{"id":82929,"date":"2020-05-26T19:42:01","date_gmt":"2020-05-26T17:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range"},"modified":"2020-05-26T19:42:01","modified_gmt":"2020-05-26T17:42:01","slug":"rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","title":{"rendered":"RangeAmp \u2014 en serie af angreb p\u00e5 CDN, der manipulerer HTTP-headeren Range","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En gruppe forskere fra Peking Universitet, Tsinghua Universitet og University of Texas i Dallas har afsl\u00f8ret<\/a><\/noindex> en ny klasse af DoS-angreb \u2014 RangeAmp, baseret p\u00e5 brugen af HTTP-headere Range<\/a><\/noindex> for at organisere trafikforst\u00e6rkning gennem indholdsleveringsnetv\u00e6rk (CDN). Essensen af metoden er, at p\u00e5 grund af den m\u00e5de, som Range-headere behandles af mange CDN, kan angriberen anmode om en enkelt byte fra en stor fil via CDN, men CDN vil hente hele filen eller en betydeligt st\u00f8rre datablok fra m\u00e5lserveren for at placere i cachen. Grad af trafikforst\u00e6rkning ved et s\u00e5dant angreb afh\u00e6ngig af CDN sp\u00e6nder fra 724 til 43330 gange, hvilket kan bruges til at overbelaste den indkommende trafik til CDN eller reducere b\u00e5ndbredden af den endelige forbindelse til ofrets websted.<\/p>\n

\"RangeAmp<\/center><\/p>\n

Range-headeren giver klienten mulighed for at angive intervaller af positioner i filen, der skal downloades i stedet for at returnere hele filen. For eksempel kan klienten angive \u201eRange: bytes=0-1023\u201c og serveren vil kun sende de f\u00f8rste 1024 bytes af data. Denne mulighed er nyttig ved download af store filer \u2014 brugeren kan pause download og derefter forts\u00e6tte fra det sted, hvor det blev afbrudt. N\u00e5r der angives \u201ebytes=0-0\u201c, foreskriver standarden at sende det f\u00f8rste byte i filen, \u201ebytes=-1\u201c \u2014 det sidste, \u201ebytes=1-\u201c \u2014 fra byte 1 til slutningen af filen. Det er tilladt at overf\u00f8re flere intervaller i et enkelt header, for eksempel \u201eRange: bytes=0-1023,8192-10240\u201c.<\/p>\n

Derudover er der blevet foresl\u00e5et en anden angrebsmetode, der har til form\u00e5l at \u00f8ge netv\u00e6rksbelastningen ved at videregive trafik gennem en anden CDN, som bruges som proxy (for eksempel n\u00e5r Cloudflare fungerer som front-end (FCDN) og Akamai som back-end (BCDN)). Metoden minder om det f\u00f8rste angreb, men lokaliseres inden for CDN-netv\u00e6rkene og muligg\u00f8r for\u00f8gelse af trafikken ved at tilg\u00e5 gennem andre CDN'er, hvilket \u00f8ger belastningen p\u00e5 infrastrukturen og s\u00e6nker servicekvaliteten. <\/p>\n

Ideen er, at angriberen sender Range-anmodninger til CDN med flere intervaller, s\u00e5som \u201ebytes=0-,0-,0-\u2026\u201c, \u201ebytes=1-,0-,0-\u2026\u201c eller \u201ebytes=-1024,0-,0-\u2026\u201c. Anmodningerne indeholder mange intervaller \u201e0-\u201c, som implicerer at sende filen fra nul-positionen til slutningen. P\u00e5 grund af en forkert implementering af intervalparsing ved den f\u00f8rste CDN, der henvender sig til den anden, bliver en fuld fil sendt for hvert interval \u201e0-\u201c, hvis den oprindeligt sendte anmodning fra angriberen indeholder duplikerede og overlappende intervaller. Graden af trafikforst\u00e6rkning i et s\u00e5dant angreb ligger mellem 53 og 7432 gange.<\/p>\n

\"RangeAmp<\/center><\/p>\n

I l\u00f8bet af unders\u00f8gelsen blev adf\u00e6rden af 13 CDN \u2014
\nAkamai, Alibaba Cloud, Azure, CDN77, CDNsun, Cloudflare, CloudFront, Fastly, G-Core Labs, Huawei Cloud, KeyCDN, StackPath og Tencent Cloud. Alle de overvejede CDN tillod den f\u00f8rste type angreb p\u00e5 den endelige server. Seks tjenester blev truffet af den anden angrebsform mod CDN, hvoraf fire kan fungere som front-end (CDN77, CDNsun, Cloudflare og StackPath) og tre som back-end (Akamai, Azure og StackPath). Den st\u00f8rste forst\u00e6rkning opn\u00e5s i Akamai og StackPath, som tillader angivelse af mere end 10.000 intervaller i Range-headeren. CDN-ejerne blev underrettet om s\u00e5rbarhederne for cirka 7 m\u00e5neder siden, og p\u00e5 tidspunktet for offentligg\u00f8relsen af oplysningerne havde 12 ud af 13 CDN l\u00f8st de identificerede problemer eller udtrykt vilje til at l\u00f8se dem (kun tjenesten StackPath reagerede ikke).<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041f\u0435\u043a\u0438\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0426\u0438\u043d\u0445\u0443\u0430 \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0414\u0430\u043b\u043b\u0430\u0441\u0435 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043a\u043b\u0430\u0441\u0441 DoS-\u0430\u0442\u0430\u043a — RangeAmp, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 Range \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 (CDN). \u0421\u0443\u0442\u044c \u043c\u0435\u0442\u043e\u0434\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0438\u0437-\u0437\u0430 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Range-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 CDN \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 CDN \u043e\u0434\u0438\u043d \u0431\u0430\u0439\u0442 \u0438\u0437 \u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430, \u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82930,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82929","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47RangeAmp \u2014 en serie angreb p\u00e5 CDN, der manipulerer HTTP-headeren Range | ProHoster","description":"En gruppe forskere fra Peking Universitet, Tsinghua Universitet og University of Texas i Dallas","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47RangeAmp \u2014 \u0441\u0435\u0440\u0438\u044f \u0430\u0442\u0430\u043a \u043d\u0430 CDN, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0430\u044f HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Range | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041f\u0435\u043a\u0438\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0426\u0438\u043d\u0445\u0443\u0430 \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0414\u0430\u043b\u043b\u0430\u0441\u0435","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-26T17:42:01+00:00","article:modified_time":"2020-05-26T17:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82929","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:28:37","updated":"2022-10-02 22:54:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/82929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=82929"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/82929\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/82930"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=82929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=82929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=82929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}