{"id":71704,"date":"2020-02-27T20:54:05","date_gmt":"2020-02-27T17:54:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-wi-fi-chipah-cypress-i-broadcom-pozvolyayushhaya-rasshifrovat-trafik"},"modified":"2020-03-03T16:10:37","modified_gmt":"2020-03-03T13:10:37","slug":"uyazvimost-v-wi-fi-chipah-cypress-i-broadcom-pozvolyayushhaya-rasshifrovat-trafik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-wi-fi-chipah-cypress-i-broadcom-pozvolyayushhaya-rasshifrovat-trafik","title":{"rendered":"Vulnerabilitet n\u00eb cipet Wi-Fi Cypress dhe Broadcom, i cili lejon dekriptimin e trafikut","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hulumtuesit nga kompania Eset zbuluan<\/a><\/noindex> n\u00eb konferenc\u00ebn q\u00eb po zhvillohet k\u00ebto dit\u00eb RSA 2020<\/a><\/noindex> informacione mbi mang\u00ebsive<\/a><\/noindex> (CVE-2019-15126<\/a><\/noindex>) n\u00eb \u00e7ipat pa tel t\u00eb Cypress dhe Broadcom, t\u00eb cilat lejojn\u00eb dekodimin e trafikut Wi-Fi t\u00eb kapur, t\u00eb mbrojtur duke p\u00ebrdorur protokollin WPA2. Vulnerabilitetet kan\u00eb marr\u00eb emrin kodik Kr00k. Problemi mbulon \u00e7ipat FullMAC (steku Wi-Fi implementohet n\u00eb an\u00ebn e \u00e7ipit, dhe jo n\u00eb drejtues), t\u00eb p\u00ebrdorur n\u00eb nj\u00eb gam\u00eb t\u00eb gjer\u00eb pajisjesh konsumator\u00ebsh, nga smartphone-t e prodhuesve t\u00eb njohur (Apple, Xiaomi, Google, Samsung), te kolonat inteligjente (Amazon Echo, Amazon Kindle), kartat (Raspberry Pi 3) dhe piketat e aksesit pa tel (Huawei, ASUS, Cisco).<\/p>\n

Vulnerabiliteti shkaktohet nga trajtimi i pap\u00ebrshtatsh\u00ebm i \u00e7el\u00ebsave t\u00eb enkriptimit gjat\u00eb \u00e7aktivizimit (disociimit<\/a><\/noindex>) t\u00eb pajisjes nga pika e qasjes. Gjat\u00eb \u00e7aktivizimit, b\u00ebhet zerozimi i \u00e7el\u00ebsit t\u00eb sesionit t\u00eb ruajtur n\u00eb memorje n\u00eb \u00e7ip (PTK), pasi d\u00ebrgimi i m\u00ebtejsh\u00ebm i t\u00eb dh\u00ebnave n\u00eb k\u00ebt\u00eb seanc\u00eb nuk do t\u00eb kryhet. Thelbi i vulnerabilitetit \u00ebsht\u00eb se t\u00eb dh\u00ebnat q\u00eb mbeten n\u00eb tamponin e d\u00ebrgimit (TX) enkriptohen me nj\u00eb \u00e7el\u00ebs t\u00eb past\u00ebr, i cili p\u00ebrb\u00ebhet vet\u00ebm nga zerot dhe, p\u00ebr rrjedhoj\u00eb, mund t\u00eb dekodohen leht\u00ebsisht kur kapen. \u00c7el\u00ebsi bosh p\u00ebrdoret vet\u00ebm p\u00ebr t\u00eb dh\u00ebnat mbet\u00ebse n\u00eb tampon, i cili \u00ebsht\u00eb disa kilobyte i madh. <\/p>\n

Pra, sulmi bazohet n\u00eb d\u00ebrgimin artificial t\u00eb kadrove t\u00eb caktuara, q\u00eb shkaktojn\u00eb disociimin, dhe kapjen e t\u00eb dh\u00ebnave q\u00eb d\u00ebrgohen pas tyre. Disociimi zakonisht p\u00ebrdoret n\u00eb rrjetet pa tel p\u00ebr t\u00eb kaluar nga nj\u00eb pik\u00eb qasje n\u00eb nj\u00eb tjet\u00ebr gjat\u00eb roaming-ut ose kur humbet lidhja me pik\u00ebn aktuale t\u00eb qasjes. Disociimin mund ta shkaktoj\u00eb d\u00ebrgimi i nj\u00eb kadri menaxhues, i cili d\u00ebrgohet n\u00eb m\u00ebnyr\u00eb t\u00eb enkriptuar dhe nuk k\u00ebrkon autentifikim (sulmuesi duhet vet\u00ebm t\u00eb arrij\u00eb sinjalin e Wi-Fi, por nuk ka nevoj\u00eb p\u00ebr lidhje me rrjetin pa tel). Sulmi \u00ebsht\u00eb testuar vet\u00ebm duke p\u00ebrdorur protokollin WPA2, dhe nuk \u00ebsht\u00eb verifikuar n\u00ebse \u00ebsht\u00eb e mundur t\u00eb kryhet sulmi n\u00eb WPA3.<\/p>\n

\"Vulnerabilitet<\/a><\/noindex><\/center><\/p>\n

Sipas vler\u00ebsimeve paraprake, potencialisht kjo vulnerabilitet mund t\u00eb preki miliarda pajisjeve q\u00eb jan\u00eb n\u00eb p\u00ebrdorim. N\u00eb pajisjet me \u00e7ipa Qualcomm, Realtek, Ralink dhe Mediatek, problemi nuk shfaqet. Megjithat\u00eb, dekodimi i trafikut \u00ebsht\u00eb i mundur si kur nj\u00eb pajisje klienti e prekshme n\u00eb vulnerabilitet i qaset nj\u00eb pik\u00eb t\u00eb qasjes pa probleme, ashtu edhe n\u00eb rastin kur nj\u00eb pajisje e padiskutueshme i qaset nj\u00eb pike qasjeje ku shfaqet vulnerabiliteti. Shum\u00eb prodhues t\u00eb pajisjeve konsumator\u00ebve tashm\u00eb kan\u00eb l\u00ebshuar p\u00ebrdit\u00ebsime t\u00eb firmuerit p\u00ebr t\u00eb eliminuar vulnerabilitetin (p\u00ebr shembull, Apple e ka eliminuar<\/a><\/noindex> vulnerabilitetin q\u00eb n\u00eb tetor t\u00eb vitit t\u00eb kaluar). <\/p>\n

Duhet theksuar se vulnerabiliteti prek enkriptimin n\u00eb nivelin e rrjetit pa tela dhe lejon analizimin vet\u00ebm t\u00eb lidhjeve t\u00eb pambrojtura q\u00eb vendosen nga p\u00ebrdoruesi, por nuk ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb kompromentuar lidhjet me enkriptim n\u00eb nivelin e aplikacionit (HTTPS, SSH, STARTTLS, DNS mbi TLS, VPN etj.). Rreziku i sulmit gjithashtu zvog\u00eblohet nga fakti se sulmuesi mund t\u00eb dekodoj\u00eb vet\u00ebm disa kilobajt t\u00eb dh\u00ebnash n\u00eb nj\u00eb her\u00eb, t\u00eb cilat ishin n\u00eb tamponin e transmetimit gjat\u00eb shk\u00ebputjes. P\u00ebr t\u00eb kapur me sukses t\u00eb dh\u00ebnat konfidenciale q\u00eb d\u00ebrgohen p\u00ebrmes nj\u00eb lidhjeje t\u00eb pambrojtur, sulmuesi ose duhet t\u00eb dij\u00eb sakt\u00ebsisht momentin e d\u00ebrgimit, ose t\u00eb nis\u00eb vazhdimisht shk\u00ebputjen nga pika e qasjes, gj\u00eb q\u00eb do t\u00eb bie n\u00eb sy p\u00ebr p\u00ebrdoruesin p\u00ebr shkak t\u00eb rip\u00ebrtritjes t\u00eb vazhdueshme t\u00eb lidhjes pa tel.<\/p>\n

Disa nga pajisjet e testuara n\u00eb Eset p\u00ebr mund\u00ebsin\u00eb e sulmit jan\u00eb:<\/p>\n