{"id":82460,"date":"2020-05-21T19:42:00","date_gmt":"2020-05-21T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery"},"modified":"2020-05-21T19:42:00","modified_gmt":"2020-05-21T17:42:00","slug":"ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","title":{"rendered":"\u00datok NXNSAttack, kter\u00fd se dot\u00fdk\u00e1 v\u0161ech DNS resolver\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f z Telavivsk\u00e9 univerzity a Mezioborov\u00e9ho centra v Herzliyi (Izrael) vyvinula<\/a><\/noindex> novou metodu \u00fatoku NXNSAttack<\/a><\/noindex> (PDF<\/a><\/noindex>), kter\u00e1 umo\u017e\u0148uje vyu\u017e\u00edt libovoln\u00e9 DNS resolvery jako zesilova\u010de provozu, dosahuj\u00edc\u00ed stupn\u011b zes\u00edlen\u00ed a\u017e 1621 n\u00e1sobku po\u010dtu paket\u016f (na ka\u017ed\u00fd odeslan\u00fd po\u017eadavek k resolveru lze dos\u00e1hnout odesl\u00e1n\u00ed 1621 po\u017eadavk\u016f na server ob\u011bti) a a\u017e 163 n\u00e1sobku podle provozu. <\/p>\n

Probl\u00e9m souvis\u00ed se specifiky fungov\u00e1n\u00ed protokolu a zasahuje v\u0161echny DNS servery, kter\u00e9 podporuj\u00ed rekurzivn\u00ed zpracov\u00e1n\u00ed po\u017eadavk\u016f, v\u010detn\u011b BIND<\/a><\/noindex> (CVE-2020-8616), Knot<\/a><\/noindex> (CVE-2020-12667), PowerDNS<\/a><\/noindex> (CVE-2020-10995), Windows DNS Server<\/a><\/noindex> a Unbound<\/a><\/noindex> (CVE-2020-12662), a tak\u00e9 ve\u0159ejn\u00e9 DNS slu\u017eby Google, Cloudflare, Amazon, Quad9, ICANN a dal\u0161\u00edch spole\u010dnost\u00ed. Oprava probl\u00e9mu byla koordinov\u00e1na s v\u00fdvoj\u00e1\u0159i DNS server\u016f, kte\u0159\u00ed z\u00e1rove\u0148 vydali aktualizace s opravou zranitelnosti ve sv\u00fdch produktech. Ochrana proti \u00fatoku byla zavedena v verz\u00edch
\nUnbound 1.10.1<\/a><\/noindex>, Knot Resolver 5.1.1<\/a><\/noindex>, PowerDNS Recursor 4.3.1, 4.2.2, 4.1.16<\/a><\/noindex>, BIND 9.11.19, 9.14.12, 9.16.3<\/a><\/noindex>.<\/p>\n

\u00datok se zakl\u00e1d\u00e1 na pou\u017e\u00edv\u00e1n\u00ed \u00fato\u010dn\u00edkem po\u017eadavk\u016f odkazuj\u00edc\u00edch na velk\u00e9 mno\u017estv\u00ed d\u0159\u00edve nevid\u011bn\u00fdch fiktivn\u00edch NS z\u00e1znam\u016f, kter\u00fdm je delegov\u00e1no ur\u010den\u00ed jm\u00e9na, ale bez uveden\u00ed v odpov\u011bdi glue z\u00e1znam\u016f s informacemi o IP adres\u00e1ch NS server\u016f. Nap\u0159\u00edklad \u00fato\u010dn\u00edk ode\u0161le po\u017eadavek na ur\u010den\u00ed jm\u00e9na sd1.attacker.com, p\u0159i\u010dem\u017e ovl\u00e1d\u00e1 DNS server odpov\u00eddaj\u00edc\u00ed za dom\u00e9nu attacker.com. V odpov\u011bdi na dotaz resolveru k DNS serveru \u00fato\u010dn\u00edka se vr\u00e1t\u00ed odpov\u011b\u010f, kter\u00e1 deleguje ur\u010den\u00ed adresy sd1.attacker.com DNS serveru ob\u011bti prost\u0159ednictv\u00edm uveden\u00ed NS z\u00e1znam\u016f bez detailizace IP NS server\u016f. Jeliko\u017e zm\u00edn\u011bn\u00fd NS server p\u0159edt\u00edm nebyl vid\u011bn a jeho IP adresa nen\u00ed uvedena, resolver se pokou\u0161\u00ed ur\u010dit IP adresu NS serveru, a to t\u00edm, \u017ee ode\u0161le dotaz k DNS serveru ob\u011bti, kter\u00fd spravuje c\u00edlovou dom\u00e9nu (victim.com).<\/p>\n

\"\u00datok<\/a><\/noindex><\/center><\/p>\n

Probl\u00e9m je v tom, \u017ee \u00fato\u010dn\u00edk m\u016f\u017ee vr\u00e1tit obrovsk\u00fd seznam unik\u00e1tn\u00edch NS server\u016f s neexistuj\u00edc\u00edmi fiktivn\u00edmi n\u00e1zvy subdom\u00e9n ob\u011bti (fake-1.victim.com, fake-2.victim.com, \u2026 fake-1000.victim.com). Resolver se pokus\u00ed odeslat dotaz DNS serveru ob\u011bti, ale dostane odpov\u011b\u010f, \u017ee dom\u00e9na nebyla nalezena, a pot\u00e9 se pokus\u00ed ur\u010dit dal\u0161\u00ed NS server na seznamu a tak st\u00e1le d\u00e1l, dokud neprojde v\u0161emi uveden\u00fdmi NS z\u00e1znamy \u00fato\u010dn\u00edka. To znamen\u00e1, \u017ee na jeden dotaz \u00fato\u010dn\u00edka bude resolverem odesl\u00e1no obrovsk\u00e9 mno\u017estv\u00ed dotaz\u016f, aby zjistil NS hostitele. Proto\u017ee n\u00e1zvy NS server\u016f jsou generov\u00e1ny n\u00e1hodn\u011b a odkazuj\u00ed na neexistuj\u00edc\u00ed subdom\u00e9ny, nejsou vymaz\u00e1v\u00e1ny z cache a ka\u017ed\u00fd dotaz \u00fato\u010dn\u00edka zp\u016fsob\u00ed lavinu dotaz\u016f na DNS server, kter\u00fd obsluhuje dom\u00e9nu ob\u011bti.<\/p>\n

\"\u00datok<\/a><\/noindex><\/center><\/p>\n

V\u00fdzkumn\u00edci zkoumali m\u00edru zranitelnosti ve\u0159ejn\u00fdch DNS resolver\u016f a zjistili, \u017ee p\u0159i odes\u00edl\u00e1n\u00ed dotaz\u016f resolveru CloudFlare (1.1.1.1) lze dos\u00e1hnout zn\u00e1soben\u00ed po\u010dtu paket\u016f (PAF, Faktor Amplifikace Paketu) a\u017e 48kr\u00e1t, Google (8.8.8.8) - 30kr\u00e1t, FreeDNS (37.235.1.174) - 50kr\u00e1t, OpenDNS (208.67.222.222) - 32kr\u00e1t. V\u00fdrazn\u011bj\u0161\u00ed hodnoty jsou pozorov\u00e1ny pro
\nLevel3 (209.244.0.3) - 273kr\u00e1t, Quad9 (9.9.9.9) - 415kr\u00e1t
\nSafeDNS (195.46.39.39) - 274kr\u00e1t, Verisign (64.6.64.6) - 202kr\u00e1t,
\nUltra (156.154.71.1) - 405kr\u00e1t, Comodo Secure (8.26.56.26) - 435kr\u00e1t, DNS.Watch (84.200.69.80) - 486kr\u00e1t, a Norton ConnectSafe (199.85.126.10) - 569kr\u00e1t. Pro servery na b\u00e1zi BIND 9.12.3 m\u016f\u017ee \u00farove\u0148 zes\u00edlen\u00ed d\u00edky paralelizaci dotaz\u016f dos\u00e1hnout a\u017e 1000. V Knot Resolver 5.1.0 je \u00farove\u0148 zes\u00edlen\u00ed p\u0159ibli\u017en\u011b n\u011bkolik des\u00edtek znak\u016f (24-48), proto\u017ee ur\u010den\u00ed NS n\u00e1zv\u016f prob\u00edh\u00e1 sekven\u010dn\u011b a nar\u00e1\u017e\u00ed na vnit\u0159n\u00ed omezen\u00ed po\u010dtu krok\u016f rozli\u0161en\u00ed n\u00e1zv\u016f povolen\u00fdch pro jeden dotaz.<\/p>\n

Vyzna\u010duj\u00ed se dv\u011b hlavn\u00ed strategie ochrany. Pro syst\u00e9my s DNSSEC navrhnuto<\/a><\/noindex> pou\u017e\u00edt RFC-8198<\/a><\/noindex> pro zabr\u00e1n\u011bn\u00ed obch\u00e1zen\u00ed cache DNS, proto\u017ee dotazy jsou odes\u00edl\u00e1ny s n\u00e1hodn\u00fdmi n\u00e1zvy. Podstatou metody je generov\u00e1n\u00ed negativn\u00edch odpov\u011bd\u00ed bez osloven\u00ed autoritativn\u00edch DNS server\u016f, p\u0159i\u010dem\u017e se pou\u017e\u00edv\u00e1 ov\u011b\u0159en\u00ed podle rozsah\u016f p\u0159es DNSSEC. Jednodu\u0161\u0161\u00ed metodou je omezit po\u010det n\u00e1zv\u016f, kter\u00e9 lze ur\u010dit p\u0159i zpracov\u00e1n\u00ed jednoho delegovan\u00e9ho dotazu, av\u0161ak tato metoda m\u016f\u017ee zp\u016fsobit probl\u00e9my s n\u011bkter\u00fdmi existuj\u00edc\u00edmi konfiguracemi, proto\u017ee limity nejsou definov\u00e1ny v protokolu.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c) \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 NXNSAttack (PDF), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043b\u044e\u0431\u044b\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0441\u0442\u0435\u043f\u0435\u043d\u044c \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0434\u043e 1621 \u0440\u0430\u0437 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (\u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043a \u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u0443 \u0437\u0430\u043f\u0440\u043e\u0441, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b 1621 \u0437\u0430\u043f\u0440\u043e\u0441) \u0438 \u0434\u043e 163 \u0440\u0430\u0437 \u043f\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82460","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00datok NXNSAttack, kter\u00fd zasahuje v\u0161echny DNS resolvery | ProHoster","description":"Skupina v\u00fdzkumn\u00edk\u016f z Telavivsk\u00e9 univerzity a Mezioborov\u00e9ho centra v Herzliyi (Izrael)","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 NXNSAttack, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c)","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-21T17:42:00+00:00","article:modified_time":"2020-05-21T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82460","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:37:29","updated":"2022-09-29 14:28:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/82460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=82460"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/82460\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/82461"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=82460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=82460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=82460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}