Ko te Hukarere DNS Pouara me te Tauranga Whakamua UPnP Whakaaetanga: ISP Gateway e tohu ana ki nga Tūmau DNS Rogue, 30-30-30 ki te NVRAM Tautuhi Maamaa, me te DoH/DoT Whakamuna¶

Te whakatuwhera i to pona, waea atamai ranei i runga i to kaainga Wi-Fi iti-tari ranei ka kite i te rūpahu "Chrome / Windows Critical Update Required" pahū-ake, mata-waahi mauhere e tono ana mo to pouara, kupuhipa imeera ranei, NET::ERR_CERT_AUTHORITY_INVALID Ko nga whakatupato tiwhikete TLS i runga i nga paetukutuku peeke, i te kitenga ranei na to pouara WAN / DHCP Ko te whirihoranga kua tuhia wahangu ano kia tohu ki tetahi tangata kee DNS Wāhitau IP (kua whakatuwherahia ranei te maha o nga korero kore mana UPnP Ko nga ture tuku tauranga e whakaatu ana i o NAS, nga kamera me nga PC ki te ipurangi whanui) he tino whakararu i te taumata whatunga. Ina whakararue te kaikohuru i to pouara Wi-Fi, ISP ranei i te kuaha (Netgear, TP-Link, ASUS, Linksys, D-Link, MikroTik, Ubiquiti, Arris, Comcast Xfinity, AT&T BGW, BT Smart Hub), ka whakahaeretia e ratou te kuaha taunoa (192.168.1.1 ranei 192.168.0.1) mo nga taputapu kotahi i roto i to whare i te wa kotahi, tae atu ki nga iPhones, nga waea Android, nga pouaka whakaata Ataata, nga pona mahi, me nga tari IoT e kore e taea te whakauru i nga rorohiko wheori tawhito.

Ko te mea kino rawa atu, ko nga whanau malware hou o te pouara (VPNFilter, KV-Botnet, RaptorTrain, Volt Typhoon, ZuoRAT, Cyclops Blink, a GhostDNS) ka whakamahi i nga tikanga tohenga motuhake e rua: ko etahi ka whakarereke noa i te kore-kore NVRAM tautuhinga (DNS tūmau, CWMP / TR-069 whakahaere mamao, me UPnP ripanga) mā te Whakapae Tono Whakawhiti Pae (CSRF) he kupuhipa kaiwhakahaere taunoa ranei, i te wa e utaina ana nga putea botnets matatau ki roto /tmp RAM, tuhirua ranei te Linux MTD Nga wehewehenga kohiko SPI. Mo nga whatunga whai hononga me nga whakararu NAS, panui Ko te kaipahua DNS, te whirihora WAN pouara ISP, me te tinihanga i te tomokanga mauhere, kua taupatupatuhia te whare, te tari iti ranei NAS, DeadBolt ransomware, me te kati UPnP, a te whakapumau i nga pouara kaainga me nga taputapu IoT. Mēnā ka pā tō whakararu o te whatunga ki ngā taputapu waea waea hauora, ki nga punaha ora-a-tinana ranei, huri tonu ki nga raraunga pūkoro me te waea atu ki to nama whawhati tata (911 i te United States me Canada, 112 puta noa i te Kotahitanga o Europi, 999 i roto i te United Kingdom) tirohia to maatau raarangi ingoa tau ohorere.

Mahia tenei inaianei¶

1. Momotuhia o waea me o pona mai i te whatunga Wi-Fi kua taupatupatuhia, KAUA e paato "Update", "Install Certificate", ranei "Verify Account" i runga i tetahi pūtirotiro pahū-ake:
2. He aha te mea whakamate nga pahū-ake DNS nauhea: Ina tohuhia e te pouara i kahakina koe DHCP Kaiwhakatau DNS ki tetahi wahitau IP kino, ka pato i te ingoa rohe noa (ka tirohia ranei e to OS te hononga ma te msftconnecttest.com / captive.apple.com) ka anga atu to kaitirotiro ki tetahi kai-whakahaere e hautū ana ClickFix / Lumma Stealer / Whakahou Chrome rūpahu malware he wharangi takiuru ISP rūpahu ranei. Hurihia o waea atamai ki te pūkoro 5G/LTE tonu.
3. Toia te mono hiko ki te pouara mo te 60 hēkona TUATAHI (Stage-2 /tmp RAM Malware Flush), ka honoa he rorohiko pokekore kotahi ma te taura Ethernet (kua whakawetohia a Wi-Fi) hei tirotiro me te tautuhi ano i te pouara:
4. He aha te FBI i taunaki ai kia tere te hurihanga hiko: Ko te nuinga o nga poti pouara maha (VPNFilter, KV-Botnet, ZuoRAT) e kore e taea te tuhi i a raatau paatete hongi me nga taarua takawaenga ki te panui-anake iti SquashFS wehewehenga kohiko; engari, ka whakahaerehia e ratou te Waahanga 2 me te Waahanga 3 i roto i te ahua ohorere RAM (/tmp ranei /var/run). Ko te wetewete i te taura hiko mo te 60 hēkona ka mate tonu te kaikokoti i roto i te pukoro mahara kia taea ai e koe te uru humarie ki te wharangi kaiwhakahaere pouara ki te muru i te Waahanga 1 te tohe me te whakahou ano i te firmware.
5. ** Kia mohio ki te pono mo te "30-30-30 Hard Reset" vs. Modern Bootloader / NVRAM Factory Reset**:
6. Mo nga tekau tau, ka taunaki nga kaiarahi i te 30-30-30 reset (e pupuri ana i te kohao tautuhi mo te 30 hēkona ka whakakahangia, 30 hēkona ka wetewetehia, me te 30 hēkona i te wā e mono ana te hiko ki roto).
7. Mooni Hangarau: Te 30-30-30 he mea motuhake te wa ki te tuku iho Broadcom CFE (Common Firmware Environment) bootloaders rere DD-WRT. I te ao hou ARM a MIPS nga pouara e rere ana U-Boot (ASUS, TP-Link, Netgear, UniFi, GL.iNet), ko te wetewete i te hiko i te wa e pupuri ana i te paatene Tautuhi i te wa e whawhai ana ka maka te pouara ki roto Bootloader TFTP / Crashed Recovery aratau kaua ki te muru NVRAM.
8. Ki te wheketere-tautuhi NVRAM i runga i tetahi pouara hou: Waiho te taura hiko kia uru ki roto, ka whakaweto katoa te pouara, pehia me te pupuri i te waahi kei muri Reset patene pinea mo te 10 ki te 30 hēkona kia whiti nga rama rama o mua ki te amipere/whero ka whakaara ano te pouara, katahi ka tuku.
9. Whakaarohia te ahua hou o te wheketere firmware hou (.bin / .chk / .trx / .img) i tangohia mai i runga i te hononga pūkoro ma i mua i te hono ano i te WAN (Ipurangi) taura Itarangi:
10. Mena kei te wheketere koe ki te tautuhi i tetahi pouara i te wa e mahi ana WAN kei te hono tonu te tauranga ki te ipurangi a te iwi whanui, nga matawai botnet aunoa (Shodan / Censys whakangao ana i nga tuhinga whakamaarama papatipu WAN tauranga whakahaere 8080, 8443, 7547 TR-069, ranei UPnP SOAP) ka taea te whakamahi ano i te whakaraeraetanga, taunoa ranei admin/admin takiuru i roto i te 90 hēkona o te whakaara ano.
11. Tikiake i te kōnae mārō hou mā te whakamahi i te wāhiwera pūtau o tō waea i te tuatahi, wetekina te WAN taura mai i te pouara, mahi i te tautuhi wheketere, tuku i te konae firmware tuimotu ma 192.168.1.1, tautuhia he kupuhipa kaiwhakahaere 20-puāhua hou, ka katahi mono te WAN ka hoki mai te taura ipurangi.
12. ** Monokia UPnP (Universal Plug and Play), NAT-PMP, Remote WAN Management, a WPS i roto tonu i nga tautuhinga pouara**:
13. E iwa tekau paiheneti o nga taupatupatu tauranga-whakamua kare i mana ka tupu na UPnP ka whakahohea ma te taunoa i runga i nga pouara kaihoko: ka taea e tetahi TV atamai kua pangia, IoT kāmera, tuhinga tirotiro tirotiro ranei i to whatunga paetata ka tukuna he kore motuhēhē UPnP IGD SOAP tono XML (AddPortMapping) ki 192.168.1.1:1900 whakahau i te pouara ki te whakatuwhera i nga tauranga papaahi o waho ki to NAS o roto (port 5000/445) Windows PC ranei (port 3389 RDP).
14. ** Horoia te rohe DNS Cache a ARP Cache i runga ia Windows, Mac, iPhone, me nga taputapu Android, ka taea Encrypted DNS (DNS-over-HTTPS / DoH ranei DNS-over-TLS / DoT)**:
15. Ahakoa i muri i to whakatikanga i te pouara, ka haere tonu to rorohiko rorohiko me o waea ki te arataki waka ki nga wahitau IP o te kaitukino kia pau ra ano o ratou TTL DNS keteroki, ka pehia ranei e koe nga keteroki DNS OS me te tirotiro (ipconfig /flushdns).

Rakau whakatau: te tirotiro me te whakakore i te kaipahua DNS pouara, te whakararu UPnP ranei¶

A pee i tenei rerenga mahi mo te hunga tirotiro whatunga hei whakaū i te kahakina, te whakakore i te tohe, me te whakapakeke i to kuaha:

flowchart TD
    Start["Ko nga Whakatupato Hupatopa, Whakatupato Tiwhikete, Nga Pahū-Up Whakahou rūpahu, Te Waka Puturi/Kahakina ranei i runga Wi-Fi"] --> AuditDNS["STEP 1: Whakahaere 'nslookup google.com' & Tirohia te Pouara WAN/DHCP DNS IP + UPnP Tauranga Whakamua Ripanga"]

    AuditDNS --> IsHijacked{"Kei te Whakaatuhia e te Pouara nga IP DNS Tawahi Kaore i te Mohiotia, Ko te Tauranga UPnP Whakamua ranei?"}

    IsHijacked -->|"KORE: He Maemaa te DNS Pouara me nga Tauranga, KOTAHI anake te Pūrere He Whakahou"| LocalMalware["Ko te Whakaaetanga he waahi ki tera PC/Waea Kotahi -> Tirohia te Kōnae 'Kaihautu', Toronga Chrome Kino, Rogue Proxy/VPN Profile ranei"]

    IsHijacked -->|"Ae: Kua Hurihia te DNS Pouara, Whakatuwheratia te Whakahaere WAN, Nga Ture UPnP Rogue ranei kei reira"| UnplugWAN["STEP 2: Wewetehia te Waea WAN (Ipurangi) mai i te Pouara + Pouara-Porohiko Hiko mo te 60 Hekona ki te Horoi '/tmp' RAM Malware"]

    UnplugWAN --> EoLCheck{"Ko te Pouara he huarahi na te ISP, nau ake ranei te Pouara Hokohoko?"}

    EoLCheck -->|"Pouwhanga/Kaiwhakahaere ISP-Rihitia (Comcast, AT&T, Spectrum, BT, Wahine, Rogers)"| ISPGateway["1. Puritia a tinana ki te 15-30s. 2. Hurihia nga Kupuhipa Kaiwhakahaere & Wi-Fi + Monokia UPnP. 3. Mēnā kua taupatupatuhia te TR-069 / Firmware, Tonoa kia Whakawhitia Nga taputapu Koreutu i te Toa ISP"]

    EoLCheck -->|"Pouara Tauhokohoko: Ko te Tauira He Whakamutunga-o-te Ora (EoL / Karekau he Whakahoutanga Rorohiko i roto i te 2+ Tau)"| ReplaceRouter["Wewete i te moko me te whakakapi i nga pukoro: ka taumanutia ano nga ararere EoL i roto i nga haora o te hono ano ki te WAN."]

    EoLCheck -->|"Pouara Tauhokohoko: Tauira Tautoko kaha"| CleanReflash["1. Tikina Nga Roopu Whaimana Hou ki runga i te Hoapapa Pukoro Ma. 2. Purihia te Tautuhi Pinhole 15-30s (While Powered On & Offline). 3. Utu Whakamuna ma te Itarangi -> Monokia UPnP & WAN Kaiwhakahaere -> Tautuhi DoH/DoT Whakamuna"]

Wāhanga 1: Me pehea te whakamatau mena kua kahakina te teepu DNS, UPnP ranei o to pouara (Tirotiro Matapaki)¶

I mua i te muru i te pouara, kia 2 meneti ki te tirotiro he aha i whakarereke kia mohio ai koe mehemea i paihana noa te tangata whakaeke DNS (GhostDNS kāhua) ka tukuna atu ranei nga tauranga ki to whatunga o roto (UPnP / NAT pokanoa).

1. Te arotake i o tūmau DNS kaha mai i te raina whakahau (nslookup / scutil / resolvectl)¶

Whakatuwherahia he Kapeka, Tohu Whakahau ranei i runga i te rorohiko e hono ana ki te whatunga ka whakahaere: - ** Matapihi (Command Prompt / PowerShell):

ipconfig /all
nslookup example.com

scutil --dns | grep 'nameserver\[[0-9]*\]'

resolvectl status

Whakatauritehia te DNS Servers Wāhitau IP i whakahokia mai e to pouara ki tenei ripanga o nga whirihoranga tika me.

2. Te arotake i to Pouara UPnP a Port Forwarding / Virtual Server Ripanga¶

Ina takiuru koe ki te atanga whakahaere o to pouara (http://192.168.1.1, 192.168.0.1, 10.0.0.1, ranei 192.168.50.1), haere ki Advanced -> NAT Forwarding / Port Forwarding / UPnP: - Titiro ki te UPnP Portmap Table (nga riihi UPnP hohe): - Ka whakatuwherahia e nga papatohu petipeti tika mo te wa poto nga tauranga UDP teitei (penei i te UDP 3074 mo te Xbox/Call of Duty). - Nga tohu o te taupatupatu kaha: Ki te kite koe UPnP he ture tuku tauranga TCP waho ki Port 445 (SMB), Port 3389 (Windows Remote Desktop / RDP), Port 22 (SSH), Port 5000 / 5001 / 8080 (Synology / QNAP NAS), Port 554 (RTSP Security Cameras), ranei Port 1080 / 9050 (SOCKS5 Proxy Botnet), he kino kei roto i to whatunga (he WAN ranei UPnP SOAP exploit) kua werohia nga kohao ki roto i to papangaahi. - Tirohia hoki Advanced -> Security -> Remote Management (WAN Access) me Firewall -> DMZ: - Manatokohia tena Remote Management (Wāhi Tukutuku mai i WAN) kei MĀNO (OFF) me tera DMZ Host kei MĀNGA (Blank / 0.0.0.0). Ko nga kaitukino ka takahi i te pouara tata tonu ka huri Remote Management on Port 8080 / 8443 tuu ranei he IP o roto ki te DMZ kia hoki mai ratou ki roto i muri mai.

Wāhanga 2: Te whakakore i te pouara taahiraa-i-taahiraa, NVRAM te tautuhi, me te whakahou i te firmware tuimotu¶

Kaua rawa e takiuru noa ki te pouara kua taupatupatuhia me te momo 8.8.8.8 hoki ki roto i te pouaka DNS me te kore e tautuhi ano me te whakamaarama ano: mena ka whakatohia e te kaiwhaiwhai a cron mahi, whakarerekētia dnsmasq.conf, whakahohea TR-069 (CWMP) te whirihoranga-aunoa nauhea, te whakamahi ranei i te whakaraeraetanga whakaraeraetanga firmware, ka hoki mai ano te tautuhinga DNS rogue 10 meneti i muri mai.

Whakahaerehia tenei 6-taahiraa whakaora ruma ma:

Hipanga 1: Tikiake i te mārō mana hou me nga taputapu i mua i te momotu i te ipurangi¶

1. Ma te whakamahi i te ** atamai i runga i nga raraunga pūkoro** (kua whakawetohia a Wi-Fi) he rorohiko ranei kua herea ki te wahiwera pūkoro o to waea:
2. Titiro ki te whakapiri tinana kei raro o to pouara ka panuihia te Tauira Tauira ME te Whakahoutanga Pumanawa (Ver: 1.0, v2, v4.20). (Kia ana Hardware v1 mārō ki runga a v2 ka taea e te pouara te pereki.)
3. Haere tika ki te paetukutuku tautoko mana o te kaihanga (asus.com, tp-link.com, netgear.com, linksys.com, ui.com) me te tango i te ** firmware hou .zip pūranga** ki tō rorohiko.
4. Unuhia te .zip kōnae kia whai koe i te raw .bin, .chk, .trx, ranei .img kua reri te konae firmware i runga i to Papamahi.

Hipanga 2: Wehe i te pouara i te WAN (Ipurangi) me te rewharewha RAM¶

1. ** Wewetehia te WAN Tauera Itarangi** (te taura mai i to muka ONT pouwhanga taura ranei ki te puru/kowhai Internet / WAN tauranga i runga i to pouara).
2. Tangohia te katoa LAN Ko nga taura Ethernet engari mo tetahi pona/PC maa (kua whakawetohia tana Wi-Fi).
3. Tangohia te taura hiko o te pouara mai i te pakitara mo te 60 hēkona katoa: Ka whakakorea katoatia e tenei nga pūnga pūnga papahoa papahoa me te whakakore i nga kino o te Waahi-2/Waahi-3 e rere ana ki roto. /tmp RAM.

Hipanga 3: Mahia he taputapu tika NVRAM Tautuhi Tautuhi (He aha te karo 30-30-30 i runga i nga pouara hou)¶

1. Monohia te taura hiko o te pouara ki roto (pupuri te WAN taura ipurangi tangohia) me tatari kia 2 meneti katoa kia mutu te whakaohooho o te pouara.
2. Ma te whakamahi i te tope pepa, i te taputapu SIM-ejector ranei, pehia me te pupuri i te waahi kei muri Reset patene poroporo kei muri o te pouara:
3. ** Paerewa U-Boot / Pouara Linux Hou (ASUS, TP-Link, Netgear, Linksys, Ubiquiti, Synology, Eero)**: Puritia te Reset te paatene mo te 15 ki te 30 hēkona i te wa e whakakahangia ana te pouara tae noa ki te kimo tere nga rama LED katoa, ka huri ranei te amipere, katahi ka tuku i te paatene ka tatari kia 3 meneti kia whakaara ano te pouara me te muru. NVRAM wehewehenga.
4. ASUS Motuhake "Hard Factory Reset" (NVRAM + /jffs Muku Wehewehenga): Kei runga i nga pouara ASUS (RT-AX, RT-BE, GT-AX rangatū), ka taea e te malware, nga tuhinga nauhea ranei te huna ki roto i te /jffs wehewehenga kohiko e ora tonu ana i te tautuhi noa. Hei muru e rua NVRAM a /jffs i runga i te pouara ASUS:
   1. Whakawetohia te hiko o te pouara.
   2. Pēhia me te pupuri i te tinana WPS pātene (ehara i te paatene Tautuhi).
   3. I a koe e pupuri ana i te WPS pātene, huri te mana pouara ON.
   4. Kia mau tonu WPS mo te 15 hēkona tae noa ki te tiimata o te hiko hiko, katahi ka pouri/whakahou, ka tuku. Ka mahia e tenei he taumata taputapu NVRAM + /jffs ūkui.

Hipanga 4: Whakaohohia te firmware tuimotu ka maukati i te rererangi whakahaere¶

1. I runga i to rorohiko hono-Itarangi, whakatuwherahia he matapihi tirotiro motuhake/incognito ka haere ki te IP taunoa o te pouara (http://192.168.1.1, 192.168.0.1, ranei 192.168.50.1).
2. Whakaotia te ruānuku tatūnga tuatahi tuimotu ka tautuhia he ahua, 20-puāhua Kupuhipa Kaiwhakahaere (kaua rawa e whakamahi anō i tō kupuhipa Wi-Fi hei kupuhipa Kaiwhakahaere pouara).
3. Haere ki Administration / System -> Firmware Upgrade -> Manual / Local File Upload, tohua te konae firmware whaimana i tangohia e koe i te Hipanga 1, ka whakakorikoria. Ahakoa he rite te tau putanga ki te mea kua oti kee te whakauru, ka tuhiruahia te rootfs whakaahua pūnaha me te manatoko i te waitohu firmware cryptographic.
4. Kia whakaara ano te pouara i muri i te uira firmware, manatokohia enei 6 Tautuhinga Whakapakeke Whakaaetanga i mua i te hono ano i te taura ipurangi ki roto:
5. UPnP (Universal Plug and Play): Tautuhi ki DISABLED / OFF.
6. Remote Management (WAN Web Access / HTTPS from WAN / SSH from WAN): Tautuhi ki DISABLED / OFF.
7. TR-069 / CWMP (I runga i nga Pouara Hokohoko): Tautuhi ki DISABLED / OFF (mehemea ka hiahiatia e te kuaha ISP muka).
8. WPS (Wi-Fi Protected Setup PIN / Patene): Tautuhi ki DISABLED / OFF.
9. Wi-Fi Security: Tautuhi ki WPA3-Personal (ranei WPA2/WPA3-Personal AES; kore rawa WPA/TKIP ranei WEP) me te kīangahipa Wi-Fi hou.
10. WAN DNS Server: Tautuhi ā-ringa DNS Tuatahi ki 1.1.1.1 (Cloudflare) ranei 9.9.9.9 (Quad9 Malware-Aukati DNS) me te DNS Tuarua ki 1.0.0.1ranei 149.112.112.112 (me te whakahohe DNS-over-TLS / DoT i runga i te pouara mena ka tautokona).
11. Monohia te WAN (Ipurangi) taura hoki ki te pouara.

Wāhanga 3: Te horoi i nga keteroki DNS kawa ki runga i nga taputapu katoa me te whakahohe i te DNS Whakamuna (DoH / DoT)¶

Ahakoa kua 100 paiheneti te ma o to pouara, ko nga pona, papamahi, waea atamai ranei i honoa i te wa o te hopukina ka mau tonu rekoata DNS kawa (TTL tae atu ki te 7 ra), he rohe whakarereke hosts he konae, he puna puna turanga tirotiro paihana ranei.

Hipanga 1: Tirohia te rohe hosts konae me te horoi OS + Pūtirotiro DNS keteroki¶

1. Manatokohia kaore te malware i tuhi i nga urunga rūpahu ki te rohe o to rorohiko hosts kōnae:
2. Windows: Whakatuwherahia te Pukatuhi hei Kaiwhakahaere ka tuwhera C:\Windows\System32\drivers\etc\hosts. Ia raina i roto i te taunoa ma hosts me timata te konae ki te # (kōrero). Mukua tetahi mapi raina ingoa rohe tuturu (google.com, microsoft.com, pae peeke, rohe wheori ranei) ki nga wahitau IP rereke.
3. macOS / Linux: Taki cat /etc/hosts kei te Terminal.
4. Pahia nga keteroki DNS me te ARP Pūnaha Whakahaere:
5. ** Matapihi (Run Command Prompt as Administrator)**:

   ipconfig /flushdns
   ipconfig /release
   ipconfig /renew
   arp -d *
   

6. macOS (Terminal):

   sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
   

7. iPhone / iPad / Android: Tahuri Aratau Rererangi mo te 15 hēkona, ka whakawetohia, ka Wareware me te hono ano ki te whatunga Wi-Fi.
8. Flush Chrome, Edge, me te Toa Pūtirotiro Roto DNS me nga Keteroki Turanga:
9. Ko nga kaitirotiro Chromium e pupuri ana i o raatau ake keteroki DNS o roto i te motuhake o Windows/macOS.
10. Whakatuwheratia te Chrome, Edge, Brave ranei -> momo chrome://net-internals/#dns i roto i te pae wāhitau -> pāwhiri Clear host cache.
11. Panuku, pawhiria Sockets kei te paetaha maui (chrome://net-internals/#sockets) -> pāwhiri Close idle sockets me Flush socket pools.

Hipanga 2: Whakahohe DNS Whakamuna (DNS-over-HTTPS / DoH a DNS-over-TLS / DoT) kia KORE rawa e taea e te pouara te hopu ano i to DNS¶

DNS tawhito (UDP port 53) kaore i whakamunatia, karekau hoki i whakamotuhēhētia: ka taea e tetahi pouara whakararu, ISP, Wi-Fi toa kawhe, kuaha hotera ranei te haukoti i o tono tauranga 53 me te hanga whakautu rūpahu. Whakahohe DNS-over-HTTPS (DoH)ranei DNS-over-TLS (DoT) ka takai i o patai DNS ki roto TLS 1.3 whakamunatanga i manatokohia e te tiwhikete cryptographic, ko te tikanga ahakoa kua taumanutia to pouara, kaore e taea te panui, te whakarereke ranei i te rapu DNS kotahi:

Wāhanga 4: Te arotake i nga taputapu o roto i kitea i te wa UPnP i tuwhera (NAS, Cameras, a RDP)¶

Mēnā ka kitea e tō tātari pouara i te Wāhanga 1 he kare i whakamanahia UPnP tauranga whakamua (ranei DMZ te whakakitenga) kua kaha i mua i to tautuhi i te pouara, me manatoko koe karekau te hunga whakaeke i whakatu he turanga ki runga i tetahi taputapu o roto i te wa e tuwhera ana aua tauranga paahi:

1. Tirohia nga taputapu NAS o te Whare / Tari (Synology DiskStation, QNAP, TrueNAS):
2. Whakatuwherahia to paewhiri mana NAS -> Security Advisor / QuFirewall / Connection Logs.
3. Rapua nga nganatanga takiuru whakahaere i rahua, i angitu ranei mai i nga wahitau IP ke, nga kaute kaiwhakahaere hou i hanga, kua whakaritea ohorere ranei cron mahi.
4. I roto i nga tautuhinga NAS (Control Panel -> External Access -> Router Configuration), tangotaki aunoa katoa UPnP pouaka tatūnga pouara kia kore te NAS e ngana ki te whakatuwhera ano i nga tauranga pouara.
5. Tirohia nga PC Windows mo RDP (Port 3389) Korouru-Tauakina:
6. Mehemea TCP 3389 i puta mai i to pouara UPnP tepu, whakatuwhera Windows Kaitiro Takahanga (eventvwr.msc) -> Windows Logs -> Security me te tātari mo Event ID 4624 (Takiuru Angitu, Momo Takiuru 10 RemoteInteractive) me Event ID 4625 (Rahua Takiuru).
7. Monokia te Papamahi Mamao Windows (Settings -> System -> Remote Desktop -> OFF) ki te kore e tino uru atu na roto i tetahi VPN mata-a-hoa whakamunatia (Tailscale, WireGuard, ranei ZeroTier).
8. ** Wewetehia nga pouaka whakaata atamai, nga kamera IP, me nga taputapu IoT ki te Whatunga Wi-Fi Manuhiri (VLAN / AP Isolation)**:
9. Ko te nuinga o roto UPnP Ko nga whakararu o te pouara i ahu mai i tetahi kamera IoT iti, mono atamai, pouaka pouaka whakaata Android ranei i runga i to whatunga Wi-Fi matua e hono ana ki te botnet me te tuku. UPnP IGD whakahau ki 192.168.1.1.
10. Whakahohea te ** Whatunga Wi-Fi Manuhiri** o to pouara me Access Intranet / Allow guests to see each other and access my local network whakaturia ki OFF (Client Isolation), ka nukuhia nga pouaka whakaata Ataata katoa, nga kamera, nga miihini karetao, me nga taputapu atamai ki runga i tera SSID Manuhiri taratahi kia kore rawa e taea te korero ki te IP whakahaere LAN o to pouara (192.168.1.1) ranei o koutou pona mahi ano.

Pātai auau¶

Me pehea te hurihanga a te kaiwhakangungu i nga tautuhinga DNS i roto i taku pouara kaainga mena kaore ia e noho ana i taku whare i runga i taku Wi-Fi?¶

Ka whakararu te hunga whakaeke i nga pouara o te kaainga me te tari iti i tawhiti me te kore e tata ki to Wi-Fi ma te whakamahi i nga tikanga tuatahi e toru: (1) Whakapae Tono Whakawhiti Pae (CSRF) me te Rebinding DNS: Ka toro koe ki tetahi paetukutuku noa kei roto he tuhinga panui kino i a koe i runga i to rorohiko kaainga; ka tukuna marietia e taua tuhinga he tono HTTP POST mai i to kaitirotiro ki to pouara rohe (http://192.168.1.1/apply.cgi), a mena kei te whakamahi tonu to pouara i te kupuhipa taunoa (kaiwhakahaere / kaiwhakahaere ranei kaiwhakahaere / kupuhipa), ka tuhi ano te tuhinga i nga tūmau WAN DNS o to pouara i roto i te 1 hēkona. (2) Whakahaere WAN kitea ranei TR-069 (Tauranga 7547 / 8080 / 8443): Ka kitea e nga kaitirotiro ipurangi aunoa nga pouara me te Whakahaere Mamao ka waiho kia tuwhera, kaore ano kia whakaraeraehia nga whakaraeraetanga firmware, ka werohia nga whakahau mai i te ipurangi; me (3) UPnP Whakaaturanga WAN: Ko nga pouara tawhito, he whirihora pohehe ranei ka kitea i runga i to raatau UPnP SOAP daemon (tauranga 1900 / 5000) ki te atanga WAN, ka taea e tetahi i runga i te ipurangi te taapiri i nga ture tuku tauranga, whakarereke ranei Tautuhi DNSServer tautuhinga kore he kupuhipa.

He aha koe i kii ai ko te "30-30-30 Hard Reset" rongonui kaore e mahi i runga i nga pouara hou, ka raru pea?¶

Ko te 30-30-30 tautuhi ano (e pupuri ana i te Tautuhi mo te 30s me te hiko hiko, 30s me te hiko whakaweto, me te 30s i te wa e hoki ana te hiko) i tuhia 20 tau ki muri ake mo Kei te rere nga pouara Linksys WRT54G DD-WRT i runga Broadcom CFE nga kaieke boot. Tata ki nga pouara hou i hangaia i roto i nga tau 12 kua hipa (ASUS, TP-Hono, Netgear, Linksys Velop, UniFi, MikroTik), me te pupuri i te paatene Tautuhi tinana i te wa e hono ana i te taura hiko Ko te keu taputapu ki te aukati i te whawhai noa ka tomo Putatu TFTP Aratau Whakaora Firmware (kei reira te rama hiko e kimo ata ana e tatari ana mo te tūmau TFTP, a NVRAM ko kaore kua murua katoa). Hei horoi tika NVRAM hoki ki te wheketere taunoa i runga i tetahi pouara hou, kia mau tonu te waea hiko i te wa e tino whakaoho ana te pouara, pupurihia te kohao Tautuhi mo te 15 ki te 30 hēkona kia whiti nga rama, ka waiho kia whakaara ano i a ia ano.

Ki te mono ahau UPnP (Universal Plug and Play) i runga i taku pouara mo te haumarutanga, ka pakaru taku mahi waea a Zoom, rerema Netflix, tirotiro paetukutuku ranei?¶

Kao, whakakore UPnP kare he paanga ki a Zoom, Microsoft Teams, Netflix, YouTube, Slack, imeera, tirotiro paetukutuku ranei. Ka timata nga tono ipurangi paerewa katoa ki waho nga hononga mai i to taputapu ki te tūmau kapua, ko te Tirohanga Pakete Stateful a to pouara (SPI) Ka mau aunoa te papaahi NAT me te kore UPnP. Ko te anake nga mea e whakamahi ana UPnP he keemu papatohu a-hoa-ki-hoa (PlayStation, Xbox, Nintendo Whakawhiti e hautū ana i nga riipii), nga kiritaki BitTorrent, me nga tūmau manaaki-whaiaro (Plex) e ngana ana ki te whakaae kaore i tonohia ki roto hononga mai i nga tangata ke i runga ipurangi. Ka wehe atu UPnP tahuri WATE e taunaki ana e te NSA, CISA, a FBI na te mea ka aukati i nga taputapu IoT kino, kino ranei i roto i to kaainga ki te whakatuwhera puku i nga tauranga paahi ki te ipurangi whanui.

Ka pewhea mena ko taku pouara he ISP paheko pouwhanga/kuwaha (penei i te Comcast Xfinity xFi, AT&T BGW320, Spectrum ranei) a ka kore ahau e whakaae ki te huri i nga tūmau DNS, te firmware flash ranei?¶

He maha nga pouwhanga kuaha kua tukuna e te ISP e maukati ana i te WAN DNS mara i roto i te atanga tukutuku kia kore e taea e nga kaihoko te whakarereke, me te whakahaere i te firmware i runga anake i te upoko coaxial/muka a te ISP ma te Tuhinga ranei TR-069. Mena kei te whakaatu te keeti riihi-ISP i te whanonga DNS nauhea, te tauranga kore mana ranei ki te tuku whakamua: (1) Purihia te reanga tinana Tautuhi Anō kohao i te tuara o te kuwaha ISP mo 20 ki te 30 hēkona ki te akiaki i te tautuhi wheketere me te hou Tuhinga / ONT tango kōnae boot mai i to ISP; (2) Takiuru ki to taupānga pūkoro ISP (Xfinity, SmartHomeManager, Taku Spectrum) ki te huri i to kupuhipa kaute me te arotake i tetahi taupānga-whirihora Tauranga Whakamua; me (3) Whirihorahia DNS Whakamuna (DoH / DoT) tika i runga i o pona, waea, me nga kaitirotiro (penei i te waahanga 3 i runga ake nei), whakauruhia ranei te keeti ISP ki roto Aratau Piriti / Aratau Whakawhiti IP me te hono i to ake pouara hokohoko haumaru ki muri.

Nga kaiarahi e pa ana¶

• Ko te kaipahua DNS, te whirihora WAN pouara ISP, me te tinihanga i te tomokanga mauhere
• NAS whare, tari iti ranei kua taupatupatu (QNAP/Synology), DeadBolt ransomware, me te katinga whakamua tauranga UPnP
• Te whakamarumaru i nga pouara kaainga me nga taputapu IoT
• CAPTCHA rūpahu ClickFix PowerShell Win+R papatopenga pūmanawa kino me te Lumma infostealer whakaora
• Kore-ra te whakamahi i te papaki whawhati tata me te Wehenga o te Ora (EoL) taputapu
• Ko nga nama ohorere ma te whenua

Nga puna me nga aratohu whai mana¶

• Pokapü Haumaru Motu (NSA) me te Pokapü Haumaru Haumaru me te Hanganga (CISA Pepa Parongo Haumaru Haumaru Hononga - media.defense.gov): Nga Tikanga Pai mo te Haumaru i To Whatunga Kainga (Whakakore UPnP, WAN Administration, Legacy WPS, me te Whakakapi i nga Pouara SOHO Whakamutunga o te Ora).
• Federal Bureau of Investigation (FBI Panuitanga mo nga mahi a te iwi I-052518-PSA & KV-Botnet / RaptorTrain Nga Tohutohu): *Ko nga Kai-whakaari Cyber ​​Tahi e aro ana ki nga Pouara Kaainga me te Tari: Ka whakaara ano i te waa ki te Whakapai i nga Utu-2 RAM, Tautuhi Tautuhi, me te Kawa Whakapai Maama *.
• Ope Mahi Hangarau Ipurangi (IETF RFC 8484 - Uiui DNS mo HTTPS (DoH) & RFC 7858 - Whakaahua mo te DNS mo te Haumarutanga Layer Transport (DoT)): Motuhēhēnga Kuputuhi me te Tiaki Tikanga o te Resolution DNS Stub-to-Recursive.
• ASUS, Netgear, me TP-Link Tohutohu Haumarutanga Whaimana: Mauroro NVRAM a /jffs Wehenga Wehewehenga Tautuhi Nga tikanga vs. U-Boot / CFE TFTP Whakaora Whenua.