{"id":110728,"date":"2023-10-11T03:10:14","date_gmt":"2023-10-11T01:10:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-protokole-http-2-zadejstvovannaya-v-krupnejshej-ddos-atake"},"modified":"2023-10-11T03:10:14","modified_gmt":"2023-10-11T01:10:14","slug":"uyazvimost-v-protokole-http-2-zadejstvovannaya-v-krupnejshej-ddos-atake","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-protokole-http-2-zadejstvovannaya-v-krupnejshej-ddos-atake","title":{"rendered":"Zranitelnost v protokolu HTTP\/2, vyu\u017eit\u00e1 v nejv\u011bt\u0161\u00edm DDoS \u00fatoku.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost Google zaznamenala nejv\u011bt\u0161\u00ed DDoS \u00fatok na svou infrastrukturu, jeho\u017e intenzita dos\u00e1hla 398 milion\u016f po\u017eadavk\u016f za sekundu. Nov\u00fd \u00fatok je v intenzit\u011b 7kr\u00e1t siln\u011bj\u0161\u00ed ne\u017e p\u0159edchoz\u00ed rekordn\u00ed DDoS \u00fatok, p\u0159i kter\u00e9m se \u00fato\u010dn\u00edk\u016fm poda\u0159ilo vytvo\u0159it tok 47 milion\u016f po\u017eadavk\u016f za sekundu. Pro srovn\u00e1n\u00ed, celkov\u00fd provoz na cel\u00e9m webu je odhadov\u00e1n na \u00farovni 1-3 miliardy po\u017eadavk\u016f za sekundu. Krom\u011b Google se \u00fatoku tak\u00e9 postavily spole\u010dnosti Amazon a Cloudflare. Mo\u017enost proveden\u00ed nov\u00e9ho \u00fatoku souvis\u00ed s odhalen\u00edm zranitelnosti v protokolu HTTP\/2 (CVE-2023-44487), kter\u00e1 umo\u017e\u0148uje p\u0159i minim\u00e1ln\u00edm zat\u00ed\u017een\u00ed klienta sm\u011b\u0159ovat obrovsk\u00fd tok po\u017eadavk\u016f na server. <\/p>\n

Nov\u00e1 technika \u00fatoku dostala n\u00e1zev \u201eRapid Reset\u201c a vyu\u017e\u00edv\u00e1 toho, \u017ee prost\u0159edky multiplexov\u00e1n\u00ed kan\u00e1l\u016f poskytovan\u00e9 v HTTP\/2 umo\u017e\u0148uj\u00ed vytv\u00e1\u0159et proudy po\u017eadavk\u016f v r\u00e1mci ji\u017e nav\u00e1zan\u00e9ho spojen\u00ed, bez otev\u00edr\u00e1n\u00ed nov\u00fdch s\u00ed\u0165ov\u00fdch spojen\u00ed a bez \u010dek\u00e1n\u00ed na potvrzen\u00ed p\u0159ijet\u00ed paket\u016f. Zranitelnost je pova\u017eov\u00e1na za d\u016fsledek nedostatk\u016f protokolu HTTP\/2, jeho\u017e specifikace uv\u00e1d\u00ed, \u017ee p\u0159i pokusu o otev\u0159en\u00ed p\u0159\u00edli\u0161 velk\u00e9ho po\u010dtu proud\u016f by m\u011bly b\u00fdt zru\u0161eny pouze proudy p\u0159ekra\u010duj\u00edc\u00ed limit, ale nem\u011blo by se uzav\u00edrat cel\u00e9 s\u00ed\u0165ov\u00e9 spojen\u00ed. <\/p>\n

Analogicky k d\u0159\u00edve pou\u017e\u00edvan\u00fdm metod\u00e1m \u00fatok\u016f na HTTP\/2 se v nov\u00e9m \u00fatoku tak\u00e9 vytv\u00e1\u0159\u00ed velk\u00e9 mno\u017estv\u00ed tok\u016f v r\u00e1mci jednoho spojen\u00ed. Kl\u00ed\u010dov\u00fdm rozd\u00edlem nov\u00e9ho \u00fatoku je, \u017ee m\u00edsto \u010dek\u00e1n\u00ed na odpov\u011b\u010f je za ka\u017ed\u00fdm odeslan\u00fdm po\u017eadavkem zas\u00edl\u00e1n r\u00e1mec s p\u0159\u00edznakem RST_STREAM, kter\u00fd okam\u017eit\u011b ru\u0161\u00ed po\u017eadavek. Zru\u0161en\u00ed po\u017eadavku v ran\u00e9 f\u00e1zi umo\u017e\u0148uje zbavit se zp\u011btn\u00e9ho provozu sm\u011brem k klientovi a obej\u00edt existuj\u00edc\u00ed na HTTP serverech omezen\u00ed maxim\u00e1ln\u00edho mo\u017en\u00e9ho po\u010dtu tok\u016f sou\u010dasn\u011b otev\u0159en\u00fdch v r\u00e1mci jednoho spojen\u00ed podle HTTP\/2. Takto objem po\u017eadavk\u016f sm\u011b\u0159uj\u00edc\u00edch na HTTP server p\u0159est\u00e1v\u00e1 z\u00e1viset na zpo\u017ed\u011bn\u00edch mezi odesl\u00e1n\u00edm po\u017eadavku a p\u0159ijet\u00edm odpov\u011bdi (RTT, round-trip time) a omezuje se pouze na propustnost komunika\u010dn\u00edho kan\u00e1lu.

\"Zranitelnost<\/center> <\/p>\n

Jeliko\u017e k prov\u00e1d\u011bn\u00ed \u00fatoku na stran\u011b klienta sta\u010d\u00ed jednodu\u0161e odes\u00edlat po\u017eadavky, ani\u017e by bylo pot\u0159eba p\u0159ij\u00edmat odpov\u011bdi, m\u016f\u017ee b\u00fdt \u00fatok proveden s minim\u00e1ln\u00edmi n\u00e1klady. Nap\u0159\u00edklad \u00fatok zaznamenan\u00fd spole\u010dnost\u00ed Cloudflare dos\u00e1hl 201 milionu po\u017eadavk\u016f za sekundu a byl proveden pomoc\u00ed relativn\u011b mal\u00e9ho botnetu o 20 tis\u00edc\u00edch po\u010d\u00edta\u010d\u00edch. Na stran\u011b serveru<\/a> n\u00e1klady na zpracov\u00e1n\u00ed p\u0159\u00edchoz\u00edch po\u017eadavk\u016f jsou v\u00fdrazn\u011b vy\u0161\u0161\u00ed, i kdy\u017e jsou zru\u0161eny, proto\u017ee je nutn\u00e9 prov\u00e9st operace, jako je vy\u010dlen\u011bn\u00ed datov\u00fdch struktur pro nov\u00e9 toky, anal\u00fdza po\u017eadavku, rozbalen\u00ed hlavi\u010dky a porovn\u00e1n\u00ed URL s prost\u0159edkem. P\u0159i \u00fatoku na zp\u011btn\u00e9 proxy se \u00fatok m\u016f\u017ee roz\u0161\u00ed\u0159it na backendy, proto\u017ee proxy m\u016f\u017ee stihnout p\u0159esm\u011brovat po\u017eadavek na backend p\u0159ed zpracov\u00e1n\u00edm r\u00e1mce RST_STREAM. <\/p>\n

\u00datok m\u016f\u017ee b\u00fdt proveden pouze na zraniteln\u00e9 servery s podporou HTTP\/2 (skript pro ov\u011b\u0159en\u00ed zranitelnosti na serverech, n\u00e1stroj pro proveden\u00ed \u00fatoku). \u00datoky na HTTP\/3 zat\u00edm nebyly zaznamen\u00e1ny a mo\u017enost jejich proveden\u00ed nebyla pln\u011b analyzov\u00e1na, ale z\u00e1stupci spole\u010dnosti Google doporu\u010duj\u00ed v\u00fdvoj\u00e1\u0159\u016fm servery<\/a> p\u0159idat do implementace HTTP\/3 ochrann\u00e1 opat\u0159en\u00ed, podobn\u00e1 t\u011bm, kter\u00e1 byla zavedena k blokaci \u00fatok\u016f na HTTP\/2. <\/p>\n

Podm\u00ednka zranitelnosti a dostupnost oprav pro HTTP servery a proxy: <\/p>\n