{"id":82460,"date":"2020-05-21T19:42:00","date_gmt":"2020-05-21T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery"},"modified":"2020-05-21T19:42:00","modified_gmt":"2020-05-21T17:42:00","slug":"ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","title":{"rendered":"NXNSAttack-angreb, der ber\u00f8rer alle DNS-opl\u00f8sere","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En gruppe forskere fra Tel Aviv Universitet og Interdisciplin\u00e6re Center i Herzliya (Israel) har udviklet<\/a><\/noindex> en ny angrebsmetode NXNSAttack<\/a><\/noindex> (PDF<\/a><\/noindex>), som g\u00f8r det muligt at bruge enhver DNS-opl\u00f8sere som trafikforst\u00e6rkere, hvilket giver en forst\u00e6rkningsgrad p\u00e5 op til 1621 gange i antallet af pakker (for hver anmodning sendt til opl\u00f8seren, kan man opn\u00e5 sendingen af 1621 anmodninger til offerets server) og op til 163 gange i trafik. <\/p>\n

Problemet skyldes funktionerne i protokollen og p\u00e5virker alle DNS-servere, der underst\u00f8tter rekursiv behandling af anmodninger, herunder BIND<\/a><\/noindex> (CVE-2020-8616), Knot<\/a><\/noindex> (CVE-2020-12667), PowerDNS<\/a><\/noindex> (CVE-2020-10995), Windows DNS Server<\/a><\/noindex> og Unbound<\/a><\/noindex> (CVE-2020-12662), samt offentlige DNS-tjenester fra Google, Cloudflare, Amazon, Quad9, ICANN og andre virksomheder. L\u00f8sningen p\u00e5 problemet blev koordineret med udviklerne af DNS-servere, som samtidig udsendte opdateringer, der l\u00f8ste s\u00e5rbarheden i deres produkter. Beskyttelse mod angrebet er implementeret i versionerne
\nUnbound 1.10.1<\/a><\/noindex>, Knot Resolver 5.1.1<\/a><\/noindex>, PowerDNS Recursor 4.3.1, 4.2.2, 4.1.16<\/a><\/noindex>, BIND 9.11.19, 9.14.12, 9.16.3<\/a><\/noindex>.<\/p>\n

Angrebet er baseret p\u00e5, at angriberen bruger anmodninger, der henviser til et stort antal tidligere ukendte falske NS-poster, der f\u00e5r tildelt navnedefinition, men uden at angive glue-poster med oplysninger om IP-adresserne for NS-serverne i svaret. For eksempel sender angriberen en anmodning om at bestemme navnet sd1.attacker.com, mens han kontrollerer DNS-serveren, der er ansvarlig for dom\u00e6net attacker.com. Som svar p\u00e5 anmodningen fra opl\u00f8seren til angriberens DNS-server gives der et svar, der delegere definitionen af adressen sd1.attacker.com til offerets DNS-server ved at angive NS-poster i svaret uden detaljer om IP for NS-serverne. Da den n\u00e6vnte NS-server ikke er set f\u00f8r, og dens IP-adresse ikke er angivet, fors\u00f8ger opl\u00f8seren at bestemme IP-adressen p\u00e5 NS-serveren ved at sende en anmodning til offerets DNS-server, der betjener det m\u00e5lrettede dom\u00e6ne (victim.com).<\/p>\n

\"NXNSAttack-angreb,<\/a><\/noindex><\/center><\/p>\n

Problemet er, at en angriber kan svare med en enorm liste af unikke NS-servere med ikke-eksisterende fiktive underdom\u00e6nenavne til offeret (fake-1.victim.com, fake-2.victim.com,\u2026 fake-1000.victim.com). Resolveren vil fors\u00f8ge at sende en foresp\u00f8rgsel til offerets DNS-server, men vil f\u00e5 svaret, at dom\u00e6net ikke kan findes, hvorefter den vil fors\u00f8ge at bestemme den n\u00e6ste NS-server i listen, og s\u00e5dan forts\u00e6tte, indtil den har gennemg\u00e5et alle de angivne NS-posteringer fra angriberen. Derfor vil der blive sendt en enorm m\u00e6ngde foresp\u00f8rgsler til DNS-serveren, der h\u00e5ndterer offerets dom\u00e6ne for hver enkelt foresp\u00f8rgsel fra angriberen.<\/p>\n

\"NXNSAttack-angreb,<\/a><\/noindex><\/center><\/p>\n

Forskere har unders\u00f8gt, hvor udsatte offentlige DNS-resolvere er for problemet, og de har fastsl\u00e5et, at n\u00e5r man sender foresp\u00f8rgsler til CloudFlare (1.1.1.1) resolveren, kan man opn\u00e5 en for\u00f8gelse af antallet af pakker (PAF, Packet Amplification Factor) p\u00e5 48 gange, Google (8.8.8.8) \u2014 30 gange, FreeDNS (37.235.1.174) \u2014 50 gange, OpenDNS (208.67.222.222) \u2014 32 gange. Mere markante tal ses for
\nLevel3 (209.244.0.3) \u2014 273 gange, Quad9 (9.9.9.9) \u2014 415 gange
\nSafeDNS (195.46.39.39) \u2014 274 gange, Verisign (64.6.64.6) \u2014 202 gange,
\nUltra (156.154.71.1) \u2014 405 gange, Comodo Secure (8.26.56.26) \u2014 435 gange, DNS.Watch (84.200.69.80) \u2014 486 gange, og Norton ConnectSafe (199.85.126.10) \u2014 569 gange. For servere baseret p\u00e5 BIND 9.12.3 kan forst\u00e6rkningsniveauet n\u00e5 op p\u00e5 1000 takket v\u00e6re parallellisering af foresp\u00f8rgslerne. I Knot Resolver 5.1.0 er forst\u00e6rkningsniveauet cirka flere ti gange (24-48), da bestemmelsen af NS-navne udf\u00f8res sekventielt og er begr\u00e6nset af det interne loft p\u00e5 antallet af navneopl\u00f6sningstrin, der er tilladt for en enkelt foresp\u00f8rgsel.<\/p>\n

Der skelnes mellem to hovedstrategier for beskyttelse. For systemer med DNSSEC er det blevet foresl\u00e5et til PostgreSQL-udviklerne<\/a><\/noindex> bruges RFC-8198<\/a><\/noindex> for at forhindre cache-bypass af DNS, da anmodninger sendes med tilf\u00e6ldige navne. Metoden g\u00e5r ud p\u00e5 at generere negative svar uden at konsultere autoritative DNS-servere, ved hj\u00e6lp af range-checking via DNSSEC. En mere simpel metode er at begr\u00e6nse antallet af navne, der kan bestemmes under behandling af en enkelt delegeret anmodning, men denne metode kan f\u00f8re til problemer med nogle eksisterende konfigurationer, da gr\u00e6nserne ikke er defineret i protokollen.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c) \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 NXNSAttack (PDF), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043b\u044e\u0431\u044b\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0441\u0442\u0435\u043f\u0435\u043d\u044c \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0434\u043e 1621 \u0440\u0430\u0437 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (\u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043a \u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u0443 \u0437\u0430\u043f\u0440\u043e\u0441, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b 1621 \u0437\u0430\u043f\u0440\u043e\u0441) \u0438 \u0434\u043e 163 \u0440\u0430\u0437 \u043f\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82460","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47NXNSAttack-angreb, der p\u00e5virker alle DNS-resolv\u00f8rer | ProHoster","description":"En gruppe forskere fra Tel Aviv Universitet og Interdisciplin\u00e6re Center i Herzliya (Israel)","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 NXNSAttack, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c)","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-21T17:42:00+00:00","article:modified_time":"2020-05-21T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82460","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:37:29","updated":"2022-09-29 14:28:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/82460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=82460"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/82460\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/82461"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=82460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=82460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=82460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}