{"id":102321,"date":"2021-11-18T21:36:40","date_gmt":"2021-11-18T19:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere"},"modified":"2021-11-18T21:36:40","modified_gmt":"2021-11-18T19:36:41","slug":"predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","title":{"rendered":"Byl navr\u017een zp\u016fsob \u00fatoku pro vzd\u00e1len\u00e9 ur\u010dov\u00e1n\u00ed fragment\u016f pam\u011bti na serveru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f z Technick\u00e9 univerzity v Grazu (Rakousko), d\u0159\u00edve zn\u00e1m\u00e1 v\u00fdvojem \u00fatok\u016f MDS, NetSpectre, Throwhammer a ZombieLoad, zve\u0159ejnila novou metodu \u00fatoku (CVE-2021-3714) prost\u0159ednictv\u00edm vedlej\u0161\u00edch kan\u00e1l\u016f na mechanismus deduplikace str\u00e1nek pam\u011bti (Memory-Deduplication). Tato metoda umo\u017e\u0148uje ur\u010dit p\u0159\u00edtomnost ur\u010dit\u00fdch dat v pam\u011bti, uspo\u0159\u00e1dat \u00fanik obsahu pam\u011bti po bytech nebo zjistit rozlo\u017een\u00ed pam\u011bti pro obch\u00e1zen\u00ed ochrany zalo\u017een\u00e9 na randomizaci adres (ASLR). Nov\u00e1 metoda se od d\u0159\u00edve demonstrovan\u00fdch variant \u00fatok\u016f na mechanizmus deduplikace li\u0161\u00ed prov\u00e1d\u011bn\u00edm \u00fatoku z extern\u00edho hostitele, p\u0159i\u010dem\u017e jako krit\u00e9rium slou\u017e\u00ed zm\u011bna doby odezvy na odes\u00edlan\u00e9 \u00fato\u010dn\u00e9 po\u017eadavky prost\u0159ednictv\u00edm protokol\u016f HTTP\/1 a HTTP\/2. Mo\u017enost proveden\u00ed \u00fatoku byla demonstrov\u00e1na pro servery zalo\u017een\u00e9 na Linuxu a Windows. <\/p>\n

\u00datoky na mechanismus deduplikace pam\u011bti vyu\u017e\u00edvaj\u00ed jako kan\u00e1l pro \u00fanik informac\u00ed rozd\u00edl v \u010dase zpracov\u00e1n\u00ed operace z\u00e1pisu v situac\u00edch, kdy zm\u011bna dat vede ke klonov\u00e1n\u00ed deduplikovan\u00e9 str\u00e1nky pam\u011bti pomoc\u00ed mechanismu Copy-On-Write (COW). B\u011bhem pr\u00e1ce j\u00e1dro ur\u010duje identick\u00e9 str\u00e1nky pam\u011bti z r\u016fzn\u00fdch proces\u016f a spojuje je, t\u00edm se zobrazuje identick\u00e9 str\u00e1nky pam\u011bti v jedn\u00e9 oblasti fyzick\u00e9 pam\u011bti pro ulo\u017een\u00ed pouze jedn\u00e9 kopie. P\u0159i pokusu o zm\u011bnu dat jedn\u00edm z proces\u016f souvisej\u00edc\u00edch s deduplikovan\u00fdmi str\u00e1nkami dojde k v\u00fdjimce (page fault) a pomoc\u00ed mechanismu Copy-On-Write se automaticky vytvo\u0159\u00ed samostatn\u00e1 kopie str\u00e1nky pam\u011bti, kter\u00e1 je p\u0159i\u0159azena dan\u00e9mu procesu. Na proveden\u00ed kop\u00edrov\u00e1n\u00ed se vynakl\u00e1d\u00e1 dal\u0161\u00ed \u010das, co\u017e m\u016f\u017ee b\u00fdt zn\u00e1mkou zm\u011bny dat, kter\u00e1 se p\u0159ekr\u00fdv\u00e1 s jin\u00fdm procesem. <\/p>\n

V\u00fdzkumn\u00edci uk\u00e1zali, \u017ee zpo\u017ed\u011bn\u00ed vznikl\u00e1 v d\u016fsledku funkce mechanismu COW mohou b\u00fdt zachycena nejen lok\u00e1ln\u011b, ale i anal\u00fdzou zm\u011bn doby dod\u00e1n\u00ed odpov\u011bd\u00ed p\u0159es s\u00ed\u0165. Bylo navr\u017eeno n\u011bkolik metod pro ur\u010den\u00ed obsahu pam\u011bti z vzd\u00e1len\u00e9ho hostitele prost\u0159ednictv\u00edm anal\u00fdzy doby prov\u00e1d\u011bn\u00ed po\u017eadavk\u016f prost\u0159ednictv\u00edm protokol\u016f HTTP\/1 a HTTP\/2. Pro uchov\u00e1n\u00ed vyb\u00edran\u00fdch vzor\u016f se pou\u017e\u00edvaj\u00ed typick\u00e9 webov\u00e9 aplikace, kter\u00e9 uchov\u00e1vaj\u00ed informaci obsa\u017eenou v p\u0159ich\u00e1zej\u00edc\u00edch po\u017eadavc\u00edch v pam\u011bti. <\/p>\n

Obecn\u00fd princip \u00fatoku spo\u010d\u00edv\u00e1 v napln\u011bn\u00ed na serveru<\/a> str\u00e1nky pam\u011bti daty, kter\u00e9 potenci\u00e1ln\u011b opakuj\u00ed obsah ji\u017e existuj\u00edc\u00ed na serveru str\u00e1nky pam\u011bti. Pot\u00e9 \u00fato\u010dn\u00edk \u010dek\u00e1 na \u010das pot\u0159ebn\u00fd pro proveden\u00ed deduplikace j\u00e1drem a slou\u010den\u00ed str\u00e1nky pam\u011bti, po \u010dem\u017e prov\u00e1d\u00ed zm\u011bny kontrolovan\u00e9ho duplicitn\u00edho datov\u00e9ho bloku a hodnot\u00ed \u010das reakce k ur\u010den\u00ed \u00fasp\u011b\u0161nosti z\u00e1sahu.

\"Byl<\/center> <\/p>\n

V r\u00e1mci proveden\u00fdch experiment\u016f dos\u00e1hla maxim\u00e1ln\u00ed rychlost \u00faniku informac\u00ed 34,41 bajt\u016f za hodinu p\u0159i \u00fatoku p\u0159es glob\u00e1ln\u00ed s\u00ed\u0165 a 302,16 bajt\u016f za hodinu p\u0159i \u00fatoku p\u0159es lok\u00e1ln\u00ed s\u00ed\u0165, co\u017e je rychlej\u0161\u00ed ne\u017e jin\u00e9 metody z\u00edsk\u00e1v\u00e1n\u00ed dat prost\u0159ednictv\u00edm extern\u00edch kan\u00e1l\u016f (nap\u0159\u00edklad p\u0159i \u00fatoku NetSpectre je rychlost p\u0159enosu dat 7,5 bajt\u016f za hodinu). <\/p>\n

Byly navr\u017eeny t\u0159i pracovn\u00ed varianty \u00fatoku. Prvn\u00ed varianta umo\u017e\u0148uje ur\u010dit data v pam\u011bti webov\u00e9ho serveru<\/a>, na kter\u00e9m se pou\u017e\u00edv\u00e1 Memcached. \u00datok spo\u010d\u00edv\u00e1 v na\u010d\u00edt\u00e1n\u00ed ur\u010dit\u00fdch datov\u00fdch sad do \u00falo\u017ei\u0161t\u011b Memcached, vy\u010di\u0161t\u011bn\u00ed deduplikovan\u00e9 bloky, op\u011btovn\u00e9m z\u00e1pisu stejn\u00e9ho prvku a vytvo\u0159en\u00ed podm\u00ednek pro vznik COW-kop\u00edrov\u00e1n\u00ed prost\u0159ednictv\u00edm zm\u011bny obsahu bloku. V pr\u016fb\u011bhu experimentu s Memcached se poda\u0159ilo za 166,51 sekundy ur\u010dit verzi libc nainstalovanou v syst\u00e9mu b\u011b\u017e\u00edc\u00edm ve virtu\u00e1ln\u00edm stroji. <\/p>\n

Druh\u00e1 varianta umo\u017enila zjistit obsah z\u00e1znam\u016f v datab\u00e1zi MariaDB p\u0159i pou\u017eit\u00ed \u00falo\u017ei\u0161t\u011b InnoDB prost\u0159ednictv\u00edm rekonstrukce obsahu bajt po bajtu. \u00datok se prov\u00e1d\u00ed zasl\u00e1n\u00edm speci\u00e1ln\u011b upraven\u00fdch dotaz\u016f, kter\u00e9 vedou k jednomu bajtov\u00fdm nesrovnalostem v str\u00e1nk\u00e1ch pam\u011bti a anal\u00fdzou \u010dasu reakce za \u00fa\u010delem ur\u010den\u00ed, \u017ee domn\u011bnka o obsahu bajtu byla spr\u00e1vn\u00e1. Rychlost takov\u00e9ho \u00faniku je mal\u00e1 a \u010din\u00ed 1,5 bajt\u016f za hodinu p\u0159i \u00fatoku z lok\u00e1ln\u00ed s\u00edt\u011b. V\u00fdhodou metody je, \u017ee m\u016f\u017ee b\u00fdt pou\u017eita k obnov\u011b nezn\u00e1m\u00e9ho obsahu pam\u011bti. <\/p>\n

T\u0159et\u00ed varianta umo\u017enila za 4 minuty zcela obej\u00edt mechanismus ochrany KASLR a z\u00edskat informace o posunu v pam\u011bti obrazu j\u00e1dra virtu\u00e1ln\u00edho stroje, kdy\u017e se adresa posunu nach\u00e1z\u00ed na str\u00e1nce pam\u011bti, jej\u00ed\u017e jin\u00e9 \u00fadaje nejsou zm\u011bn\u011bny. \u00datok byl proveden z hostitele, kter\u00fd byl za 14 p\u0159echod\u016f (hops) od napaden\u00e9ho syst\u00e9mu. P\u0159\u00edklady k\u00f3du pro proveden\u00ed v\u00fd\u0161e uveden\u00fdch \u00fatok\u016f slibuj\u00ed, \u017ee budou zve\u0159ejn\u011bny na GitHubu.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u043d\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0434\u0435\u0434\u0443\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 (Memory-Deduplication), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0431\u0430\u0439\u0442\u043e\u0432\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u043a\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 (ASLR). \u041e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102322,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Byla navr\u017eena metoda \u00fatoku pro d\u00e1lkovou identifikaci fragment\u016f pam\u011bti na serveru | ProHoster","description":"Skupina v\u011bdc\u016f z Technick\u00e9 univerzity v Grazu (Rakousko), zn\u00e1m\u00e1 d\u0159\u00edv\u011bj\u0161\u00edmi \u00fatoky MDS, NetSpectre, Throwhammer a ZombieLoad, zve\u0159ejnila novou metodu \u00fatoku (CVE-2021-3714) prost\u0159ednictv\u00edm postrann\u00edch kan\u00e1l\u016f.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-18T19:36:41+00:00","article:modified_time":"2021-11-18T19:36:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102321","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-18 19:37:43","updated":"2026-02-09 21:39:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=102321"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102321\/revisions"}],"predecessor-version":[{"id":159967,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102321\/revisions\/159967"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/102322"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=102321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=102321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=102321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}