{"id":120072,"date":"2024-10-07T13:09:25","date_gmt":"2024-10-07T11:09:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah"},"modified":"2024-10-07T13:09:25","modified_gmt":"2024-10-07T11:09:25","slug":"uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","title":{"rendered":"Zranitelnost v CUPS se uk\u00e1zala jako vyu\u017eiteln\u00e1 pro zes\u00edlen\u00ed provozu p\u0159i DDoS \u00fatoc\u00edch","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina odpov\u011bdn\u00e1 za bezpe\u010dnost s\u00edt\u011b pro doru\u010dov\u00e1n\u00ed obsahu Akamai odhalila dal\u0161\u00ed vektor \u00fatoku na proces cups-browsed, kter\u00fd lze vyu\u017e\u00edt vedle jeho role jako jednoho z \u010dl\u00e1nk\u016f v exploitaci vedouc\u00ed k prov\u00e1d\u011bn\u00ed k\u00f3du v syst\u00e9mu. Odes\u00edl\u00e1n\u00edm po\u017eadavk\u016f na proces cups-browsed, kter\u00fd bez omezen\u00ed p\u0159ij\u00edm\u00e1 spojen\u00ed na portu 631, lze dos\u00e1hnout odesl\u00e1n\u00ed dat na jin\u00fd host, jejich\u017e objem m\u016f\u017ee p\u0159ekro\u010dit p\u016fvodn\u00ed po\u017eadavek a\u017e 600kr\u00e1t. Pro srovn\u00e1n\u00ed, zes\u00edlen\u00ed pro memcached m\u016f\u017ee dos\u00e1hnout 10-50 tis\u00edckr\u00e1t, NTP \u2014 556kr\u00e1t, DNS \u2014 28-54kr\u00e1t, RIPv2 \u2014 21kr\u00e1t, SNMPv2 \u2014 6kr\u00e1t. <\/p>\n

Takov\u00e1 vlastnost umo\u017e\u0148uje pou\u017e\u00edvat syst\u00e9my s cups-browsed jako zesilova\u010d provozu b\u011bhem prov\u00e1d\u011bn\u00ed DDoS \u00fatok\u016f. Metoda \u00fatoku za pou\u017eit\u00ed zesilova\u010de provozu spo\u010d\u00edv\u00e1 v tom, \u017ee po\u017eadavky z \u00fa\u010dastn\u00edc\u00edch se DDoS \u00fatok\u016f jsou sm\u011brov\u00e1ny nikoli p\u0159\u00edmo na syst\u00e9m ob\u011bti, ale p\u0159es mezilehl\u00e9ho zesilova\u010de provozu. B\u011bhem skenov\u00e1n\u00ed s\u00edt\u011b bylo zji\u0161t\u011bno v\u00edce ne\u017e 198 tis\u00edc zraniteln\u00fdch syst\u00e9m\u016f s CUPS, z nich\u017e 34 % (58 tis\u00edc syst\u00e9m\u016f) bylo vhodn\u00fdch pro zes\u00edlen\u00ed provozu v DDoS \u00fatoku. <\/p>\n

Na rozd\u00edl od metod zes\u00edlen\u00ed provozu, kter\u00e9 vy\u017eaduj\u00ed odes\u00edl\u00e1n\u00ed UDP paket\u016f s podvr\u017eenou zp\u011btnou adresou ob\u011bti, pou\u017eit\u00ed cups-browsed umo\u017e\u0148uje obej\u00edt se bez spoofingu. Slu\u017eba cups-browsed m\u00e1 vestav\u011bnou mo\u017enost na\u010d\u00edst PPD soubor z libovoln\u00e9ho serveru<\/a> v reakci na neautorizovan\u00fd extern\u00ed po\u017eadavek, b\u011bhem n\u011bho\u017e klient odes\u00edl\u00e1 URL, a cups-browsed se pokou\u0161\u00ed na\u010d\u00edst PPD soubor z ur\u010den\u00e9ho serveru. <\/p>\n

P\u0159i odes\u00edl\u00e1n\u00ed \u017e\u00e1dosti pro na\u010dten\u00ed PPD souboru v cups-browsed je mo\u017en\u00e9 dos\u00e1hnout p\u0159ipojen\u00ed dodate\u010dn\u00e9ho vypln\u011bn\u00ed k hodnot\u011b \u201eIPP URI\u201c, kter\u00e9 m\u016f\u017ee dosahovat a\u017e 989 byt\u016f. P\u0159itom je p\u0159i iniciovan\u00e9 \u017e\u00e1dosti na cups-browsed hodnota \u201eIPP URI\u201c duplikov\u00e1na \u2014 jednou v HTTP hlavi\u010dce a podruh\u00e9 uvnit\u0159 t\u011bla POST \u017e\u00e1dosti, p\u0159i\u010dem\u017e se \u017e\u00e1dosti cyklicky opakuj\u00ed po ne\u00fasp\u011b\u0161n\u00fdch pokusech o na\u010dten\u00ed a vracen\u00ed. serverem<\/a> k\u00f3du chyby 404. <\/p>\n

Na 62 % (35900) prov\u011b\u0159en\u00fdch syst\u00e9m\u016f odeslal cups-browsed alespo\u0148 10 TCP\/IPP\/HTTP po\u017eadavk\u016f na napaden\u00fd syst\u00e9m v reakci na jeden v\u00fdchoz\u00ed UDP po\u017eadavek. V pr\u016fm\u011bru pro 58000 syst\u00e9m\u016f posti\u017een\u00fdch probl\u00e9mem bylo \u010d\u00edslo opakovan\u00fdch po\u017eadavk\u016f 45. P\u0159i optim\u00e1ln\u00ed sc\u00e9n\u00e1\u0159i odesl\u00e1n\u00ed jednoho 30-bajtov\u00e9ho v\u00fdchoz\u00edho po\u017eadavku p\u0159i 45 opakovan\u00fdch pokusech o na\u010dten\u00ed povede k odesl\u00e1n\u00ed 18000 bajt\u016f dat na c\u00edlov\u00fd syst\u00e9m, tj. dojde ke zes\u00edlen\u00ed provozu o 600 n\u00e1sobk\u016f. V nejhor\u0161\u00edm sc\u00e9n\u00e1\u0159i je zes\u00edlen\u00ed 108 n\u00e1sobk\u016f. <\/p>\n

D\u00e1le lze zm\u00ednit, \u017ee spole\u010dnost Cloudflare odrazila rekordn\u00ed DDoS \u00fatok, p\u0159i kter\u00e9m byl na syst\u00e9m ob\u011bti nam\u00ed\u0159en tok o rychlosti 3,8 terabitu za sekundu (2,14 miliardy paket\u016f za sekundu). Uv\u00e1d\u00ed se, \u017ee \u00fatok byl organizov\u00e1n za pou\u017eit\u00ed velk\u00e9ho po\u010dtu kompromitovan\u00fdch dom\u00e1c\u00edch router\u016f zna\u010dek Asus a Mikrotik, stejn\u011b jako DVR za\u0159\u00edzen\u00ed a webov\u00fdch server\u016f, kter\u00e9 byly hackov\u00e1ny mimo jin\u00e9 za pou\u017eit\u00ed relativn\u011b nov\u00fdch zranitelnost\u00ed.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0430\u044f \u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Akamai, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 cups-browsed, \u043f\u043e\u043c\u0438\u043c\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0432\u0435\u043d\u044c\u0435\u0432 \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u043c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0427\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 cups-browsed, \u0431\u0435\u0437 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u044e\u0449\u0435\u043c\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043d\u0430 631 \u043f\u043e\u0440\u0442\u0443, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u0445\u043e\u0441\u0442, \u0440\u0430\u0437\u043c\u0435\u0440 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0435\u0432\u044b\u0448\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120072","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v CUPS se uk\u00e1zala b\u00fdt vhodn\u00e1 pro zes\u00edlen\u00ed provozu p\u0159i DDoS \u00fatoc\u00edch | ProHoster","description":"Skupina zodpov\u011bdn\u00e1 za bezpe\u010dnost s\u00edt\u011b pro doru\u010dov\u00e1n\u00ed obsahu Akamai odhalila dal\u0161\u00ed vektor \u00fatoku na proces cups-browsed, krom\u011b jeho vyu\u017eit\u00ed jako jednoho z \u010dl\u00e1nk\u016f v exploitu, vedouc\u00edm k.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CUPS \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u0430 \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u0440\u0438 DDoS-\u0430\u0442\u0430\u043a\u0430\u0445 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0430\u044f \u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Akamai, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 cups-browsed, \u043f\u043e\u043c\u0438\u043c\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0432\u0435\u043d\u044c\u0435\u0432 \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u043c \u043a.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-10-07T11:09:25+00:00","article:modified_time":"2024-10-07T11:09:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120072","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:46:25","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 07:07:19","updated":"2026-02-22 15:46:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120072","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=120072"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120072\/revisions"}],"predecessor-version":[{"id":162469,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120072\/revisions\/162469"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=120072"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=120072"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=120072"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}