{"id":97349,"date":"2020-10-17T14:42:14","date_gmt":"2020-10-17T12:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/minimizacziya-riskov-ispolzovaniya-dns-over-tls-dot-i-dns-over-https-doh"},"modified":"2020-10-17T14:42:14","modified_gmt":"2020-10-17T12:42:14","slug":"minimizacziya-riskov-ispolzovaniya-dns-over-tls-dot-i-dns-over-https-doh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/minimizacziya-riskov-ispolzovaniya-dns-over-tls-dot-i-dns-over-https-doh","title":{"rendered":"Minimalizace rizik spojen\u00fdch s pou\u017eit\u00edm DNS-over-TLS (DoT) a DNS-over-HTTPS (DoH)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"MinimalizaceMinimalizace rizik spojen\u00fdch s pou\u017eit\u00edm DoH a DoT<\/p>\n

Ochrana proti DoH a DoT<\/h2>\n

Kontrolujete sv\u016fj DNS provoz? Organizace investuj\u00ed mnoho \u010dasu, pen\u011bz a \u00fasil\u00ed do zabezpe\u010den\u00ed sv\u00fdch s\u00edt\u00ed. Jednou z oblast\u00ed, kter\u00e9 jsou \u010dasto opom\u00edjeny, je DNS. <\/p>\n

Dobr\u00e9 shrnut\u00ed rizik vypl\u00fdvaj\u00edc\u00edch z DNS je prezentace spole\u010dnosti Verisign<\/a><\/noindex> na konferenci Infosecurity. <\/p>\n

\"Minimalizace31 % zkouman\u00fdch t\u0159\u00edd ransomwaru pou\u017eilo DNS k v\u00fdm\u011bn\u011b kl\u00ed\u010d\u016f. Z\u00e1v\u011bry studie<\/p>\n

31 % zkouman\u00fdch t\u0159\u00edd ransomwaru pou\u017eilo DNS k v\u00fdm\u011bn\u011b kl\u00ed\u010d\u016f.<\/p>\n

Probl\u00e9m je v\u00e1\u017en\u00fd. Podle v\u00fdzkumn\u00e9 laborato\u0159e Palo Alto Networks Unit 42 p\u0159ibli\u017en\u011b 85 % malware pou\u017e\u00edv\u00e1 DNS k vytvo\u0159en\u00ed komunika\u010dn\u00edho a kontroln\u00edho kan\u00e1lu, co\u017e \u00fato\u010dn\u00edk\u016fm usnad\u0148uje vnik\u00e1n\u00ed do va\u0161\u00ed s\u00edt\u011b a kr\u00e1de\u017e dat. Od sv\u00e9ho vzniku byl provoz DNS p\u0159ev\u00e1\u017en\u011b neza\u0161ifrovan\u00fd a bylo snadn\u00e9 jej analyzovat ochran\u00fdmi mechanismy NGFW. <\/p>\n

Objevily se nov\u00e9 protokoly pro DNS zam\u011b\u0159en\u00e9 na zv\u00fd\u0161en\u00ed d\u016fv\u011brnosti DNS p\u0159ipojen\u00ed. Tyto protokoly jsou aktivn\u011b podporov\u00e1ny p\u0159edn\u00edmi poskytovateli prohl\u00ed\u017ee\u010d\u016f a dal\u0161\u00edmi dodavateli softwaru. Brzy dojde k n\u00e1r\u016fstu \u0161ifrovan\u00e9ho DNS provozu v podnikov\u00fdch s\u00edt\u00edch. \u0160ifrovan\u00fd DNS provoz, kter\u00fd nen\u00ed spr\u00e1vn\u011b analyzov\u00e1n a je povolen, p\u0159edstavuje bezpe\u010dnostn\u00ed hrozbu pro spole\u010dnost. Takovou hrozbou jsou nap\u0159\u00edklad ransomwarov\u00e9 \u00fatoky, kter\u00e9 vyu\u017e\u00edvaj\u00ed DNS k v\u00fdm\u011bn\u011b \u0161ifrovac\u00edch kl\u00ed\u010d\u016f. \u00dato\u010dn\u00edci nyn\u00ed po\u017eaduj\u00ed v\u00fdkupn\u00e9 v \u0159\u00e1du n\u011bkolika milion\u016f dolar\u016f za obnoven\u00ed p\u0159\u00edstupu k va\u0161im dat\u016fm. Ve spole\u010dnosti Garmin, nap\u0159\u00edklad, zaplatili 10 milion\u016f dolar\u016f.<\/p>\n

P\u0159i spr\u00e1vn\u00e9m nastaven\u00ed mohou NGFW zakazovat nebo chr\u00e1nit pou\u017e\u00edv\u00e1n\u00ed DNS-over-TLS (DoT) a mohou b\u00fdt pou\u017eity k z\u00e1kazu pou\u017e\u00edv\u00e1n\u00ed DNS-over-HTTPS (DoH), co\u017e umo\u017e\u0148uje analyzovat ve\u0161ker\u00fd DNS provoz va\u0161\u00ed s\u00edt\u011b.<\/p>\n

Co je \u0161ifrovan\u00fd DNS?<\/h2>\n

Co je DNS<\/p>\n

Syst\u00e9m dom\u00e9nov\u00fdch jmen (DNS) p\u0159ev\u00e1d\u00ed u\u017eivatelsky p\u0159\u00edv\u011btiv\u00e9 dom\u00e9nov\u00e9 n\u00e1zvy (nap\u0159\u00edklad adresu www.paloaltonetworks.com<\/a><\/noindex> ) na IP adresu (nap\u0159\u00edklad 34.107.151.202). Kdy\u017e u\u017eivatel zad\u00e1 dom\u00e9nov\u00e9 jm\u00e9no do webov\u00e9ho prohl\u00ed\u017ee\u010de, prohl\u00ed\u017ee\u010d ode\u0161le DNS dotaz na DNS server s \u017e\u00e1dost\u00ed o IP adresu spojenou s t\u00edmto dom\u00e9nov\u00fdm jm\u00e9nem. V odpov\u011bdi DNS server vrac\u00ed IP adresu, kterou tento prohl\u00ed\u017ee\u010d pou\u017eije.<\/p>\n

DNS dotazy a odpov\u011bdi jsou pos\u00edl\u00e1ny po s\u00edti jako oby\u010dejn\u00fd text v neza\u0161ifrovan\u00e9 podob\u011b, co\u017e je \u010din\u00ed zraniteln\u00fdmi v\u016f\u010di \u0161pehov\u00e1n\u00ed nebo zm\u011bn\u011b odpov\u011bdi a p\u0159esm\u011brov\u00e1n\u00ed prohl\u00ed\u017ee\u010de na \u0161kodliv\u00e9 servery. \u0160ifrov\u00e1n\u00ed DNS komplikuje sledov\u00e1n\u00ed DNS dotaz\u016f nebo jejich zm\u011bnu b\u011bhem p\u0159enosu. \u0160ifrov\u00e1n\u00ed DNS dotaz\u016f a odpov\u011bd\u00ed v\u00e1s chr\u00e1n\u00ed p\u0159ed \u00fatokem typu Man-in-the-Middle, p\u0159i\u010dem\u017e vykon\u00e1v\u00e1 stejn\u00e9 funkce, jak\u00e9 m\u00e1 tradi\u010dn\u00ed protokol DNS (syst\u00e9m dom\u00e9nov\u00fdch jmen) v otev\u0159en\u00e9m textu. <\/p>\n

V posledn\u00edch n\u011bkolika letech byly zavedeny dva protokoly pro \u0161ifrov\u00e1n\u00ed DNS:<\/p>\n

    \n
  1. \n

    DNS-over-HTTPS (DoH)<\/p>\n<\/li>\n

  2. \n

    DNS-over-TLS (DoT) <\/p>\n<\/li>\n<\/ol>\n

    Tyto protokoly maj\u00ed jednu spole\u010dnou vlastnost: \u00famysln\u011b skr\u00fdvaj\u00ed DNS dotazy p\u0159ed jak\u00fdmkoli odposlechem\u2026 v\u010detn\u011b bezpe\u010dnostn\u00edch pracovn\u00edk\u016f organizace. Protokoly zejm\u00e9na pou\u017e\u00edvaj\u00ed protokol TLS (Transport Layer Security) k vytvo\u0159en\u00ed \u0161ifrovan\u00e9ho p\u0159ipojen\u00ed mezi klientem, kter\u00fd prov\u00e1d\u00ed dotazy, a serverem, kter\u00fd tyto dotazy DNS vy\u0159izuje, p\u0159es port, kter\u00fd se obvykle pro DNS provoz nepou\u017e\u00edv\u00e1.<\/p>\n

    Ochrana soukrom\u00ed DNS dotaz\u016f je velk\u00fdm plusem t\u011bchto protokol\u016f. Nicm\u00e9n\u011b vytv\u00e1\u0159ej\u00ed probl\u00e9my pro bezpe\u010dnostn\u00ed pracovn\u00edky, kte\u0159\u00ed mus\u00ed sledovat s\u00ed\u0165ov\u00fd provoz a detekovat a blokovat \u0161kodliv\u00e9 p\u0159ipojen\u00ed. Proto\u017ee se protokoly li\u0161\u00ed ve sv\u00e9 implementaci, metody anal\u00fdzy se budou li\u0161it pro DoH a DoT.<\/p>\n

    DNS over HTTPS (DoH)<\/h2>\n

    \"MinimalizaceDNS uvnit\u0159 HTTPS<\/p>\n

    DoH pou\u017e\u00edv\u00e1 dob\u0159e zn\u00e1m\u00fd port 443 pro HTTPS, pro kter\u00fd je v RFC specificky uvedeno, \u017ee \u00fakolem je \u201esm\u00edchat provoz DoH s jin\u00fdm HTTPS provozem ve stejn\u00e9m spojen\u00ed\u201c, \u201ezt\u00ed\u017eit anal\u00fdzu DNS provozu\u201c a t\u00edm obej\u00edt opat\u0159en\u00ed podnikov\u00e9 kontroly ( RFC 8484 DoH, sekce 8.1<\/a><\/noindex> ). Protokol DoH pou\u017e\u00edv\u00e1 \u0161ifrov\u00e1n\u00ed TLS a syntaxi po\u017eadavk\u016f, kterou poskytuj\u00ed b\u011b\u017en\u00e9 standardy HTTPS a HTTP\/2, p\u0159i\u010dem\u017e p\u0159id\u00e1v\u00e1 DNS dotazy a odpov\u011bdi nad standardn\u00edmi HTTP po\u017eadavky.<\/p>\n

    Rizika spojen\u00e1 s DoH<\/h2>\n

    Pokud nedok\u00e1\u017eete rozli\u0161it b\u011b\u017en\u00fd HTTPS provoz od po\u017eadavk\u016f DoH, mohou aplikace ve va\u0161\u00ed organizaci (a budou) obch\u00e1zet m\u00edstn\u00ed nastaven\u00ed DNS p\u0159esm\u011brov\u00e1n\u00edm po\u017eadavk\u016f na extern\u00ed servery, kter\u00e9 odpov\u00eddaj\u00ed na po\u017eadavky DoH, co\u017e obch\u00e1z\u00ed jak\u00e9koli monitorov\u00e1n\u00ed, tedy odstran\u00ed mo\u017enost kontroly DNS provozu. Ide\u00e1ln\u011b byste m\u011bli DoH kontrolovat pomoc\u00ed funkc\u00ed de\u0161ifrov\u00e1n\u00ed HTTPS. <\/p>\n

    A Google a Mozilla implementovaly mo\u017enosti DoH<\/a><\/noindex> v posledn\u00edch verz\u00edch sv\u00fdch prohl\u00ed\u017ee\u010d\u016f a ob\u011b spole\u010dnosti pracuj\u00ed na pou\u017eit\u00ed DoH jako v\u00fdchoz\u00edho nastaven\u00ed pro v\u0161echny DNS po\u017eadavky. Microsoft tak\u00e9 vyv\u00edj\u00ed pl\u00e1ny<\/a><\/noindex> na integraci DoH do sv\u00fdch opera\u010dn\u00edch syst\u00e9m\u016f. Nev\u00fdhodou je, \u017ee nejen respektovan\u00e9 spole\u010dnosti vyv\u00edjej\u00edc\u00ed software, ale i zlo\u010dinci za\u010dali pou\u017e\u00edvat DoH jako prost\u0159edek obch\u00e1zen\u00ed tradi\u010dn\u00edch opat\u0159en\u00ed firewalu. (Nap\u0159\u00edklad si p\u0159e\u010dt\u011bte n\u00e1sleduj\u00edc\u00ed \u010dl\u00e1nky: PsiXBot nyn\u00ed pou\u017e\u00edv\u00e1 Google DoH<\/a><\/noindex> , PsiXBot se st\u00e1le vyv\u00edj\u00ed s aktualizovanou infrastrukturou DNS<\/a><\/noindex> a anal\u00fdza zadn\u00edho vstupu Godlua<\/a><\/noindex> .) V ka\u017ed\u00e9m p\u0159\u00edpad\u011b jak dobr\u00fd, tak \u0161kodliv\u00fd provoz DoH z\u016fstane nepov\u0161imnut, co\u017e organizaci ponech\u00e1 slepou v\u016f\u010di zlovoln\u00e9mu pou\u017e\u00edv\u00e1n\u00ed DoH jako kan\u00e1lu pro \u0159\u00edzen\u00ed malwaru (C2) a kr\u00e1de\u017e citliv\u00fdch dat.<\/p>\n

    Zaji\u0161t\u011bn\u00ed viditelnosti a kontroly DoH provozu<\/h2>\n

    Jako nejlep\u0161\u00ed \u0159e\u0161en\u00ed pro kontrolu DoH doporu\u010dujeme nastavit v NGFW de\u0161ifrov\u00e1n\u00ed HTTPS provozu a blokov\u00e1n\u00ed DoH provozu (n\u00e1zev aplikace: dns-over-https). <\/p>\n

    Nejprve se ujist\u011bte, \u017ee je NGFW nastaveno pro de\u0161ifrov\u00e1n\u00ed HTTPS podle p\u0159\u00edru\u010dky k osv\u011bd\u010den\u00fdm postup\u016fm de\u0161ifrov\u00e1n\u00ed.<\/a><\/noindex>.<\/p>\n

    Za druh\u00e9, vytvo\u0159te pravidlo pro provoz aplikace \u00abdns-over-https\u00bb, jak je zn\u00e1zorn\u011bno n\u00ed\u017ee:<\/p>\n

    \"MinimalizacePravidlo Palo Alto Networks NGFW pro blokaci DNS-over-HTTPS<\/p>\n

    Jako alternativu (pokud va\u0161e organizace je\u0161t\u011b zcela neimplementovala de\u0161ifrov\u00e1n\u00ed HTTPS) lze NGFW nastavit na aplikaci akci \u201ezak\u00e1zat\u201c pro identifik\u00e1tor aplikace \u201edns-over-https\u201c, ale \u00fa\u010dinek bude omezen na blokaci ur\u010dit\u00fdch dob\u0159e zn\u00e1m\u00fdch DoH server\u016f podle jejich dom\u00e9nov\u00e9ho jm\u00e9na, proto\u017ee bez de\u0161ifrov\u00e1n\u00ed HTTPS nelze DoH provoz pln\u011b zkontrolovat (viz.  Applipedia od Palo Alto Networks<\/a><\/noindex>   a vyhledejte fr\u00e1zi \u201edns-over-https\u201c).<\/p>\n

    DNS over TLS (DoT)<\/h2>\n

    \"MinimalizaceDNS uvnit\u0159 TLS<\/p>\n

    Zat\u00edmco protokol DoH se sna\u017e\u00ed m\u00edsit s jin\u00fdm provozem na stejn\u00e9 portu, DoT naopak pou\u017e\u00edv\u00e1 speci\u00e1ln\u00ed port vyhrazen\u00fd pro tento jedin\u00fd \u00fa\u010del, p\u0159i\u010dem\u017e v\u00fdslovn\u011b zakazuje pou\u017e\u00edv\u00e1n\u00ed stejn\u00e9ho portu pro tradi\u010dn\u00ed neza\u0161ifrovan\u00fd provoz DNS ( RFC 7858, odd\u00edl 3.1<\/a><\/noindex> ).<\/p>\n

    Protokol DoT pou\u017e\u00edv\u00e1 protokol TLS k zaji\u0161t\u011bn\u00ed \u0161ifrov\u00e1n\u00ed, kter\u00e9 encapsuluje standardn\u00ed dotazy protokolu DNS, s provozem pou\u017e\u00edvaj\u00edc\u00edm dob\u0159e zn\u00e1m\u00fd port 853 ( RFC 7858, odd\u00edl 6<\/a><\/noindex> ). Protokol DoT byl navr\u017een tak, aby usnadnil organizac\u00edm blokov\u00e1n\u00ed provozu na portu, nebo se dohodnout na jeho pou\u017eit\u00ed, ale zapnout de\u0161ifrov\u00e1n\u00ed na tomto portu.<\/p>\n

    Rizika spojen\u00e1 s DoT<\/h2>\n

    Google implementoval DoT ve sv\u00e9m klientovi Android 9 Pie a nov\u011bj\u0161\u00edch verz\u00edch<\/a><\/noindex> , p\u0159i\u010dem\u017e v\u00fdchoz\u00edm nastaven\u00edm je automatick\u00e9 pou\u017e\u00edv\u00e1n\u00ed DoT, pokud je k dispozici. Pokud jste ohodnotili rizika a jste p\u0159ipraveni na pou\u017eit\u00ed DoT na \u00farovni organizace, je pot\u0159eba, aby s\u00ed\u0165ov\u00ed administr\u00e1to\u0159i v\u00fdslovn\u011b povolili odchoz\u00ed provoz na portu 853 p\u0159es sv\u016fj perimetr pro tento nov\u00fd protokol.<\/p>\n

    Zaji\u0161t\u011bn\u00ed viditelnosti a kontroly provozu DoT<\/h2>\n

    Jako nejlep\u0161\u00ed praxi kontroly DoT doporu\u010dujeme kter\u00e9koliv z v\u00fd\u0161e uveden\u00e9ho, \u200b\u200bna z\u00e1klad\u011b po\u017eadavk\u016f va\u0161\u00ed organizace:<\/p>\n