{"id":119766,"date":"2024-09-12T03:43:01","date_gmt":"2024-09-12T01:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom"},"modified":"2024-09-12T03:43:01","modified_gmt":"2024-09-12T01:43:01","slug":"popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","title":{"rendered":"F\u00f6rs\u00f6k att f\u00e5 TLS-certifikat f\u00f6r andra dom\u00e4ner mobi, med hj\u00e4lp av en utg\u00e5tt dom\u00e4n med WHOIS-tj\u00e4nst","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskare fr\u00e5n f\u00f6retaget watchTowr Labs har publicerat resultaten av ett experiment med att f\u00e5nga en gammal WHOIS-tj\u00e4nst fr\u00e5n registratorn f\u00f6r dom\u00e4nzonen .MOBI. Anledningen till forskningen var att registratorn \u00e4ndrade adressen f\u00f6r WHOIS-tj\u00e4nsten, flyttade den fr\u00e5n dom\u00e4nen whois.dotmobiregistry.net till den nya v\u00e4rden whois.nic.mobi. Samtidigt slutade dom\u00e4nen dotmobiregistry.net att anv\u00e4ndas och blev tillg\u00e4nglig f\u00f6r registrering i december 2023. <\/p>\n

Forskarna spenderade 20 dollar och k\u00f6pte denna dom\u00e4n, varefter de startade sin egen falska WHOIS-tj\u00e4nst whois.dotmobiregistry.net p\u00e5 sin server. Det var f\u00f6rv\u00e5nande att m\u00e5nga system inte bytte till den nya v\u00e4rden whois.nic.mobi och fortsatte att anv\u00e4nda det gamla namnet. Fr\u00e5n den 30 augusti till den 4 september i \u00e5r registrerades 2,5 miljoner f\u00f6rfr\u00e5gningar med det gamla namnet, skickade fr\u00e5n mer \u00e4n 135 000 unika system. <\/p>\n

Bland avs\u00e4ndarna av f\u00f6rfr\u00e5gningar fanns posttj\u00e4nster servrar<\/a> fr\u00e5n statliga och milit\u00e4ra organisationer som kontrollerade de dom\u00e4ner som n\u00e4mns i e-post genom WHOIS, f\u00f6retag och plattformar specialiserade p\u00e5 s\u00e4kerhet (VirusTotal, Group-IB), samt certifikatdom\u00e4ner, dom\u00e4ntj\u00e4nster, SEO-tj\u00e4nster och dom\u00e4nregistratorer (t.ex. domain.com, godaddy.com, who.is, whois.ru, smallseo.tools, seocheki.net, centralops.net, name.com, urlscan.io och webchart.org). <\/p>\n

M\u00f6jligheten att skicka vilken information som helst som svar p\u00e5 en beg\u00e4ran till den gamla WHOIS-tj\u00e4nsten f\u00f6r dom\u00e4nzonen .MOBI har anv\u00e4nts f\u00f6r att utveckla flera typer av attacker mot avs\u00e4ndarna av f\u00f6rfr\u00e5gningar. Den f\u00f6rsta attacktypen baserades p\u00e5 antagandet att om n\u00e5gon forts\u00e4tter att skicka f\u00f6rfr\u00e5gningar till en l\u00e4nge ersatt tj\u00e4nst, s\u00e5 g\u00f6r de det troligen med hj\u00e4lp av f\u00f6r\u00e5ldrad programvara som inneh\u00e5ller s\u00e5rbarheter. <\/p>\n

Till exempel, i phpWHOIS uppt\u00e4cktes en s\u00e5rbarhet CVE-2015-5243 \u00e5r 2015, vilket g\u00f6r det m\u00f6jligt f\u00f6r angriparen att exekvera kod vid tolkning av speciellt formatterad data som returnerades av WHOIS-servern. Ett annat exempel \u00e4r den s\u00e5rbarhet som uppt\u00e4cktes \u00e5r 2021, CVE-2021-32749, i paketet Fail2Ban, som m\u00f6jligg\u00f6r exekvering av extern kod vid \u00e5terl\u00e4mnande av felaktiga data fr\u00e5n WHOIS-tj\u00e4nsten som anv\u00e4nds vid skapandet av en blockering varning (Fail2Ban identifierade via WHOIS administratorns e-post och angav den vid k\u00f6rning av mail-kommandot utan korrekt escaping av specialtecken). <\/p>\n

Den andra attacken baseras p\u00e5 att vissa certifikatutf\u00e4rdare erbjuder m\u00f6jlighet till verifiering av dom\u00e4n\u00e4garskap via e-post som anges i registratorns databas, som \u00e4r tillg\u00e4nglig via WHOIS-protokollet. Det visade sig att flera certifikatutf\u00e4rdare som st\u00f6djer denna verifieringsmetod forts\u00e4tter att anv\u00e4nda den gamla WHOIS-servern f\u00f6r dom\u00e4nzonen .MOBI. <\/p>\n

D\u00e4rmed, genom att f\u00e5 kontroll \u00f6ver namnet whois.dotmobiregistry.net, kan angriparna \u00e5terl\u00e4mna sina data, genomf\u00f6ra bekr\u00e4ftelse och f\u00e5 TLS-certifikat<\/a> f\u00f6r vilken dom\u00e4n som helst inom .MOBI-zonen. Till exempel, under experimentet beg\u00e4rde forskarna ett GlobalSign TLS-certifikat f\u00f6r dom\u00e4nen microsoft.mobi och den e-postadress som returnerades av den falska WHOIS-tj\u00e4nsten, \"whois@watchTowr.com\", visades i gr\u00e4nssnittet som tillg\u00e4nglig f\u00f6r att skicka bekr\u00e4ftelsekoden f\u00f6r dom\u00e4n\u00e4garskapet.

\"F\u00f6rs\u00f6k<\/center>
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0433\u043e WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b «.MOBI». \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0443\u0436\u0438\u043b\u043e \u0442\u043e, \u0447\u0442\u043e \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u043f\u043e\u043c\u0435\u043d\u044f\u043b \u0430\u0434\u0440\u0435\u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u043f\u0435\u0440\u0435\u043c\u0435\u0441\u0442\u0438\u0432 \u0435\u0433\u043e \u0441 \u0434\u043e\u043c\u0435\u043d\u0430 whois.dotmobiregistry.net \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0445\u043e\u0441\u0442 whois.nic.mobi. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043e\u043c\u0435\u043d dotmobiregistry.net \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438 \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2023 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d \u0438 \u0441\u0442\u0430\u043b \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0442\u0440\u0430\u0442\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":119767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47F\u00f6rs\u00f6k att f\u00e5 TLS-certifikat f\u00f6r andras mobi-dom\u00e4ner genom att anv\u00e4nda en utg\u00e5ngen dom\u00e4n med WHOIS-tj\u00e4nst | ProHoster","description":"Forskare fr\u00e5n watchTowr Labs publicerade resultaten av ett experiment med att f\u00e5nga en f\u00f6r\u00e5ldrad WHOIS-tj\u00e4nst fr\u00e5n registratorn f\u00f6r dom\u00e4nzonen \".MOBI\".","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0434\u043b\u044f \u0447\u0443\u0436\u0438\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 mobi, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u043e\u0441\u0440\u043e\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u043c\u0435\u043d \u0441 WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 watchTowr Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u0437\u0430\u0445\u0432\u0430\u0442\u043e\u043c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0435\u0433\u043e WHOIS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b ".MOBI".","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/popytka-polucheniya-tls-sertifikatov-dlya-chuzhih-domenov-mobi-ispolzuya-prosrochennyj-domen-s-whois-servisom","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-09-12T01:43:01+00:00","article:modified_time":"2024-09-12T01:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:33:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:28:23","updated":"2026-02-09 17:33:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/119766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=119766"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/119766\/revisions"}],"predecessor-version":[{"id":159214,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/119766\/revisions\/159214"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/119767"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=119766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=119766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=119766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}