En gruppe forskere fra University of California, Riverside, har offentliggjort en ny variant af SAD DNS-angrebet (CVE-2021-20322), som fungerer trods de beskyttelser, der blev tilf\u00f8jet sidste \u00e5r for at blokere s\u00e5rbarheden CVE-2020-25705. Den nye metode ligner generelt den tidligere s\u00e5rbarhed, men adskiller sig blot ved at bruge en anden type ICMP-pakker til at kontrollere aktive UDP-porte. Det foresl\u00e5ede angreb muligg\u00f8r inds\u00e6ttelse af falske data i DNS-serverens cache, hvilket kan bruges til at \u00e6ndre IP-adressen for et vilk\u00e5rligt dom\u00e6ne i cachen og omdirigere foresp\u00f8rgsler til dom\u00e6net til en ondsindet server. <\/p>\n
Den foresl\u00e5ede metode fungerer kun i Linux-netv\u00e6rksstakken p\u00e5 grund af knytningen til, hvordan ICMP-pakkebehandlingsmekanismen i Linux fungerer, hvilket er en kilde til datal\u00e6kager, der letter bestemmelsen af det anvendte UDP-portnummer. serveren<\/a> for at sende en ekstern foresp\u00f8rgsel. \u00c6ndringer, der blokkerer datal\u00e6kager, blev accepteret i Linux-kernen i slutningen af august (rettelsen blev en del af kerne 5.15 og de septemberopdateringer af LTS-kernerne). Rettelsen g\u00e5r ud p\u00e5 at skifte til at bruge SipHash-hash-algoritmen i netv\u00e6rkscacherne i stedet for Jenkins Hash. Status for udbedring af s\u00e5rbarheden i distributionerne kan vurderes p\u00e5 f\u00f8lgende sider: Debian, RHEL, Fedora, SUSE, Ubuntu. <\/p>\n If\u00f8lge de forskere, der har identificeret problemet, er cirka 38% af de \u00e5bne resolvere, der er tilg\u00e6ngelige online, s\u00e5rbare, inklusive popul\u00e6re DNS-tjenester som OpenDNS og Quad9 (9.9.9.9). Hvad ang\u00e5r serversoftware, kan angrebet udf\u00f8res p\u00e5 en Linux-server med pakker som BIND, Unbound og dnsmasq. P\u00e5 DNS-servere, der k\u00f8rer med Windows- og BSD-systemer, opst\u00e5r problemet ikke. For at udf\u00f8re angrebet med succes skal der anvendes IP-spoofing, dvs. det kr\u00e6ves, at udbyderen af den angribende enhed ikke blokerer pakker med en falsk kilde-IP-adresse. <\/p>\n Vi minder om, at SAD DNS-angrebet muligg\u00f8r at omg\u00e5 den beskyttelse, der er tilf\u00f8jet i DNS-servere for at blokere den klassiske metode til DNS-cache-forgiftning, foresl\u00e5et af Dan Kaminsky i 2008. Kaminskys metode manipulerer med den beskedne st\u00f8rrelse af identifikationsnummerfeltet for DNS-foresp\u00f8rgslen, som kun er 16 bit. For at finde den korrekte DNS-transaktionsidentifikator, der er n\u00f8dvendig for at spoofe et v\u00e6rtsnavn, er det tilstr\u00e6kkeligt at sende omkring 7000 foresp\u00f8rgsler og simulere ca. 140.000 falske svar. Angrebet best\u00e5r i at sende et stort antal pakker til DNS-resolveren med en falsk binding til IP og med forskellige DNS-transaktionsidentifikatorer. For at forhindre caching af det f\u00f8rste svar angives der i hvert falskt svar et lidt \u00e6ndret dom\u00e6nenavn (1.example.com, 2.example.com, 3.example.com osv.). <\/p>\n For at beskytte mod denne type angreb har producenterne af DNS-servere implementeret tilf\u00e6ldig tildeling af startnetv\u00e6rksporte, som foresp\u00f8rgslerne sendes fra, hvilket kompenserer for den ikke tilstr\u00e6kkeligt store st\u00f8rrelse af identifikatoren. Efter implementeringen af beskyttelsen blev det foruden at finde den 16-bit identifikator n\u00f8dvendigt ogs\u00e5 at finde en af 64.000 porte, hvilket \u00f8gede antal muligheder for s\u00f8gning til 2^32. <\/p>\n SAD DNS-metoden g\u00f8r det muligt at forenkle bestemmelsen af netv\u00e6rksportnummeret drastisk og reducerer angrebet til den klassiske Kaminsky-metode. Angriberen kan identificere anmodninger til inaktive og aktive UDP-porte ved at udnytte l\u00e6kagen af oplysninger om aktiviteten af netv\u00e6rksporte under behandlingen af ICMP-pakkesvar. Metoden muligg\u00f8r en reduktion af antallet af mulige kombinationer med 4 ordner \u2014 2^16+2^16 i stedet for 2^32 (131_072 i stedet for 4_294_967_296). L\u00e6kagen af oplysninger, der hurtigt kan identificere aktive UDP-porte, er for\u00e5rsaget af utilstr\u00e6kkelig implementering i koden til behandling af ICMP-pakker med fragmenteringsanmodninger (flaget ICMP Fragmentation Needed) eller omdirigering (flaget ICMP Redirect). Afsendelsen af s\u00e5danne pakker \u00e6ndrer tilstanden af cachen i netv\u00e6rksstakken, hvilket g\u00f8r det muligt at bestemme, hvilken UDP-port der er aktiv, baseret p\u00e5 serverens reaktion. <\/p>\n Angrebsscenario: N\u00e5r en DNS-resolver fors\u00f8ger at bestemme dom\u00e6nenavnet, sender den en UDP-foresp\u00f8rgsel til den tilh\u00f8rende DNS-server. I det \u00f8jeblik, hvor resolveren venter p\u00e5 svar, kan angriberen hurtigt identificere det oprindelige portnummer, der blev brugt til at sende foresp\u00f8rgslen, og sende et falsk svar til det samme portnummer, og udgive sig for at v\u00e6re den tilh\u00f8rende DNS-server ved hj\u00e6lp af spoofing. IP-adresser<\/a>DNS-resolveren vil placere de data, der blev sendt i det falske svar, i cachen og i en periode returnere den indsatte IP-adresse til alle andre DNS-foresp\u00f8rgsler for dom\u00e6nenavnet. \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-25705. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0432 \u0446\u0435\u043b\u043e\u043c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0442\u0438\u043f\u0430 ICMP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 UDP-\u043f\u043e\u0440\u0442\u043e\u0432. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102308","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ny variant af SAD DNS-angrebet til indstilling af falske data i DNS-caching | ProHoster","description":"En gruppe forskere fra University of California, Riverside, har offentliggjort en ny variant af SAD DNS-angrebet (CVE-2021-20322), som fungerer trods den beskyttelse, der blev tilf\u00f8jet sidste \u00e5r for at blokere s\u00e5rbarheden.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-17T19:36:54+00:00","article:modified_time":"2021-11-17T19:36:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102308","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-17 19:38:17","updated":"2026-02-09 21:46:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=102308"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102308\/revisions"}],"predecessor-version":[{"id":160307,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102308\/revisions\/160307"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=102308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=102308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=102308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"