{"id":102321,"date":"2021-11-18T21:36:40","date_gmt":"2021-11-18T19:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere"},"modified":"2021-11-18T21:36:40","modified_gmt":"2021-11-18T19:36:41","slug":"predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","title":{"rendered":"En foresl\u00e5et angrebsmetode til fjernbestemmelse af hukommelsesfragmenter p\u00e5 serveren","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En gruppe forskere fra Graz Universitet (\u00d8strig), tidligere kendt for angreb som MDS, NetSpectre, Throwhammer og ZombieLoad, har offentliggjort en ny angrebsmetode (CVE-2021-3714) via sidekanaler p\u00e5 mekanismen for hukommelsesdeduplicering, som g\u00f8r det muligt at bestemme tilstedev\u00e6relsen af bestemte data i hukommelsen, organisere byte-for-byte l\u00e6kage af hukommelsesindhold eller bestemme hukommelseslayoutet for at omg\u00e5 beskyttelse baseret p\u00e5 adresse-randomisering (ASLR). I mods\u00e6tning til tidligere viste angrebsvarianter p\u00e5 dedupliceringsmekanismen, adskiller den nye metode sig ved at udf\u00f8re angrebet fra en ekstern v\u00e6rt ved at bruge \u00e6ndringen i svartid p\u00e5 de angrebte foresp\u00f8rgsler gennem HTTP\/1 og HTTP\/2 protokoller som kriterier. Angrebsmuligheden er blevet demonstreret p\u00e5 servere baseret p\u00e5 Linux og Windows. <\/p>\n

Angreb p\u00e5 mekanismen for hukommelsesdeduplicering bruger behandlingstiden af skriveoperationer som kanal til at l\u00e6kke oplysninger, n\u00e5r data\u00e6ndringer f\u00f8rer til kloning af den deduplikerede hukommelses-side ved hj\u00e6lp af mekanismen Copy-On-Write (COW). Under arbejdet bestemmer kernen identiske hukommelsessider fra forskellige processer og kombinerer dem, hvilket viser identiske hukommelsessider i et omr\u00e5de af den fysiske hukommelse for at gemme kun \u00e9n kopi. N\u00e5r et af processerne fors\u00f8ger at \u00e6ndre data relateret til de deduplikerede sider, opst\u00e5r der en undtagelse (page fault), og ved hj\u00e6lp af mekanismen Copy-On-Write oprettes der automatisk en separat kopi af hukommelsessiden, som tilknyttes processen. Den ekstra tid, der bruges til at udf\u00f8re kopieringen, kan v\u00e6re et tegn p\u00e5 data\u00e6ndringer, der krydser en anden proces. <\/p>\n

Forskere har vist, at de forsinkelser, der opst\u00e5r som f\u00f8lge af COW-mekanismen, kan fanges ikke kun lokalt, men ogs\u00e5 ved at analysere netv\u00e6rksresponsens leveringstid. Flere metoder til at bestemme hukommelsesindholdet fra en ekstern v\u00e6rt er blevet foresl\u00e5et gennem analyse af svartid for foresp\u00f8rgsler via HTTP\/1 og HTTP\/2 protokoller. Typiske webapplikationer, der gemmer information indsendt i foresp\u00f8rgsler, bruges til at bevare de valgte m\u00f8nstre. <\/p>\n

Det grundl\u00e6ggende princip for angrebet g\u00e5r ud p\u00e5 at fylde p\u00e5 serveren<\/a> Hukommelsessider med data, som potentielt kan gentage indholdet p\u00e5 allerede eksisterende hukommelsessider p\u00e5 serveren. Angriberen venter derefter p\u00e5 den tid, der er n\u00f8dvendig for kernen at udf\u00f8re deduplikation og sammensmeltning af hukommelsessiderne, hvorefter han \u00e6ndrer den kontrollerede datadublet og vurderer svartiden for at bestemme succesraten for indgrebet.

\"En<\/center> <\/p>\n

I de gennemf\u00f8rte eksperimenter var den maksimale hastighed for informationsl\u00e6kage 34,41 byte i timen ved angreb gennem det globale netv\u00e6rk og 302,16 byte i timen ved angreb gennem det lokale netv\u00e6rk, hvilket er hurtigere end andre metoder til at udvinde data gennem tredjeparts kanaler (for eksempel er dataoverf\u00f8rselshastigheden ved NetSpectre 7,5 byte i timen). <\/p>\n

Tre arbejdsversioner af angrebet er blevet foresl\u00e5et. Den f\u00f8rste variant g\u00f8r det muligt at bestemme data i hukommelsen. webserveren<\/a>, hvor Memcached anvendes. Angrebet g\u00e5r ud p\u00e5 at indl\u00e6se bestemte datas\u00e6t i Memcached-lageret, rydde det deduplikede blok og genindskrive det samme element, hvilket skaber betingelser for opst\u00e5else af COW-kopiering ved at \u00e6ndre indholdet i blokken. I eksperimentet med Memcached lykkedes det at bestemme versionen af libc installeret i systemet, der k\u00f8rer i en virtuel maskine, p\u00e5 166,51 sekunder. <\/p>\n

Den anden variant gav mulighed for at finde indholdet af poster i database-registreringssystemet MariaDB, ved at bruge InnoDB-lageret, gennem rekonstruktion af indholdet byte for byte. Angrebet udf\u00f8res ved at sende s\u00e6rligt modificerede foresp\u00f8rgsler, der f\u00f8rer til en-byte uoverensstemmelser i hukommelsessiderne og analyse af svartiden for at bestemme, at g\u00e6ttet om byteindholdet var korrekt. Hastigheden for en s\u00e5dan l\u00e6kage er beskeden og udg\u00f8r 1,5 byte i timen ved angreb fra det lokale netv\u00e6rk. En fordel ved metoden er, at den kan anvendes til at genskabe ukendt indhold i hukommelsen. <\/p>\n

Den tredje variant gjorde det muligt at omg\u00e5 KASLR-beskyttelsesmekanismen fuldst\u00e6ndigt p\u00e5 4 minutter og f\u00e5 information om forskydningen i hukommelsen af kernen til den virtuelle maskine, n\u00e5r forskydningsadressen ligger i en hukommelsesside, hvor andre data ikke \u00e6ndres. Angrebet blev udf\u00f8rt fra en v\u00e6rt, der befandt sig 14 transit-hop v\u00e6k fra det angrebne system. Eksempler p\u00e5 kode til at udf\u00f8re de n\u00e6vnte angreb vil blive offentliggjort p\u00e5 GitHub.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u043d\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0434\u0435\u0434\u0443\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 (Memory-Deduplication), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0431\u0430\u0439\u0442\u043e\u0432\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u043a\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 (ASLR). \u041e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102322,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Foresl\u00e5et angrebsmetode til fjernbestemmelse af hukommelsesfragmenter p\u00e5 serveren | ProHoster","description":"En gruppe forskere fra Graz Tekniske Universitet (\u00d8strig), tidligere kendt for udviklingen af MDS-, NetSpectre-, Throwhammer- og ZombieLoad-angreb, har offentliggjort en ny angrebsmetode (CVE-2021-3714) via sidekanaler.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-18T19:36:41+00:00","article:modified_time":"2021-11-18T19:36:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102321","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-18 19:37:43","updated":"2026-02-09 21:39:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=102321"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102321\/revisions"}],"predecessor-version":[{"id":159967,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102321\/revisions\/159967"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/102322"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=102321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=102321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=102321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}