{"id":71704,"date":"2020-02-27T20:54:05","date_gmt":"2020-02-27T17:54:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-wi-fi-chipah-cypress-i-broadcom-pozvolyayushhaya-rasshifrovat-trafik"},"modified":"2020-03-03T16:10:37","modified_gmt":"2020-03-03T13:10:37","slug":"uyazvimost-v-wi-fi-chipah-cypress-i-broadcom-pozvolyayushhaya-rasshifrovat-trafik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-wi-fi-chipah-cypress-i-broadcom-pozvolyayushhaya-rasshifrovat-trafik","title":{"rendered":"Vulnerabilitet n\u00eb \u00e7ipat Wi-Fi Cypress dhe Broadcom, q\u00eb lejon dekodimin e trafikut","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebrkuesit nga kompania Eset zbuluan<\/a><\/noindex> n\u00eb konferenc\u00ebn q\u00eb po zhvillohet k\u00ebto dit\u00eb RSA 2020<\/a><\/noindex> informacion mbi dob\u00ebsin\u00eb<\/a><\/noindex> (CVE-2019-15126<\/a><\/noindex>) n\u00eb \u00e7ipat pa kabllo Cypress dhe Broadcom, duke mund\u00ebsuar dekodimin e trafikut Wi-Fi t\u00eb kapur, i mbrojtur me protokollin WPA2. Vulnerabiliteti ka emrin kodues Kr00k. Problemi p\u00ebrfshin \u00e7ipat FullMAC (staku Wi-Fi \u00ebsht\u00eb realizuar n\u00eb an\u00ebn e \u00e7ipit, jo n\u00eb shofer), t\u00eb aplikuara n\u00eb nj\u00eb gam\u00eb t\u00eb gjer\u00eb t\u00eb pajisjeve p\u00ebrdoruesve, nga smartphone t\u00eb prodhuesve t\u00eb njohur (Apple, Xiaomi, Google, Samsung), deri te kutit\u00eb inteligjente (Amazon Echo, Amazon Kindle), pllakat (Raspberry Pi 3) dhe pikave t\u00eb qasjes pa kabllo (Huawei, ASUS, Cisco).<\/p>\n

Vulnerabiliteti shkaktohet nga p\u00ebrpunimi i gabuar i \u00e7el\u00ebseve t\u00eb enkriptimit gjat\u00eb shk\u00ebputjes (disociacionit<\/a><\/noindex>) t\u00eb pajisjes nga pika e qasjes. Gjat\u00eb shk\u00ebputjes, b\u00ebhet zeroimi i \u00e7el\u00ebsit t\u00eb seanc\u00ebs (PTK) q\u00eb ruhet n\u00eb memorje t\u00eb \u00e7ipit, pasi d\u00ebrgimi i m\u00ebtejsh\u00ebm i t\u00eb dh\u00ebnave n\u00eb k\u00ebt\u00eb seanc\u00eb nuk do t\u00eb ndodh\u00eb. Esenca e vulnerabilitetit \u00ebsht\u00eb se t\u00eb dh\u00ebnat e mbetura n\u00ebBuffers (TX) enkriptohen duke p\u00ebrdorur nj\u00eb \u00e7el\u00ebs tashm\u00eb t\u00eb pastruar, q\u00eb p\u00ebrb\u00ebhet vet\u00ebm nga nj\u00ebra dhe, p\u00ebr pasoj\u00eb, mund t\u00eb dekodohen leht\u00ebsisht gjat\u00eb kapjes. \u00c7el\u00ebsi i zbraz\u00ebt aplikohet vet\u00ebm p\u00ebr t\u00eb dh\u00ebnat e mbetura n\u00eb buffer, madh\u00ebsia e t\u00eb cilit \u00ebsht\u00eb disa kilobajt\u00eb. <\/p>\n

K\u00ebshtu, sulmi nd\u00ebrtoset mbi d\u00ebrgimin artificialisht t\u00eb kadrove t\u00eb caktuara, q\u00eb t\u00eb shkaktojn\u00eb disociacion dhe kapjen e t\u00eb dh\u00ebnave q\u00eb d\u00ebrgohen m\u00eb pas. Disociacioni zakonisht aplikohet n\u00eb rrjetet pa kabllo p\u00ebr t\u00eb kaluar nga nj\u00eb pik\u00eb qasje n\u00eb tjetr\u00ebn gjat\u00eb roaming-ut ose kur humbet lidhja me punktin aktual t\u00eb qasjes. Disociacioni mund t\u00eb shkaktohet duke d\u00ebrguar nj\u00eb kad\u00ebr menaxhues, i cili d\u00ebrgohet n\u00eb form\u00ebn e qart\u00eb dhe nuk k\u00ebrkon autentifikim (sulmuesi ka vet\u00ebm nevoj\u00eb p\u00ebr t\u00eb pasur qasje n\u00eb sinjalin Wi-Fi, por nuk ka nevoj\u00eb t\u00eb lidhet me rrjetin pa kabllo). Sulmi \u00ebsht\u00eb testuar vet\u00ebm duke p\u00ebrdorur protokollin WPA2, mund\u00ebsia e kryerjes s\u00eb sulmit n\u00eb WPA3 nuk \u00ebsht\u00eb verifikuar.<\/p>\n

\"Vulnerabilitet<\/a><\/noindex><\/center><\/p>\n

Sipas vler\u00ebsimeve paraprake, vulnerabiliteti potencialisht mund t\u00eb prek\u00eb miliarda pajisjesh q\u00eb jan\u00eb n\u00eb p\u00ebrdorim. N\u00eb pajisje me \u00e7ipat Qualcomm, Realtek, Ralink dhe Mediatek, problemi nuk shfaqet. Megjithat\u00eb, dekodimi i trafikut \u00ebsht\u00eb i mundur si kur nj\u00eb pajisje klienti e prek nj\u00eb pik\u00eb qasje pa probleme, ashtu edhe n\u00eb rastin kur nj\u00eb pajisje e paprekur nga problemi lidhet me nj\u00eb pik\u00eb qasje q\u00eb shfaq vulnerabilitetin. Shum\u00eb prodhues t\u00eb pajisjeve p\u00ebr konsumator\u00eb tashm\u00eb kan\u00eb l\u00ebshuar p\u00ebrdit\u00ebsime t\u00eb firmware p\u00ebr t\u00eb eliminuar vulnerabilitetin (p.sh., kompania Apple eliminoi<\/a><\/noindex> vulnerabilitetin q\u00eb n\u00eb tetorin e kaluar). <\/p>\n

Duhet t\u00eb theksohet se vulnerabiliteti prekin enkriptimin n\u00eb nivelin e rrjetit pa kabllo dhe lejon analizimin vet\u00ebm t\u00eb lidhjeve q\u00eb p\u00ebrdoruesi vendos t\u00eb mos jen\u00eb t\u00eb mbrojtura, por nuk jep mund\u00ebsin\u00eb p\u00ebr t\u00eb komprometuar lidhjet me enkriptim n\u00eb nivelin e aplikacionit (HTTPS, SSH, STARTTLS, DNS over TLS, VPN etj.). Rreziku i sulmit gjithashtu u zvog\u00ebluar nga fakti se n\u00eb nj\u00eb koh\u00eb, sulmuesi mund t\u00eb dekodoj\u00eb vet\u00ebm disa kilobajt\u00eb t\u00eb t\u00eb dh\u00ebnave q\u00eb ishin n\u00eb buffer gjat\u00eb shk\u00ebputjes. P\u00ebr t\u00eb kapur me sukses t\u00eb dh\u00ebnat konfidenciale q\u00eb d\u00ebrgohen n\u00ebp\u00ebr nj\u00eb lidhje t\u00eb pa mbrojtur, sulmuesi ose duhet t\u00eb dij\u00eb sakt\u00ebsisht momentin e d\u00ebrgimit, ose t\u00eb filloj\u00eb vazhdimisht shk\u00ebputjen nga pika e qasjes, q\u00eb do t\u00eb spikaste p\u00ebr p\u00ebrdoruesin p\u00ebr shkak t\u00eb rifillimeve t\u00eb vazhdueshme t\u00eb lidhjes pa kabllo.<\/p>\n

Disa nga pajisjet e testuara n\u00eb Eset p\u00ebr mund\u00ebsin\u00eb e realizimit t\u00eb sulmit:<\/p>\n