Kubera kwa Router DNS ndi Kusokoneza Port Forwarding UPnP: Chipata cha ISP Cholozera ku Ma seva a Rogue DNS, 30-30-30 vs. NVRAM Hard Reset, ndi Encrypted DoH/DoT¶

Kutsegula laputopu yanu kapena foni yam'manja kunyumba kwanu kapena Wi-Fi yaing'ono yamaofesi kuti muwone zabodza "Chrome / Windows Critical Update Required" pop-ups, zowonekera-portal screens kufunsa rauta yanu kapena imelo achinsinsi, NET::ERR_CERT_AUTHORITY_INVALID Chenjezo la satifiketi ya TLS pamawebusayiti akubanki, kapena kuzindikira kuti rauta yanu WAN / DHCP kasinthidwe adalembedwanso mwakachetechete kuloza kwa mlendo wankhanza DNS IP adilesi (kapena yatsegula ambiri osaloledwa UPnP malamulo otumizira madoko omwe amawulula NAS, makamera, ndi ma PC anu pa intaneti ya anthu onse) ndikosokoneza kwambiri pa intaneti. Wowukira akasokoneza rauta yanu ya Wi-Fi kapena chipata cha ISP (Netgear, TP-Link, ASUS, Linksys, D-Link, MikroTik, Ubiquiti, Arris, Comcast Xfinity, AT&T BGW, BT Smart Hub), amawongolera njira yolowera (192.168.1.1 kapena 192.168.0.1) ya chida chilichonse mnyumba mwanu nthawi imodzi, kuphatikiza ma iPhones, mafoni a Android, ma Smart TV, ma laputopu akuntchito, ndi ma IoT malo omwe sangathe kukhazikitsa mapulogalamu amtundu wa antivayirasi.

Choyipa kwambiri, mabanja amakono a pulogalamu yaumbanda (VPNFilter, KV-Botnet, RaptorTrain, Volt Typhoon, ZuoRAT, Cyclops Blink,ndi GhostDNS) gwiritsani ntchito njira ziwiri zolimbikira: zina zimangosintha zosasunthika NVRAM makonda (DNS seva, CWMP / TR-069 kasamalidwe kakutali, ndi UPnP matebulo) kudzera pa Cross-Site Request Forgery (CSRF) kapena mapasiwedi okhazikika a admin, pomwe ma botnet apamwamba amalipira mkati /tmp RAM kapena lembani Linux MTD SPI flash partitions. Pazokhudzana ndi netiweki ndi kusagwirizana kwa NAS, werengani DNS hijacking, ISP rauta WAN reconfiguration, ndi wogwidwa portal spoofing, kusokoneza nyumba kapena ofesi yaying'ono NAS, DeadBolt ransomware, ndi UPnP shutoff,ndi kuteteza ma routers apanyumba ndi zida za IoT. Ngati kusokoneza maukonde anu kumakhudza zida za telemetry zachipatala kapena machitidwe oteteza moyo, sinthani nthawi yomweyo ku data yam'manja ndikuyimbira nambala yanu yadzidzidzi yakuderalo (911 ku United States ndi Canada, 112 ku European Union, 999 ku United Kingdom) kapena onani chikwatu chathu cha manambala angozi.

Chitani izi tsopano¶

1. Lumikizani mafoni anu ndi laputopu kuchokera pa netiweki ya Wi-Fi yomwe yasokonekera nthawi yomweyo ndipo MUSADANIZE "Update", "Install Certificate", kapena "Verify Account" pa msakatuli aliyense pop-up:
2. **Chifukwa chiyani ma pop-ups achinyengo a DNS ali owopsa **: Routa yobedwa ikalozera DHCP DNS solver ku adilesi yoyipa ya IP, ndikulemba dzina lodziwika bwino (kapena OS yanu ikayang'ana kulumikizidwa kudzera msftconnecttest.com / captive.apple.com) imalozera msakatuli wanu ku seva yomwe imayendetsedwa ndi owukira ClickFix / Lumma Stealer / Fake Chrome Update pulogalamu yaumbanda kapena tsamba labodza la ISP lolowera. Sinthani mafoni anu kukhala ma cellular 5G/LTE nthawi yomweyo.
3. Kokani pulagi yamagetsi pa rauta kwa masekondi 60 POYAMBA (Stage-2 /tmp RAM Malware Flush), kenako polumikizani kompyuta imodzi yoyera kudzera pa chingwe cha Efaneti (chokhala ndi Wi-Fi yozimitsa) kuti muyang'ane ndikukhazikitsanso rauta:
4. Chifukwa chiyani FBI imalimbikitsa kuzungulira kwamagetsi nthawi yomweyo: Mabotolo ambiri a router multistage (VPNFilter, KV-Botnet, ZuoRAT) sangathe kulemba mapaketi awo akuluakulu akununkhiza ndi ma proxy binaries kuti awerenge pokha SquashFS flash partitions; m'malo mwake, amayendetsa Gawo 2 ndi Gawo 3 mosakhazikika RAM (/tmp kapena /var/run). Kutulutsa chingwe chamagetsi kwa masekondi 60 nthawi yomweyo kumapha cholumikizira chapaketi chokumbukira kuti muthe kulowa patsamba loyang'anira rauta kuti mufufute kulimbikira kwa Gawo 1 ndikuwunikiranso firmware.
5. ** Dziwani zowona za "30-30-30 Hard Reset" motsutsana ndi Zamakono Bootloader / NVRAM Factory Reset**:
6. Kwa zaka zambiri, owongolera adalimbikitsa 30-30-30 reset (kugwirizira pinhoo yokhazikitsiranso kwa masekondi 30 yoyatsidwa, masekondi 30 osalumikizidwa, ndi masekondi 30 ndikulowetsanso mphamvu).
7. Zowona zaukadaulo: The 30-30-30 nthawi inali yeniyeni ya cholowa ** Broadcom CFE (Common Firmware Environment) ma bootloaders akuthamanga DD-WRT**. Pa zamakono ARM ndi MIPS ma routers akuthamanga U-Boot (ASUS, TP-Link, Netgear, UniFi, GL.iNet), kutulutsa mphamvu ndikugwira batani la Bwezeretsani panthawi ya boot kumaponyera rauta mu ** Bootloader TFTP / Crashed Recovery mode ** osati kupukuta NVRAM.
8. Kukhazikitsanso fakitale NVRAM pa rauta iliyonse yamakono: **siyani chingwe chamagetsi cholumikizidwa ndipo rautayo itayamba kale **, kanikizani ndikugwira chokhazikika Reset batani la pinhobo mosalekeza kwa masekondi 10 mpaka 30 mpaka nyali zonse zakutsogolo za LED zikuwunikira amber/zofiyira ndipo rauta iyambiranso, ndikumasula.
9. ** Onetsaninso chithunzi chaposachedwa kwambiri cha firmware ya fakitale (.bin / .chk / .trx / .img) idatsitsidwa pa intaneti yoyera MUSANALUMIKIZE WAN (Intaneti) Chingwe cha Efaneti**:
10. Ngati mutakhazikitsanso fakitale ya rauta nthawi yake WAN doko likadali lolumikizidwa pa intaneti ya anthu onse, makina ojambulira a botnet (Shodan / Censys kutsata zolemba za anthu ambiri WAN madoko oyang'anira 8080, 8443, 7547 TR-069, kapena UPnP SOAP) angagwiritsenso ntchito chiwopsezo chosasinthika kapena chosasinthika admin/admin lowani mkati mwa masekondi 90 kuchokera kuyambiranso.
11. Tsitsani fayilo yatsopano ya firmware pogwiritsa ntchito hotspot ya foni yanu kaye, chotsani WAN chingwe kuchokera pa rauta, yambitsaninso fakitale, kwezani fayilo ya firmware popanda intaneti kudzera 192.168.1.1, ikani mawu achinsinsi olamulira a zilembo 20, ndipo pokhapokha plug the WAN intaneti chingwe kubwerera.
12. **Letsani UPnP (Universal Plug and Play), NAT-PMP, Remote WAN Management,ndi WPS nthawi yomweyo muzokonda za rauta **:
13. Makumi asanu ndi anayi pa 100 aliwonse osagwirizana ndi zotumiza zotumizira madoko zimachitika chifukwa UPnP imayatsidwa mwachisawawa pa ma router ogula: TV iliyonse yomwe ili ndi kachilombo, kamera ya IoT, kapena zolemba za msakatuli pa netiweki yanu zimatha kutumiza zosavomerezeka. UPnP IGD SOAP Pempho la XML (AddPortMapping) ku 192.168.1.1:1900 kulangiza rauta kuti atsegule madoko akunja amoto molunjika ku NAS yanu yamkati (port 5000/445) kapena Windows PC (port 3389 RDP).
14. Tsukani malowo DNS Cache ndi ARP Cache pa chipangizo chilichonse cha Windows, Mac, iPhone, ndi Android, ndikuyambitsa Encrypted DNS (DNS-over-HTTPS / DoH kapena DNS-over-TLS / DoT):
15. Ngakhale mutakonza rauta, ma laputopu ndi mafoni anu azipitiliza kuyendetsa magalimoto kupita ku ma adilesi a IP a omwe akuwukirayo mpaka ma DNS TTL awo osungidwa atatha kapena muthamangitse ma cache a OS ndi osatsegula a DNS.ipconfig /flushdns).

Mtengo wachigamulo: kuzindikira ndi kuthetsa hijack ya router DNS kapena UPnP kunyengerera¶

Tsatirani mayendedwe a netiweki azamalamulowa kuti mutsimikizire kuti mwabera, kuthetseratu kulimbikira, komanso kuumitsa chipata chanu:

flowchart TD
    Start["Maulendo Okayikitsa, Machenjezo a Satifiketi, Kusintha Kwabodza Ma Pop-Ups, kapena Magalimoto Ochepa / Obedwa pa Wi-Fi"] --> AuditDNS["CHOCHITA 1: Thamangani 'nslookup google.com' & Onani Router WAN/DHCP DNS IP + UPnP Port Forwarding Table"]

    AuditDNS --> IsHijacked{"Kodi Router Imawonetsa Ma IP Osadziwika Akunja a DNS KAPENA Osavomerezeka a UPnP Port Forward?"}

    IsHijacked -->|"NO: Router DNS & Ports Ndioyera, Chida Chimodzi Chokha Chomwe Chimawongolera"| LocalMalware["Kusokoneza Ndiko Kumalo Ku PC Imodzi / Foni Imeneyo -> Yang'anani Fayilo ya 'makamu', Zowonjezera Zoyipa za Chrome, kapena Mbiri Yabodza / VPN"]

    IsHijacked -->|"INDE: rauta DNS Yasinthidwa, WAN Management Open, kapena Rogue UPnP Malamulo Alipo"| UnplugWAN["CHOCHITA 2: Chotsani WAN (Intaneti) Chingwe kuchokera pa Router + Power-Cycle Router kwa Masekondi 60 kuti Mulowetse '/tmp' RAM Malware"]

    UnplugWAN --> EoLCheck{"Kodi Router Ndi Chipata Chokhala ndi ISP Kapena Router Yanu Yekha Yogulitsa?"}

    EoLCheck -->|"ISP-Rent Modem/rauta (Comcast, AT&T, Spectrum, BT, Virgin, Rogers)"| ISPGateway["1. Gwirani Thupi Bwezerani Pinhole 15-30s. 2. Sinthani Admin & Wi-Fi Passwords + Letsani UPnP. 3. Ngati TR-069 / Firmware Yasokonekera, Fufuzani Kusintha Kwa Hardware Kwaulere Pa ISP Store"]

    EoLCheck -->|"Retail Router: Model Ndi Mapeto a Moyo (EoL / Palibe Zosintha za Firmware mu Zaka 2+)"| ReplaceRouter["UNPLUG KWANTHAWI ZONSE & KUSINTHA MALO OGWIRITSA NTCHITO: Ma EoL Router Osasindikizidwa Adzabedwanso Pasanathe Maola Olumikizananso ndi WAN"]

    EoLCheck -->|"Retail Router: Chitsanzo Chothandizira"| CleanReflash["1. Tsitsani Firmware Yatsopano Yovomerezeka Pa Ma Cellular Hotspot Oyera. 2. Gwiraninso Bwezeretsani Pinhole 15-30s (Pamene Yoyatsidwa & Yopanda intaneti). 3. Flash Firmware kudzera pa Efaneti -> Zimitsani UPnP & WAN Admin -> Khazikitsani DoH/DoT Yobisika"]

Gawo 1: Momwe mungatsimikizire ngati tebulo la DNS kapena UPnP la router yanu labedwa (Forensic Audit)¶

Musanapukute rauta, tengani mphindi 2 kuti muwone **zomwe ** zidasinthidwa kuti mudziwe ngati wowukirayo adangopha poizoni. DNS (GhostDNS style) kapenanso kutumiza madoko mu netiweki yanu yamkati (UPnP / NAT kulowerera).

1. Kuwunika ma seva anu a DNS omwe akugwira ntchito kuchokera pamzere wamalamulo (nslookup / scutil / resolvectl)¶

Tsegulani Terminal kapena Command Prompt pa kompyuta yolumikizidwa ndi netiweki ndikuyendetsa: - ** Windows (Command Prompt / PowerShell):

ipconfig /all
nslookup example.com

scutil --dns | grep 'nameserver\[[0-9]*\]'

resolvectl status

Fananizani ndi DNS Servers IP adilesi yobwezeredwa ndi rauta yanu motsutsana ndi tebulo ili lovomerezeka motsutsana ndi zosinthidwa zobedwa:

2. Kuwunika ma rauta anu UPnP ndi Port Forwarding / Virtual Server Table¶

Mukalowa mu mawonekedwe a admin wa rauta yanu (http://192.168.1.1, 192.168.0.1, 10.0.0.1, kapena 192.168.50.1), pitani ku Advanced -> NAT Forwarding / Port Forwarding / UPnP: - Onani ku UPnP Portmap Table (kubwereketsa kwa UPnP): - Masewero ovomerezeka amatsegula kwakanthawi madoko apamwamba a UDP (monga UDP 3074 kwa Xbox/Call of Duty). - Zizindikiro za kusagwirizana: Ngati muwona UPnP malamulo kutumiza madoko akunja a TCP ku Port 445 (SMB), Port 3389 (Windows Remote Desktop / RDP), Port 22 (SSH), Port 5000 / 5001 / 8080 (Synology / QNAP NAS), Port 554 (RTSP Security Cameras), kapena Port 1080 / 9050 (SOCKS5 Proxy Botnet), pulogalamu yaumbanda mkati mwa netiweki yanu (kapena WAN UPnP SOAP exploit) yabowola mabowo mwachindunji kudzera pa firewall yanu. - Onaninso Advanced -> Security -> Remote Management (WAN Access) ndiFirewall -> DMZ: - Tsimikizani kuti Remote Management (Kufikira pa Webusayiti kuchokera ku WAN) ndi KULEMEDWA (OFF) ndi kutiDMZ Host* ndi WOLEMA (Blank / 0.0.0.0). Owukira omwe amaphwanya rauta pafupifupi nthawi zonse amayatsa Remote Management on Port 8080 / 8443 kapena ikani IP mkati mu DMZ kuti abwerenso pambuyo pake.

Gawo 2: Kuthetsa kwapang'onopang'ono rauta, NVRAM yambitsaninso, ndikusinthanso firmware yapaintaneti¶

Osangolowa mu rauta yosokonekera ndikulemba 8.8.8.8 kubwerera m'bokosi la DNS osakhazikitsanso ndikuwunikiranso: ngati wowukirayo adabzala a cron ntchito, zosinthidwa dnsmasq.conf, wololedwa TR-069 (CWMP) Kukonzekera kwachiwembu, kapena kugwiritsa ntchito chiwopsezo chosasinthika cha firmware, mawonekedwe achinyengo a DNS abwereranso mphindi 10 pambuyo pake.

Chitani izi 6-sitepe zoyeretsa chipinda:

Khwerero 1: Tsitsani pulogalamu yaposachedwa ya firmware ndi zida MUSAYANSIRE intaneti¶

1. Kugwiritsa ntchito foni yam'manja pama foni am'manja (yokhala ndi Wi-Fi yozimitsa) kapena kompyuta yolumikizidwa ndi malo ochezera a foni yanu:
2. Yang'anani chomata chomwe chili pansi pa rauta yanu ndikuwerenga ndendende Nambala Yachitsanzo NDI Kukonzanso kwa Hardware (Ver: 1.0, v2, v4.20). (Kuwala Hardware v1 firmware ku a v2 rauta akhoza kuzipanga.)
3. Pitani mwachindunji patsamba lothandizira la opanga (asus.com, tp-link.com, netgear.com, linksys.com, ui.com) ndikutsitsa ** firmware yatsopano .zip archive ** ku kompyuta yanu.
4. Chotsani the .zip fayilo kuti mukhale ndi yaiwisi .bin, .chk, .trx, kapena .img fayilo ya firmware yokonzeka pa Desktop yanu.

Khwerero 2: Chotsani rauta ku WAN (Intaneti) ndi kutulutsa kwamphamvu RAM¶

1. **Chotsani WAN Ethernet chingwe ** (chingwe chochokera ku ulusi wanu ONT kapena modemu ya chingwe mu buluu / chikasu Internet / WAN doko pa rauta yanu).
2. ** Chotsani zonse LAN Zingwe za Efaneti** kupatula laputopu/PC imodzi yoyera (yokhala ndi Wi-Fi yozimitsa).
3. Chotsani chingwe chamagetsi cha rauta kukhoma kwa masekondi 60 athunthu: Izi zimachotsa ma capacitor a boardboard ndikuwononga pulogalamu yaumbanda iliyonse ya Stage-2/Stage-3 /tmp RAM.

Khwerero 3: Pangani Hardware yoyenera NVRAM Kubwezeretsanso Fakitale (Ndipo chifukwa chiyani muyenera kupewa 30-30-30 pa ma router amakono)¶

1. Lumikizani chingwe chamagetsi cha rauta (sungani fayilo ya WAN Chingwe cha intaneti ** chosalumikizidwa **) ndi ** dikirani mphindi 2 zonse ** mpaka rauta itamaliza kuyambiranso.
2. Pogwiritsa ntchito paperclip kapena SIM-ejector chida, akanikizire ndi kugwira recessed Reset batani lakumbuyo kumbuyo kwa rauta:
3. Standard U-Boot / Ma router amakono a Linux (ASUS, TP-Link, Netgear, Linksys, Ubiquiti, Synology, Eero): Gwirani Reset batani mosalekeza kwa masekondi 15 mpaka 30 ** pomwe rauta imayatsidwa mpaka nyali zonse za LED ziziwunikira mwachangu kapena kutembenuza amber, kenako masulani batani ndikudikirira mphindi 3 kuti rauta iyambitsenso ndi pukuta. NVRAM kugawa.
4. Asus Specific "Hard Factory Reset" (NVRAM + /jffs Partition Pukuta): Pa ma routers a ASUS (RT-AX, RT-BE, GT-AX mndandanda), pulogalamu yaumbanda kapena zolemba zabodza zitha kubisala mkati mwazolimbikira /jffs flash partition yomwe imapulumuka kukonzanso bwino. Kupukuta onse NVRAM ndi /jffs pa rauta ya ASUS:
   1. Zimitsani mphamvu ya rauta.
   2. Dinani ndikugwira thupi **WPS batani ** (osati Bwezerani batani).
   3. Ndikugwira **WPS batani **, tembenuzirani mphamvu ya rauta ** PA **.
   4. Pitirizani kugwira WPS kwa masekondi 15 mpaka Power LED iyamba kuwunikira mwachangu, kenako imapita mdima / kuyambiranso, ndikumasula. Izi zimagwira gawo la hardware NVRAM + /jffs kufufuta.

Khwerero 4: Yambitsaninso firmware popanda intaneti ndikutseka ndege yoyang'anira¶

1. Pa kompyuta yanu yolumikizidwa ndi Efaneti, tsegulani zenera lachinsinsi/losadziwika ndikupita ku IP yokhazikika ya rauta (http://192.168.1.1, 192.168.0.1, kapena 192.168.50.1).
2. Malizitsani wizate yoyambira yopanda intaneti ndipo nthawi yomweyo ikani mwapadera, Mawu Achinsinsi Oyang'anira zilembo 20 (osagwiritsanso ntchito mawu achinsinsi a Wi-Fi ngati achinsinsi a Administrator rauta).
3. Pitani ku Administration / System -> Firmware Upgrade -> Manual / Local File Upload, sankhani fayilo yovomerezeka ya firmware yomwe mudatsitsa mu Gawo 1, ndikuwunikira. Ngakhale nambala yamtunduwu ndi yofanana ndi yomwe idakhazikitsidwa kale, reflashing imalembanso rootfs chithunzi cha dongosolo ndikutsimikizira siginecha ya cryptographic firmware.
4. Router ikangoyambiranso kung'anima kwa firmware, tsimikizirani izi **6 Zosintha Zoyenera Zowumitsa ** musanatsegulenso chingwe cha intaneti:
5. UPnP (Universal Plug and Play): Khazikitsani ku DISABLED / OFF.
6. Remote Management (WAN Web Access / HTTPS from WAN / SSH from WAN): Khazikitsani ku DISABLED / OFF.
7. TR-069 / CWMP (Pa Ma Ruta Ogulitsa): Khazikitsani ku DISABLED / OFF (pokhapokha pakufunika ndi chipata cha fiber ISP).
8. WPS (Wi-Fi Protected Setup PIN / Pushbutton): Khazikitsani ku DISABLED / OFF.
9. Wi-Fi Security: Khazikitsani ku WPA3-Personal (kapena WPA2/WPA3-Personal AES; ayi WPA/TKIP kapena WEP) ndi mawu achinsinsi a Wi-Fi atsopano.
10. WAN DNS Server: Ikani pamanja DNS Yoyambira ku 1.1.1.1 (Cloudflare) kapena 9.9.9.9 (Quad9 Malware-Lotching DNS) ndi DNS Yachiwiri kupita ku 1.0.0.1 kapena 149.112.112.112 (ndi yambitsani DNS-over-TLS / DoT pa rauta ngati imathandizira).
11. Pulagi **WAN (Intaneti) chingwe ** kubwerera mu rauta.

Gawo 3: Kutsuka ma cache a DNS okhala ndi poizoni pazida zonse ndikuyambitsa Encrypted DNS (DoH / DoT)¶

Ngakhale rauta yanu itakhala yoyera 100 peresenti, laputopu iliyonse, kompyuta, kapena foni yamakono yomwe idalumikizidwa pakubedwa imatha kukhalabe **marekodi apoizoni a DNS ** (TTL mpaka masiku 7), malo osinthidwa hosts file, kapena dziwe losakaza lapoizoni.

Gawo 1: Yang'anani komweko hosts file ndi kuwotcha OS + Browser DNS cache¶

1. Tsimikizirani kuti pulogalamu yaumbanda sinalembe zolemba zabodza m'dera lanu hosts Fayilo:
2. Windows: Tsegulani Notepad ngati Administrator ndikutsegula C:\Windows\System32\drivers\etc\hosts. Mzere uliwonse mosasintha koyera hosts fayilo iyenera kuyamba ndi # (ndemanga). Chotsani mayina a mayina enieni a mapu a mzere (google.com, microsoft.com, masamba aku banki, kapena ma antivayirasi) kupita ku ma adilesi achilendo a IP.
3. ** macOS / Linux **: Onani cat /etc/hosts mu Terminal.
4. Yatsani ma Operating System DNS ndi ma cache a ARP:
5. ** Windows (Run Command Prompt as Administrator)**:

   ipconfig /flushdns
   ipconfig /release
   ipconfig /renew
   arp -d *
   

6. macOS (Terminal):

   sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
   

7. iPhone / iPad / Android: Yatsani Mawonekedwe Andege kwa masekondi 15, kenako ZIMIMI, ndi Iwalani ndi Kujowinanso netiweki ya Wi-Fi.
8. Onjetsani Chrome, M'mphepete, ndi Msakatuli Wamkati Wolimba Mtima DNS & Socket Cache:
9. Asakatuli a Chromium amasunga cache yawo yamkati ya DNS osadalira Windows/macOS.
10. Tsegulani Chrome, Edge, kapena Brave -> mtundu chrome://net-internals/#dns mu bar adilesi -> dinani Clear host cache.
11. Kenako, dinani Sockets m'mbali yakumanzere (chrome://net-internals/#sockets) -> dinani Close idle sockets ndi Flush socket pools.

Gawo 2: Yambitsani Encrypted DNS (DNS-over-HTTPS / DoH ndi DNS-over-TLS / DoT) kotero rauta SINGAYABE DNS yanu kachiwiri¶

DNS Yachikhalidwe (UDP port 53) sichinasinthidwe kwathunthu komanso sichinatsimikizidwe: rauta iliyonse yosokonekera, ISP, shopu ya khofi Wi-Fi, kapena chipata cha hotelo imatha kutsata zopempha zanu za doko 53 ndikupangira mayankho abodza. Kuthandizira DNS-over-HTTPS (DoH) kapena DNS-over-TLS (DoT) imakutira mafunso anu a DNS mkati TLS 1.3 kubisa komwe kumatsimikiziridwa ndi satifiketi ya cryptographic, kutanthauza **ngakhale rauta yanu itabedwa, sikungawerenge kapena kusintha kuyang'ana kumodzi kwa DNS **:

Gawo 4: Kuwunika zida zamkati zomwe zidawululidwa pomwe UPnP anali otsegula (NAS, Cameras,ndi RDP)¶

Ngati kuwunika kwa rauta yanu mu Gawo 1 kudawulula kuti **yosaloledwa UPnP doko patsogolo ** (kapena DMZ exposure) idakhala ikugwira ntchito musanakhazikitsenso rauta, muyenera kutsimikizira kuti owukira sanakhazikike pazida zamkati pomwe madoko a firewall anali otseguka:

1. ** Onani Zida Zanyumba / Ofesi NAS (Synology DiskStation, QNAP, TrueNAS)**:
2. Tsegulani gulu lanu lowongolera la NAS -> Security Advisor / QuFirewall / Connection Logs.
3. Yang'anani zoyeserera zolephera kapena zopambana zolowera kuchokera ku ma adilesi akunja a IP, maakaunti owongolera omwe angopangidwa kumene, kapena zomwe zakonzedwa mosayembekezereka. cron ntchito.
4. Mkati mwa zoikamo za NAS (Control Panel -> External Access -> Router Configuration), **Chotsani chotsani zonse zokha UPnP mabokosi okhazikitsa ma router ** kotero NAS isayesenso kutsegula madoko a router.
5. ** Onani ma PC a Windows RDP (Port 3389) Kulowerera kwa Brute-Force**:
6. Ngati TCP 3389 adawonekera mu rauta yanu UPnP tebulo, tsegulani Windows Event Viewer (eventvwr.msc)-> Windows Logs -> Security ndi kusefa kwa Event ID 4624 (Login Yopambana, Logon Type 10 RemoteInteractive) ndi Event ID 4625 (Login Yolephera).
7. Letsani Windows Remote Desktop (Settings -> System -> Remote Desktop -> OFF) pokhapokha mutafikiridwa mosamalitsa kudzera pa mesh ya anzanu ndi anzawo a VPN (Tailscale, WireGuard, kapena ZeroTier).
8. Isolate Smart TV, IP Camera, ndi IoT Devices pa Guest Wi-Fi Network (VLAN / AP Isolation):
9. Zambiri zamkati UPnP kusokoneza kwa router kumachokera ku kamera yotsika mtengo ya IoT, pulagi yanzeru, kapena bokosi la TV la Android pa netiweki yanu yayikulu ya Wi-Fi yomwe imalumikizana ndi botnet ndikutumiza. UPnP IGD amalamula kuti 192.168.1.1.
10. Yambitsani Mlendo Wi-Fi Network* ya rauta yanu ndi Access Intranet / Allow guests to see each other and access my local network set ku OFF (Client Isolation), ndikusuntha ma TV onse a Smart, makamera, zovundikira maloboti, ndi zida zanzeru pa Mlendo SSID yakutaliyo kuti asalankhulenso ndi IP yoyang'anira LAN ya rauta yanu (192.168.1.1) kapenanso laputopu yanu yantchito.

Mafunso omwe amafunsidwa pafupipafupi¶

Kodi wowononga adasintha bwanji makonzedwe a DNS mkati mwa rauta yanga ngati sakhala mnyumba mwanga pa Wi-Fi yanga?¶

Zigawenga zimasokoneza ma router akunyumba ndi maofesi ang'onoang'ono patali popanda kukhala pafupi ndi Wi-Fi yanu pogwiritsa ntchito njira zitatu zazikulu: (1) Cross-Site Request Forgery (CSRF) ndi DNS Rebinding: Mumayendera tsamba lodziwika bwino lomwe lili ndi zotsatsa zoyipa mukakhala pakompyuta yanu; script imatumiza mwakachetechete pempho la HTTP POST kuchokera kwa msakatuli wanu mwachindunji kupita ku rauta yanu (http://192.168.1.1/apply.cgi), ndipo ngati rauta yanu ikugwiritsabe ntchito mawu achinsinsi (admin / admin kapena admin / mawu achinsinsi), script imalembanso ma seva a WAN DNS a router yanu mumphindi imodzi. (2) Kuwonetsedwa kwa WAN Management kapena Mtengo wa TR-069 (Port 7547/8080/8443): Makina ojambulira pa intaneti amapeza ma routers okhala ndi Remote Administration atasiyidwa osatsegula kapena osasinthika zachiwopsezo cha firmware ndikubaya malamulo mwachindunji kuchokera pa intaneti; ndi (3) UPnP Kuwonekera kwa WAN: Ma router akale kapena olakwika amawulula awo mwangozi UPnP SOAP daemon (doko 1900/5000) ku mawonekedwe a WAN, kulola aliyense pa intaneti kuwonjezera malamulo otumizira madoko kapena kusintha SetDNSServer zokonda popanda mawu achinsinsi.

Nchifukwa chiyani munati "30-30-30 Hard Reset" yotchuka sikugwira ntchito pa ma routers amakono ndipo imatha kuyambitsa mavuto?¶

The 30-30-30 kukonzanso (kugwira Reset kwa 30s ndi mphamvu, 30s yozimitsa, ndi 30s mukuyatsanso) inalembedwa zaka 20 zapitazo makamaka kwa Ma routers a Linksys WRT54G akuyenda DD-WRT pa Broadcom CFE ma bootloaders. Pafupifupi rauta iliyonse yamakono yopangidwa zaka 12 zapitazi (ASUS, TP-Link, Netgear, Linksys Velop, UniFi, MikroTik), kukanikiza batani la Bwezeretsani thupi polumikiza chingwe chamagetsi ndiye choyambitsa cha Hardware kuyimitsa boot wamba ndikulowa Bootloader TFTP Firmware Recovery Mode (kumene kuwala kwamagetsi kumang'anima pang'onopang'ono kudikirira seva ya TFTP, ndi Chithunzi cha NVRAM ndi ayi kufufutidwa konse). Kupukuta bwino Chithunzi cha NVRAM kubwerera kumafakitale osasintha pa rauta iliyonse yamakono, sungani chingwe chamagetsi cholumikizidwa pomwe rauta yakhazikika, gwirani Bwezerani pinhole kwa masekondi 15 mpaka 30 mpaka magetsi ang'anire, ndikusiyani kuti iyambitsenso yokha.

Ngati ndiletsa UPnP (Universal Plug and Play) pa rauta yanga kuti nditetezeke, kodi isokoneza ntchito yanga ya Zoom mafoni, kukhamukira kwa Netflix, kapena kusakatula pa intaneti?¶

Ayi, kulepheretsa UPnP ilibe kanthu pa Zoom, Microsoft Teams, Netflix, YouTube, Slack, imelo, kapena kusakatula pa intaneti. Mapulogalamu onse amtundu wa intaneti amayamba zakunja maulumikizidwe kuchokera ku chipangizo chanu kupita ku seva yamtambo, yomwe Stateful Packet Inspection ya router yanu (SPI) firewall ya NAT imangogwira zokha popanda UPnP. The kokha zinthu zothandiza UPnP ndi masewera ochezera a anzanu ambiri (PlayStation, Xbox, Nintendo Switch hosting lobbies), makasitomala a BitTorrent, ndi maseva odzipangira okha (Plex) kuyesa kuvomera osapemphedwa kulowa kulumikizana ndi anthu osawadziwa pa intaneti. Kuchoka UPnP anatembenuka ZIZIMA amalimbikitsidwa ndi NSA, CISA,ndi FBI chifukwa imaletsa pulogalamu yaumbanda kapena zida zachinyengo za IoT m'nyumba mwanu kuti zisatsegule mwachinsinsi madoko achitetezo pa intaneti.

Nanga bwanji ngati rauta yanga ili yobwereketsa ISP combo modemu/chipata (monga Comcast Xfinity xFi, AT&T BGW320, kapena Spectrum) ndipo sichingandilole kusintha ma seva a DNS kapena fimuweya ya flash?¶

Ma modemu ambiri operekedwa ndi ISP amatseka Chithunzi cha WAN DNS minda yapaintaneti kuti makasitomala asawasinthe, ndikuwongolera firmware pamutu wa coaxial/fiber wa ISP kudzera pa DOCSIS kapena Mtengo wa TR-069. Ngati chipata chobwerekedwa ndi ISP chikuwonetsa machitidwe achinyengo a DNS kapena madoko osaloleka: (1) Gwirani chokhazikika. Bwezerani pinhole kumbuyo kwa chipata cha ISP cha 20 mpaka 30 masekondi kukakamiza kukonzanso kwafakitale ndi kwatsopano DOCSIS / ONT tsitsani fayilo ya boot kuchokera ku ISP yanu; (2) Lowani mu pulogalamu yanu yam'manja ya ISP (Xfinity, SmartHomeManager, Spectrum yanga) kuti musinthe mawu achinsinsi a akaunti yanu ndikuwunikanso pulogalamu iliyonse yokhazikitsidwa Port Forwards; ndi (3) Konzani DNS Yosungidwa (DoH / DoT) molunjika pama laputopu anu, mafoni, ndi asakatuli (monga zasonyezedwera mu Gawo 3 pamwambapa), kapena ikani chipata cha ISP Bridge Mode / IP Passthrough Mode ndikulumikiza rauta yanu yotetezedwa kumbuyo kwake.

Maupangiri ogwirizana¶

• DNS hijacking, ISP rauta WAN reconfiguration, ndi wogwidwa portal spoofing
• Nyumba yosokoneza kapena ofesi yaying'ono NAS (QNAP/Synology), DeadBolt ransomware, ndi UPnP yotumiza doko
• Kuteteza ma routers akunyumba ndi zida za IoT
• Fake CAPTCHA ClickFix PowerShell Win+R clipboard pulogalamu yaumbanda ndi Lumma infostealer remediation
• Zero-day imagwiritsa ntchito patching mwadzidzidzi komanso End-of-Life (EoL) kudzipatula pazida
• Nambala zadzidzidzi malinga ndi dziko

Magwero ndi malangizo ovomerezeka¶

• National Security Agency (NSA) ndi Cybersecurity and Infrastructure Security Agency (CISA Joint Cybersecurity Information Sheet - media.defense.gov): Njira Zabwino Kwambiri Zotetezera Netiweki Yanu Yanyumba (Kuyimitsa UPnP, WAN Administration, Legacy WPS, ndi Kusintha Mapeto a Moyo SOHO Routers).
• Federal Bureau of Investigation (FBI Chilengezo cha Utumiki Wautumiki I-052518-PSA & KV-Botnet / RaptorTrain Advisories): Ogwiritsa Ntchito Paintaneti Akunja Akuyang'ana Njira Zanyumba ndi Maofesi: Yambitsaninso Nthawi yomweyo ku Flush Stage-2 RAM Malipiro, Kukhazikitsanso Factory, ndi Firmware Upgrade Protocol.
• Internet Engineering Task Force (IETF RFC 8484 - * Mafunso a DNS pa HTTPS (DoH)* & RFC 7858 - Matchulidwe a DNS pa Transport Layer Security (DoT)): Cryptographic Authentication and Integrity Protection of Stub-to-Recursive DNS Resolution.
• ASUS, Netgear, ndi TP-Link Official Security Advisories: Hardware NVRAM ndi /jffs Njira Zokhazikitsira Factory Partition vs. U-Boot / CFE TFTP Recovery States.