{"id":102321,"date":"2021-11-18T21:36:40","date_gmt":"2021-11-18T19:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere"},"modified":"2021-11-18T21:36:40","modified_gmt":"2021-11-18T19:36:41","slug":"predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","title":{"rendered":"Pakkutud on r\u00fcnnakumeetod kaugelt m\u00e4lu fragmente serveris tuvastamiseks.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Graz Tehnika \u00dclikooli (Austria) teadlaste r\u00fchm, kes on varem tuntud MDS-, NetSpectre-, Throwhammer- ja ZombieLoad-r\u00fcnnakute arendamise poolest, avaldas uue r\u00fcnnakumeetodi (CVE-2021-3714), mis maandub m\u00e4lu deduplikatsiooni mehhanismi (Memory-Deduplication) kaudu. See meetod v\u00f5imaldab m\u00e4\u00e4rata, kas m\u00e4lu on teatud andmeid, korraldada baitide eraldumist m\u00e4lu sisust v\u00f5i m\u00e4\u00e4rata m\u00e4lu jaotust, et v\u00e4ltida aadresside randomiseerimise (ASLR) p\u00f5hist kaitset. Varasemast r\u00fcnnakute n\u00e4idust, deduplikatsiooni mehhanismi r\u00fcnnakud, uus meetod erineb selles, et r\u00fcnnak viiakse l\u00e4bi v\u00e4lisest hostist, kasutades kui kriteeriumi vastuste ajavahemike muutumist r\u00fcnnakute saatmisel protokollide HTTP\/1 ja HTTP\/2 kaudu. R\u00fcnnaku teostamine on demonstreeritud Linuxi ja Windowsi baasil olevatel serveritel. <\/p>\n

M\u00e4lu deduplikatsiooni mehhanismi r\u00fcnnakud kasutavad kanalisandiks ajavahe tingimusi, kui andmete muutmine toob kaasa dedupikitud m\u00e4lu lehe kopeerimise Copy-On-Write (COW) mehhanismi abil. T\u00f6\u00f6 k\u00e4igus tuvastab kernel sama m\u00e4lu lehe erinevatest protsessidest ja \u00fchendab need, kuvades identsete m\u00e4lu lehed \u00fchte f\u00fc\u00fcsilise m\u00e4lu alasse, et salvestada ainult \u00fcks koopia. Kui \u00fcks protsess p\u00fc\u00fcab muuta andmeid, mis on seotud deduplikeeritud lehtedega, tekib erand (page fault) ja Copy-On-Write mehhanismi abil luuakse automaatselt eraldi m\u00e4lu lehe koopia, mis kinnitatakse protsessile. Kopeerimise t\u00e4itmiseks kulub lisat\u00e4htaeg, mis v\u00f5ib olla m\u00e4rk andmete muutmisest, mis kattub teise protsessiga. <\/p>\n

Teadlased on n\u00e4idanud, et Copy-On-Write mehhanismi t\u00f5ttu tekkivaid viivitusi saab tabada mitte ainult lokaalselt, vaid ka anal\u00fc\u00fcsides vastuste saatmise ajavahemiku muutust v\u00f5rgus. Pakutakse v\u00e4lja mitmeid meetodeid, et m\u00e4\u00e4rata kaugehuli sisu, anal\u00fc\u00fcsides p\u00e4ringute t\u00f6\u00f6tlemise aega HTTP\/1 ja HTTP\/2 protokollide kaudu. P\u00f6\u00f6ramismustrite s\u00e4ilitamiseks kasutatakse t\u00fc\u00fcpilisi veebirakendusi, mis salvestavad m\u00e4lu sissep\u00e4\u00e4su andmed. <\/p>\n

R\u00fcnnaku \u00fcldine p\u00f5him\u00f5te seisneb. serveris<\/a> m\u00e4lulehtede andmed, mis v\u00f5ivad potentsiaalselt korrata juba serveris olevate m\u00e4lulehtede sisu. Seej\u00e4rel ootab r\u00fcndaja aega, mis on vajalik tuumade deduplikatsiooniks ja m\u00e4lulehtede \u00fchendamiseks, p\u00e4rast mida muudab ta kontrollitava andmep\u00e4randi ja hindab reageerimise aega, et m\u00e4\u00e4rata r\u00fcnnaku \u00f5nnestumise m\u00e4\u00e4ra.

\"Pakkutud<\/center> <\/p>\n

Tehtud katsete k\u00e4igus oli maksimaalne teabe leke 34,41 baiti tunnis globaalse v\u00f5rgu kaudu ja 302,16 baiti tunnis kohaliku v\u00f5rgu kaudu, mis on kiirem kui teiste andmete v\u00e4ljatoomise meetodite kaudu kolmandate osapoolte kanalite kaudu (n\u00e4iteks NetSpectre r\u00fcnnaku korral on andmeedastuskiirus 7,5 baiti tunnis). <\/p>\n

Pakutakse v\u00e4lja kolm r\u00fcndev\u00f5imalust. Esimene variant v\u00f5imaldab m\u00e4\u00e4rata andmeid m\u00e4lus veebiserver<\/a>, kus kasutatakse Memcachedi. R\u00fcnnak seisneb teatud andmekomplektide laadimises Memcachedi salvestusse, deduplikatsiooni blokeerimise kustutamises, sama elemendi uuesti kirjutamises ja tingimuste loomises COW-kopide tekkimiseks bloke sisu muutmise kaudu. Memcachediga katse k\u00e4igus \u00f5nnestus 166,51 sekundiga m\u00e4\u00e4rata s\u00fcsteemis, mis t\u00f6\u00f6tab virtuaalmasinas, installitud libc versioon. <\/p>\n

Teine variant v\u00f5imaldas teada saada MariaDB andmebaasi sisu, kasutades InnoDB salvestust, sisu taastamise kaudu bait baidi kaupa. R\u00fcnnak viiakse l\u00e4bi spetsiaalselt muudetud p\u00e4ringute saatmise kaudu, mis p\u00f5hjustavad m\u00e4lulehtedes \u00fchebaidiseid erinevusi ja reageerimise aja anal\u00fc\u00fcsimise tulemuste m\u00e4\u00e4ramiseks, et teada saada, et byte'i sisu p\u00fcsimine oli \u00f5ige. Sellise leke kiirus on v\u00e4ike ja on 1,5 baiti tunnis kohalikust v\u00f5rgust r\u00fcnnates. Meetodi plussiks on see, et seda saab kasutada tundmatu m\u00e4lusisalduse taastamiseks. <\/p>\n

Kolmas variant lubas 4 minutiga t\u00e4ielikult \u00fcletada KASLR kaitsme ja saada teavet virtuaalmasina tuuma kuvandi m\u00e4lu nihke kohta, olukorras, kus nihke aadress on m\u00e4lulehes, mille teised andmed ei muutu. R\u00fcnnak toimus hostilt, mis oli 14 edastuspunkti (hops) kaugusel r\u00fcnnatavast s\u00fcsteemist. Koodin\u00e4idised esitatud r\u00fcnnakute realiseerimiseks lubatakse avaldada GitHubis.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u043d\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0434\u0435\u0434\u0443\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 (Memory-Deduplication), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0431\u0430\u0439\u0442\u043e\u0432\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u043a\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 (ASLR). \u041e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102322,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Esitatud r\u00fcnnakumeetod serveri m\u00e4lu fragmentide kauguselt m\u00e4\u00e4ramiseks | ProHoster","description":"Graz nimetee tehnika\u00fclikooli uurijate grupp (Austria), kes on varem tuntud MDS, NetSpectre, Throwhammer ja ZombieLoad r\u00fcnnakute v\u00e4ljat\u00f6\u00f6tamise poolest, avaldas uue r\u00fcnnaku meetodi (CVE-2021-3714) k\u00fclgkanalite kaudu.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-18T19:36:41+00:00","article:modified_time":"2021-11-18T19:36:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102321","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-18 19:37:43","updated":"2026-02-09 21:39:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102321"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102321\/revisions"}],"predecessor-version":[{"id":159967,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102321\/revisions\/159967"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/102322"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}