{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"Uppdatera RouterOS p\u00e5 din MikroTik","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Uppdatera
\nP\u00e5 kv\u00e4llen den 10 mars b\u00f6rjade Mail.ru:s support ta emot klagom\u00e5l fr\u00e5n anv\u00e4ndare om att de inte kunde ansluta till Mail.ru:s IMAP\/SMTP-servrar via e-postprogram. Vissa anslutningar gick inte igenom, medan andra visade certifikatfel. Felet orsakades av att \"servern\" gav ett sj\u00e4lvsignerat TLS-certifikat.
\n<\/a><\/noindex>\u00a0
\n\"Uppdatera
\nUnder tv\u00e5 dagar kom det in \u00f6ver 10 klagom\u00e5l fr\u00e5n anv\u00e4ndare fr\u00e5n olika n\u00e4tverk och med olika enheter, vilket gjorde det osannolikt att problemet l\u00e5g i n\u00e5gon enskild leverant\u00f6rs n\u00e4tverk. En mer detaljerad granskning av problemet visade att det skedde en f\u00f6rfalskning av imap.mail.ru-servern (liksom andra e-postservrar och tj\u00e4nster) p\u00e5 DNS-niv\u00e5. Vid vidare unders\u00f6kning, med aktiv hj\u00e4lp fr\u00e5n v\u00e5ra anv\u00e4ndare, fann vi att orsaken l\u00e5g i en felaktig post i cachen p\u00e5 deras router, som ocks\u00e5 fungerar som en lokal DNS-resolver, vilket i m\u00e5nga (men inte alla) fall visade sig vara en MikroTik-enhet, mycket popul\u00e4r i sm\u00e5 f\u00f6retagsn\u00e4tverk och hos sm\u00e5 internetleverant\u00f6rer.<\/p>\n

Vad \u00e4r problemet<\/h2>\n

\nI september 2019 uppt\u00e4ckte forskare fann <\/a><\/noindex>flera s\u00e5rbarheter i MikroTik RouterOS (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979) som m\u00f6jliggjorde DNS cache poisoning-attacker, dvs. m\u00f6jligheten att f\u00f6rfalska DNS-poster i routerns DNS-cache, d\u00e4r CVE-2019-3978 till\u00e5ter angriparen att initiera en s\u00e5dan beg\u00e4ran sj\u00e4lv via port 8291 (UDP och TCP) utan att v\u00e4nta p\u00e5 att n\u00e5gon i det interna n\u00e4tverket ska beg\u00e4ra en post p\u00e5 sin DNS-server. S\u00e5rbarheten \u00e5tg\u00e4rdades av MikroTik i versionerna RouterOS 6.45.7 (stabil) och 6.44.6 (l\u00e5ngsiktig) den 28 oktober 2019, men enligt unders\u00f6kningar <\/a><\/noindex>har majoriteten av anv\u00e4ndarna f\u00f6r n\u00e4rvarande inte installerat patcharna.<\/p>\n

Det \u00e4r tydligt att detta problem f\u00f6r n\u00e4rvarande utnyttjas aktivt \"i realtid\".<\/p>\n

Vad \u00e4r faran med detta<\/h2>\n

\nAngriparen kan f\u00f6rfalska DNS-posten f\u00f6r vilken v\u00e4rd som helst som en anv\u00e4ndare i det interna n\u00e4tverket kontaktar, och d\u00e4rmed avlyssna trafiken till den. Om k\u00e4nslig information \u00f6verf\u00f6rs utan kryptering (t.ex. via http:\/\/ utan TLS) eller om anv\u00e4ndaren g\u00e5r med p\u00e5 att acceptera ett falskt certifikat kan angriparen f\u00e5 tillg\u00e5ng till all data som skickas genom anslutningen, exempelvis inloggning eller l\u00f6senord. Tyv\u00e4rr visar erfarenheten att om anv\u00e4ndaren har m\u00f6jlighet att acceptera ett falskt certifikat kommer de att utnyttja den m\u00f6jligheten.<\/p>\n

Varf\u00f6r just SMTP- och IMAP-servrar, och vad skyddade anv\u00e4ndarna<\/h2>\n

\nVarf\u00f6r f\u00f6rs\u00f6kte angriparna f\u00e5nga SMTP\/IMAP-trafik fr\u00e5n e-postapplikationer ist\u00e4llet f\u00f6r webbtrafik, \u00e4ven om en stor del av anv\u00e4ndarna kommer \u00e5t e-posten via webbl\u00e4sare \u00f6ver HTTPS?<\/p>\n

Inte alla e-postprogram som anv\u00e4nder SMTP och IMAP\/POP3 skyddar anv\u00e4ndaren fr\u00e5n fel, genom att f\u00f6rhindra att denne skickar inloggning och l\u00f6senord \u00f6ver en os\u00e4ker eller komprometterad anslutning, trots att standarden RFC 8314<\/a><\/noindex>, antogs redan 2018 (och implementerades i Mail.ru mycket tidigare), borde de skydda anv\u00e4ndaren fr\u00e5n att l\u00f6senordet f\u00e5ngas \u00f6ver vilken os\u00e4ker anslutning som helst. Dessutom anv\u00e4nds protokollet OAuth mycket s\u00e4llan i e-postklienter (det st\u00f6ds av Mail.ru:s e-postservrar), och utan det \u00f6verf\u00f6rs inloggning och l\u00f6senord i varje session.<\/p>\n

Webbl\u00e4sare kan vara n\u00e5got b\u00e4ttre skyddade mot Man-in-the-Middle-attacker. P\u00e5 alla kritiska dom\u00e4ner mail.ru har vi dessutom aktiverat HSTS-policy (HTTP strict transport security) ut\u00f6ver HTTPS. Med HSTS aktiverat ger moderna webbl\u00e4sare anv\u00e4ndaren inte en enkel m\u00f6jlighet att acceptera ett falskt certifikat, \u00e4ven om anv\u00e4ndaren skulle vilja. F\u00f6rutom HSTS har anv\u00e4ndarna skyddats av det faktum att sedan 2017 har SMTP-, IMAP- och POP3-servrarna fr\u00e5n Mail.ru f\u00f6rbjudit \u00f6verf\u00f6ring av l\u00f6senord \u00f6ver os\u00e4kra anslutningar; alla v\u00e5ra anv\u00e4ndare har anv\u00e4nt TLS f\u00f6r \u00e5tkomst via SMTP, POP3 och IMAP, och d\u00e4rf\u00f6r kan inloggning och l\u00f6senord endast f\u00e5ngas om anv\u00e4ndaren sj\u00e4lv g\u00e5r med p\u00e5 att acceptera ett manipulerat certifikat.<\/p>\n

F\u00f6r mobila anv\u00e4ndare rekommenderar vi alltid att anv\u00e4nda Mail.ru-appar f\u00f6r att f\u00e5 \u00e5tkomst till e-posten, eftersom det \u00e4r s\u00e4krare att arbeta med e-post i dem \u00e4n i webbl\u00e4sare eller inbyggda SMTP\/IMAP-klienter.<\/p>\n

Vad som beh\u00f6ver g\u00f6ras<\/h2>\n

\nDet \u00e4r n\u00f6dv\u00e4ndigt att uppdatera firmware f\u00f6r MikroTik RouterOS till en s\u00e4ker version. Om detta av n\u00e5gon anledning inte \u00e4r m\u00f6jligt, m\u00e5ste trafiken filtreras efter port 8291 (tcp och udp), vilket g\u00f6r det sv\u00e5rare att utnyttja problemet, \u00e4ven om det inte eliminerar m\u00f6jligheten f\u00f6r passiv injektion i DNS-cache. Internetleverant\u00f6rer b\u00f6r filtrera denna port i sina n\u00e4tverk f\u00f6r att skydda f\u00f6retagsanv\u00e4ndare.\u00a0<\/p>\n

Alla anv\u00e4ndare som accepterat det manipulerade certifikatet b\u00f6r omedelbart byta l\u00f6senord f\u00f6r e-post och andra tj\u00e4nster f\u00f6r vilka detta certifikat accepterades. Vi kommer ocks\u00e5 att informera anv\u00e4ndare som loggar in p\u00e5 e-posten via s\u00e5rbara enheter.<\/p>\n

P.S. Det finns en relaterad s\u00e5rbarhet som beskrivs i inl\u00e4gget LukaSafonov<\/a><\/noindex> "Backport s\u00e5rbarhet i RouterOS hotar hundratusentals enheter<\/a><\/noindex>\".
\n
K\u00e4lla: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uppdatera RouterOS p\u00e5 din MikroTik | ProHoster","description":"P\u00e5 kv\u00e4llen den 10 mars b\u00f6rjade Mail.ru:s support.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}