{"id":102321,"date":"2021-11-18T21:36:40","date_gmt":"2021-11-18T19:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere"},"modified":"2021-11-18T21:36:40","modified_gmt":"2021-11-18T19:36:41","slug":"predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","title":{"rendered":"Pakutud on meetod r\u00fcnnakuks kaugjuhtimisega m\u00e4lufragmente m\u00e4\u00e4rata serveris","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Graz Tehnika \u00dclikooli teadlaste r\u00fchm (Austria), kes on tuntud MDS, NetSpectre, Throwhammer ja ZombieLoad r\u00fcnnakute arendamise poolest, avaldas uue r\u00fcnnaku meetodi (CVE-2021-3714), mis kasutab k\u00f5rvalkanaleid m\u00e4lu deduplikatsiooni mehhanismi (Memory-Deduplication) suhtes. See v\u00f5imaldab kindlaks teha teatud andmete olemasolu m\u00e4lus, korraldada baitide tasemel m\u00e4lusisalduse leket v\u00f5i m\u00e4\u00e4rata m\u00e4lu jaotuse ASLR-p\u00f5hise kaitse \u00fcletamiseks. Uus meetod erineb varasemate deduplikatsiooni mehhanismi r\u00fcnnakute variatsioonidest r\u00fcnnaku teostamise osas v\u00e4liselt hostilt, kasutades r\u00fcnnaku algataja saadetud HTTP\/1 ja HTTP\/2 protokollide p\u00e4ringute vastuste ajamuutusi. R\u00fcnnaku teostamise v\u00f5imalust on demonstreeritud Linuxi ja Windowsi p\u00f5histe serverite puhul. <\/p>\n

M\u00e4lu deduplitseerimise mehhanismi r\u00fcnnakud kasutavad andmete lekitamiseks kanali jaotust kirjutamise toimingu t\u00f6\u00f6tlemise ajal, kui andmete muutmine p\u00f5hjustab deduplicaadieritud m\u00e4lu lehe kloonimist Copy-On-Write (COW) mehhanismi kaudu. Protsessi k\u00e4igus tuvastab s\u00fcdamik erinevate protsesside identseid m\u00e4lu lehti ja liidab need, kuvades identseid m\u00e4lu lehti \u00fches f\u00fc\u00fcsilises m\u00e4lu piirkonnas, s\u00e4ilitades vaid \u00fche koopia. Kui \u00fcks protsess proovib muuta andmeid, mis on seotud deduplitseeritud lehtedega, tekib erand (page fault) ning Copy-On-Write mehhanismi abil luuakse automaatselt eraldiseisev m\u00e4lu lehe koopia, mis seotakse protsessiga. Kokkupaigutamise t\u00e4itmiseks kulub t\u00e4iendav aeg, mis v\u00f5ib viidata teiste protsessidega kattuvate andmete muutumisele. <\/p>\n

Uurijad on n\u00e4idanud, et COW-mehhanismi t\u00f6\u00f6 tulemusena tekkivad viivitused on tuvastatavad mitte ainult lokaalselt, vaid ka anal\u00fc\u00fcsides vastuste edastamise aega v\u00f5rgu kaudu. On v\u00e4lja pakutud mitu meetodit kau hosti m\u00e4lu sisu m\u00e4\u00e4ramiseks, anal\u00fc\u00fcsides p\u00e4ringute t\u00e4itmise aega protokollide HTTP\/1 ja HTTP\/2 kaudu. Salvestatavate mallide jaoks kasutatakse t\u00fc\u00fcpilisi veebirakendusi, mis salvestavad m\u00e4llu p\u00e4ringutes saadud teavet. <\/p>\n

R\u00fcnnaku \u00fcldine p\u00f5him\u00f5te seisneb m\u00e4lu lehtede t\u00e4itmises andmetega, mis potentsiaalselt kordavad juba serveris olevate m\u00e4lu lehtede sisu. serveril<\/a> Seej\u00e4rel ootab r\u00fcndaja aega, mis on vajalik tuumale deduplikatsiooni ja m\u00e4lu lehtede \u00fchendamiseks, p\u00e4rast mida muudab ta kontrollitud andmete duplit ja hindab reageerimise aega, et m\u00e4\u00e4rata r\u00fcnnaku \u00f5nnestumise taset.

\"Pakutud<\/center> <\/p>\n

Eksperimentide k\u00e4igus oli teabe lekke maksimaalne kiirus 34,41 baiti tunnis globaalsete r\u00fcnnakute korral ja 302,16 baiti tunnis kohalike r\u00fcnnakute korral, mis on kiirem kui teised andmete hankimise meetodid kolmandate osapoolte kanalite kaudu (n\u00e4iteks NetSpectre r\u00fcnnaku korral on andmeedastuskiirus 7,5 baiti tunnis). <\/p>\n

Pakutud on kolm r\u00fcndev\u00f5imalust. Esimene variant v\u00f5imaldab m\u00e4\u00e4rata andmed m\u00e4lus veebiserver<\/a>, kus kasutatakse Memcachedit. R\u00fcnnak koosneb teatud andmekogumite laadimisest Memcachedi m\u00e4llu, dedupeeritud ploki puhastamisest, sama elementi uuesti kirjutamisest ning tingimuste loomise v\u00f5imalusest COW-kloonimise tekkimiseks ploki sisu muutmise kaudu. Memcachediga tehtud katse tulemusena \u00f5nnestus 166,51 sekundi jooksul m\u00e4\u00e4rata libc versioon, mis on installitud virtuaalmasinas. <\/p>\n

Teine variant v\u00f5imaldas saada teavet MariaDB andmebaasi salvestiste kohta, kasutades InnoDB salvestuslahendust ja taastades sisu bait-baidilt. R\u00fcnnak toimub spetsiaalselt muudetud p\u00e4ringute saatmise kaudu, mis p\u00f5hjustavad \u00fche baitiga mittevastavusi m\u00e4lu lehtede vahel ning reaktsiooniaja anal\u00fc\u00fcsi, et tuvastada, kas eeldus byte sisu osas oli \u00f5ige. Sellise lekke kiirus on madal, umbes 1.5 baiti tunnis r\u00fcnnaku korral kohalikus v\u00f5rgus. Meetodi eeliseks on see, et seda saab kasutada tundmatu m\u00e4lu sisu taastamiseks. <\/p>\n

Kolmas variant v\u00f5imaldas nelja minutiga t\u00e4ielikult m\u00f6\u00f6duda KASLR kaitse mehhanismist ja saada teavet virtuaalmasina kernelipildi m\u00e4lu nihke kohta, juhul kui nihke aadress asub m\u00e4lu lehes, mille teised andmed ei muutu. R\u00fcnnak viidi l\u00e4bi hostilt, mis asus 14 \u00fclekande siirde (hops) kaugusel r\u00fcnnatavast s\u00fcsteemist. Koodi n\u00e4idised nende r\u00fcnnakute teostamiseks lubatakse avaldada GitHubis.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u043d\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0434\u0435\u0434\u0443\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 (Memory-Deduplication), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0431\u0430\u0439\u0442\u043e\u0432\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u043a\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 (ASLR). \u041e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102322,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Esitatud r\u00fcnde meetod kaugmehaaniliste m\u00e4lu fragmentide m\u00e4\u00e4ramiseks serveris | ProHoster","description":"Grazi Tehnika \u00dclikooli teadlaste grupp (Austria), kes on tuntud MDS, NetSpectre, Throwhammer ja ZombieLoad r\u00fcnnakute v\u00e4ljat\u00f6\u00f6tamise poolest, avaldas uue r\u00fcnde meetodi (CVE-2021-3714), mis kasutab k\u00f5rvalahelaid m\u00e4lu deduplicateerimise mehhanismi (Memory-Deduplication), mis v\u00f5imaldab kindlaks teha teatud andmete olemasolu m\u00e4lus, korraldada m\u00e4lusisalduse baitide kaupa leket v\u00f5i kindlaks teha m\u00e4lu paigutuse, et minna m\u00f6\u00f6da aadresside randomiseerimise (ASLR) kaitsemeetmetest.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u043d\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0434\u0435\u0434\u0443\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 (Memory-Deduplication), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0431\u0430\u0439\u0442\u043e\u0432\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u043a\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 (ASLR). \u041e\u0442","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-18T19:36:41+00:00","article:modified_time":"2021-11-18T19:36:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102321","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-18 19:37:43","updated":"2026-02-09 21:39:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102321"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102321\/revisions"}],"predecessor-version":[{"id":159967,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102321\/revisions\/159967"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/102322"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}