat tashm\u00eb t\u00eb vendosura nuk mund t\u00eb sulmohen) dhe \u00ebsht\u00eb efektiv vet\u00ebm p\u00ebr lidhjet n\u00eb modet BR\/EDR (Bluetooth Rate t\u00eb Thjesht\u00eb\/Shtes\u00eb t\u00eb Shpejt\u00ebsis\u00eb s\u00eb T\u00eb Dh\u00ebnave), n\u00eb rast se t\u00eb dy pajisjet jan\u00eb t\u00eb ndjeshme ndaj dob\u00ebsis\u00eb. N\u00eb rastin e suksessh\u00ebm t\u00eb p\u00ebrshtatjes s\u00eb \u00e7el\u00ebsit, keqb\u00ebr\u00ebsi mund t\u00eb deshifroj\u00eb t\u00eb dh\u00ebnat e transmetuara dhe t\u00eb z\u00ebvend\u00ebsoj\u00eb n\u00eb fsheht\u00ebsi trafikun e caktuar.<\/p>\n

Kur vendoset nj\u00eb lidhje midis dy kontroler\u00ebve Bluetooth A dhe B, kontroleri A pas autentifikimit me \u00e7el\u00ebsin e lidhjes (link key) mund t\u00eb propozoj\u00eb p\u00ebrdorimin e 16 byte entropi p\u00ebr \u00e7el\u00ebsin e kriptimit (encryption key), dhe kontroleri B mund t\u00eb pranoj\u00eb k\u00ebt\u00eb vler\u00eb ose t\u00eb jap\u00eb nj\u00eb vler\u00eb m\u00eb t\u00eb vog\u00ebl, n\u00eb rast se nuk ka mund\u00ebsi t\u00eb formoj\u00eb \u00e7el\u00ebsin e propozuar. N\u00eb p\u00ebrgjigje, kontroleri A mund t\u00eb pranoj\u00eb propozimin e kthyer dhe t\u00eb aktivizoj\u00eb nj\u00eb kanal t\u00eb kriptuar t\u00eb komunikimit. N\u00eb k\u00ebt\u00eb faz\u00eb negociatash, kriptimi nuk aplikohet, k\u00ebshtu q\u00eb sulmuesi ka mund\u00ebsin\u00eb t\u00eb nd\u00ebrhyn\u00eb n\u00eb shk\u00ebmbimin e t\u00eb dh\u00ebnave midis kontroler\u00ebve dhe t\u00eb z\u00ebvend\u00ebsoj\u00eb paket\u00ebn me vler\u00ebn e propozuar t\u00eb entropis\u00eb. Duke qen\u00eb se p\u00ebrmasat e pranueshme t\u00eb \u00e7el\u00ebsit variojn\u00eb nga 1 deri n\u00eb 16 byte, kontroleri tjet\u00ebr do t\u00eb pranoj\u00eb k\u00ebt\u00eb vler\u00eb dhe do t\u00eb d\u00ebrgoj\u00eb konfirmimin e tij me njoftimin e nj\u00eb p\u00ebrmas\u00eb t\u00eb ngjashme.<\/p>\n

\"Sulmi<\/a><\/noindex><\/center><\/p>\n

P\u00ebr t\u00eb riprodhuar dob\u00ebsin\u00eb n\u00eb kushte laboratorike (aktiviteti i keqb\u00ebr\u00ebsit u emetua n\u00eb nj\u00eb nga pajisjet) \u00ebsht\u00eb propozuar
\nprototipi i mjetit<\/a><\/noindex> p\u00ebr t\u00eb realizuar sulmin.
\nP\u00ebr nj\u00eb sulm t\u00eb suksessh\u00ebm, sulmuesi duhet t\u00eb jet\u00eb brenda zon\u00ebs s\u00eb pranimit t\u00eb pajisjeve t\u00eb viktimave dhe t\u00eb ket\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb bllokuar p\u00ebrkoh\u00ebsisht sinjalin nga \u00e7do pajisje, gj\u00eb q\u00eb propozohet t\u00eb realizohet p\u00ebrmes manipulimit t\u00eb sinjalit ose bllokimit reaktiv. <\/p>\n

Organizata Bluetooth SIG, e cila \u00ebsht\u00eb p\u00ebrgjegj\u00ebse p\u00ebr zhvillimin e standartit Bluetooth, publikoi<\/a><\/noindex> ka b\u00ebr\u00eb korrigjimin e specifikimit num\u00ebr 11838, n\u00eb t\u00eb cilin jan\u00eb propozuar masa nga prodhuesit p\u00ebr t\u00eb bllokuar vulnerabilitetin (masa minimale e \u00e7el\u00ebsit t\u00eb enkriptimit \u00ebsht\u00eb rritur nga 1 n\u00eb 7). Problemi shfaqet<\/a><\/noindex> ndodhet t\u00eb gjitha<\/a><\/noindex> n\u00eb stekat p\u00ebrkat\u00ebse Bluetooth dhe firmware-t e \u00e7ipave Bluetooth, duke p\u00ebrfshir\u00eb produktet Intel<\/a><\/noindex>, Broadcom, Lenovo<\/a><\/noindex>, Apple<\/a><\/noindex>, Microsoft<\/a><\/noindex>, Qualcomm, Linux, Android<\/a><\/noindex>, Blackberry<\/a><\/noindex> dhe Cisco<\/a><\/noindex> (nga 14 \u00e7ipa t\u00eb testuar, t\u00eb gjith\u00eb rezultuan vulnerab\u00ebl). N\u00eb stekun Bluetooth t\u00eb kernit Linux \u00ebsht\u00eb b\u00ebr\u00eb<\/a><\/noindex> nj\u00eb korrigjim, q\u00eb lejon modifikimin e mas\u00ebs minimale t\u00eb \u00e7el\u00ebsit t\u00eb enkriptimit. <\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0430\u0442\u0430\u043a\u0435 KNOB (Key Negotiation Of Bluetooth), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c Bluetooth-\u0442\u0440\u0430\u0444\u0438\u043a\u0435. \u0418\u043c\u0435\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u044f\u043c\u0443\u044e \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f Bluetooth-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0435\u0430\u043d\u0441\u0430 \u043a\u043b\u044e\u0447\u0435\u0439, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u0432\u0441\u0435\u0433\u043e 1 \u0431\u0430\u0439\u0442 \u044d\u043d\u0442\u0440\u043e\u043f\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u043c\u0435\u0442\u043e\u0434 \u043f\u0440\u044f\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 (brute-force) \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043a\u043b\u044e\u0447\u0430 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u0434\u043e\u0440\u0430\u0431\u043e\u0442\u043a\u0430\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27914,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37225","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sulmi KNOB, q\u00eb lejon kapjen e trafikut t\u00eb enkriptuar Bluetooth | ProHoster","description":"Zbulimi","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-knob-pozvolyayushhaya-perehvatit-zashifrovannyj-trafik-bluetooth","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 KNOB, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a Bluetooth | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-knob-pozvolyayushhaya-perehvatit-zashifrovannyj-trafik-bluetooth","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:26+00:00","article:modified_time":"2019-10-31T19:16:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37225","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:49:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:31:24","updated":"2026-01-23 16:49:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/37225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=37225"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/37225\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/27914"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=37225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=37225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=37225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}