Mathy Vanhoef, sengoli sa tlhaselo ea KRACK ho marang-rang a se nang mohala, o senotse tlhahisoleseling mabapi le bofokoli ba 12 bo amang lisebelisoa tse fapaneng tse se nang mohala. Mathata a khethiloeng a hlahisoa tlas'a lebitso la khoutu FragAttacks 'me a koahela hoo e batlang e le likarete tsohle tse se nang mohala le lintlha tsa ho fihlella tse sebelisoang - ho lisebelisoa tse 75 tse lekiloeng, e' ngoe le e 'ngoe e ne e ka hlaseloa ke bonyane e' ngoe ea mekhoa ea tlhaselo e reriloeng.
Mathata a arotsoe ka mekhahlelo e 'meli: bofokoli ba 3 bo ile ba khetholloa ka ho toba ho litekanyetso tsa Wi-Fi le ho koahela lisebelisoa tsohle tse tšehetsang litekanyetso tsa hona joale tsa IEEE 802.11 (mathata a 'nile a lateloa ho tloha ka 1997). Bofokoli ba 9 bo amana le liphoso le mefokolo ts'ebetsong e khethehileng ea li-stacks tse se nang mohala. Kotsi e ka sehloohong e emeloa ke sehlopha sa bobeli, kaha ho hlophisa litlhaselo ka mefokolo ea litekanyetso ho hloka ho ba teng ha maemo a itseng kapa ho etsa liketso tse itseng ke motho ea hlokofalitsoeng. Bofokoli bohle bo etsahala ho sa tsotelehe melaoana e sebelisoang ho netefatsa ts'ireletso ea Wi-Fi, ho kenyelletsa le ha o sebelisa WPA3.
Boholo ba mekhoa ea tlhaselo e khethiloeng e lumella mohlaseli ho kenya liforeimi tsa L2 sebakeng sa marang-rang a sirelelitsoeng, e leng se etsang hore ho khonehe ho kenella sephethephetheng sa motho ea hlasetsoeng. Boemo ba sebele ba tlhaselo ke ho senya likarabo tsa DNS ho lebisa mosebelisi ho motho ea hlaselang. Mohlala o boetse o fanoe oa ho sebelisa bofokoli ho feta mofetoleli oa aterese ho router e se nang mohala le ho hlophisa phihlello e tobileng ea sesebelisoa marang-rang a lehae kapa ho hlokomoloha lithibelo tsa firewall. Karolo ea bobeli ea bofokoli, e amanang le ts'ebetso ea liforeimi tse arohaneng, e etsa hore ho khonehe ho ntša lintlha tse mabapi le sephethephethe ho marang-rang a se nang mohala le ho thibela data ea mosebedisi e fetisitsoeng ntle le ho ngoloa.
Mofuputsi o lokiselitse pontšo e bontšang kamoo bofokoli bo ka sebelisoang kateng ho thibela phasewete e fetisitsoeng ha u kena sebakeng sa marang-rang ka HTTP ntle le encryption.E boetse e bontša mokhoa oa ho hlasela socket e bohlale e laoloang ka Wi-Fi le ho e sebelisa e le sethala sa ho tsoela pele ho hlasela. ka lisebelisoa tse sa ntlafatsoang marang-rang a lehae a nang le mefokolo e sa lokisoang (mohlala, ho ne ho ka khoneha ho hlasela komporo e sa ntlafatsoang ka Windows 7 marang-rang a ka hare ka NAT traversal).
Ho sebelisa bofokoli, mohlaseli o tlameha ho ba sebakeng se lekanang le sesebediswa sa waelese se shebiloeng ho romela sete ea liforeimi tse entsoeng ka mokhoa o khethehileng ho mohlaseluoa. Mathata a ama lisebelisoa tsa bareki le likarete tse se nang mohala, hammoho le libaka tsa phihlello le li-routers tsa Wi-Fi. Ka kakaretso, ho sebelisa HTTPS hammoho le ho patala sephethephethe sa DNS ho sebelisa DNS holim'a TLS kapa DNS holim'a HTTPS ho lekane e le mokhoa oa ho sebetsa. Ho sebelisa VPN ho boetse ho loketse bakeng sa tšireletso.
Tse kotsi ka ho fetesisa ke likotsi tse 'ne ts'ebetsong ea lisebelisoa tse se nang mohala, tse lumellang mekhoa e sa reng letho ho fihlela sebaka sa liforeimi tsa tsona tse sa ngolisoang:
- Vulnerabilities CVE-2020-26140 le CVE-2020-26143 li lumella ho kenngoa ha foreimi libakeng tse ling tsa phihlello le likarete tse se nang mohala ho Linux, Windows, le FreeBSD.
- Vulnerability VE-2020-26145 e lumella likhechana tsa phatlalatso tse sa ngolisoang hore li sebetsoe e le liforeimi tse felletseng ho macOS, iOS le FreeBSD le NetBSD.
- Vulnerability CVE-2020-26144 e lumella ho sebetsa ha liforeimi tse sa ngolisoang tsa A-MSDU tse sa ngolisoang ka EtherType EAPOL ho Huawei Y6, Nexus 5X, FreeBSD le LANCOM AP.
Bofokoli bo bong ts'ebetsong bo amana haholo le mathata a hlahang ha ho etsoa liforeimi tse arohaneng:
- CVE-2020-26139: E lumella ho tsamaisoa ha liforeimi tse nang le folakha ea EAPOL e rometsoeng ke motho ea romelloang ea sa netefatsoang (e ama lintlha tse 2/4 tse tšepahalang tsa phihlello, hammoho le tharollo ea NetBSD le FreeBSD).
- CVE-2020-26146: e lumella ho bokelloa ha likhechana tse patiloeng ntle le ho hlahloba tatellano ea nomoro ea tatellano.
- CVE-2020-26147: E lumella ho bokelloa ha likhechana tse kopaneng tse patiloeng le tse sa ngolisoang.
- CVE-2020-26142: E lumella liforeimi tse arohaneng hore li tšoaroe joalo ka liforeimi tse felletseng (e ama OpenBSD le module ea waelese ea ESP12-F).
- CVE-2020-26141: Cheko ea TKIP MIC ha e eo bakeng sa liforeimi tse arohaneng.
Mathata a Khethehileng:
- CVE-2020-24588 - tlhaselo ea liforeimi tse kopantsoeng (folakha ea "e kopantsoeng" ha e sireletsehe 'me e ka nkeloa sebaka ke mohlaseli ho liforeimi tsa A-MSDU ho WPA, WPA2, WPA3 le WEP). Mohlala oa tlhaselo e sebelisitsoeng ke ho fetisetsa mosebelisi ho seva e mpe ea DNS kapa traversal ea NAT.
- CVE-2020-245870 ke tlhaselo ea bohlokoa ea ho kopanya (ho lumella likhechana tse patiloeng ho sebelisoa linotlolo tse fapaneng ho WPA, WPA2, WPA3 le WEP ho kopanngoa hape). Tlhaselo e u lumella ho tseba lintlha tse rometsoeng ke moreki, mohlala, ho tseba litaba tsa Cookie ha u kena ka HTTP.
- CVE-2020-24586 ke tlhaselo ea sekhechana sa cache (litekanyetso tse koahelang WPA, WPA2, WPA3 le WEP ha li hloke hore ho tlosoe likhechana tse seng li kentsoe ka har'a cache kamora khokahano e ncha ea marang-rang). E u lumella ho fumana lintlha tse rometsoeng ke moreki le ho kenya data ea hau sebakeng.
Ho lekola boemo ba ts'oaetso ea lisebelisoa tsa hau mathateng, ho se ho lokisitsoe sephutheloana se khethehileng sa lisebelisoa le setšoantšo sa Live se lokiselitsoeng ho theha drive ea bootable ea USB. Ho Linux, mathata a hlaha ho mac80211 mesh ea waelese, li-driver tse se nang mohala, le firmware e kentsoeng likareteng tse se nang mohala. Ho felisa bofokoli, ho entsoe tlhahiso ea li-patches tse koahelang mac80211 stack le bakhanni ba ath10k/ath11k. Lisebelisoa tse ling, joalo ka likarete tsa Intel wireless, li hloka ntlafatso ea firmware.
Liteko tsa lisebelisoa tse tloaelehileng:
Liteko tsa likarete tse se nang mohala ho Linux le Windows:
Liteko tsa likarete tse se nang mohala ho FreeBSD le NetBSD:
Baetsi ba ile ba tsebisoa ka mathata likhoeling tse 9 tse fetileng. Nako e telele joalo ea thibelo e hlalosoa ke ho hlophisoa ho hokahaneng ha lintlafatso le ho lieha ha ho lokisoa ha liphetoho ho litlhaloso ke mekhatlo ea ICASI le Wi-Fi Alliance. Qalong, ho ne ho reriloe ho senola tlhahisoleseding ka la 9 March, empa, ka mor'a ho bapisa likotsi, ho ile ha etsoa qeto ea ho chechisa khatiso bakeng sa likhoeli tse ling tse peli e le hore ho fanoe ka nako e eketsehileng ea ho lokisetsa li-patches, ho nahanela maemo a sa reng letho a liphetoho. ho etsoa le mathata a hlahang ka lebaka la seoa sa COVID-19.
Hoa hlokomeleha hore leha ho na le embargo, Microsoft e ile ea lokisa bofokoli bo bong pele ho kemiso ho ntlafatso ea Windows ea Hlakubele. Phatlalatso ea tlhahisoleseling e ile ea chechisoa beke pele ho letsatsi le neng le reriloe pele 'me Microsoft e ne e se na nako kapa e sa batle ho etsa liphetoho ho ntlafatso e reriloeng e loketseng ho phatlalatsoa, e leng se ileng sa baka tšokelo ho basebelisi ba lits'ebetso tse ling, kaha bahlaseli ba ne ba ka fumana leseli bofokoli ka boenjiniere bo khutlisang likahare tsa lintlafatso.
Source: opennet.ru