{"id":82460,"date":"2020-05-21T19:42:00","date_gmt":"2020-05-21T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery"},"modified":"2020-05-21T19:42:00","modified_gmt":"2020-05-21T17:42:00","slug":"ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","title":{"rendered":"NXNSAttack r\u00fcnnak, mis m\u00f5jutab k\u00f5iki DNS-resolvers","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Teadlaste r\u00fchm Tel Avivi \u00fclikoolist ja Interdistsiplinaarsest keskusest Herzliyas (Iisrael) arendas<\/a><\/noindex> uue r\u00fcnnaku meetodi NXNSAttack<\/a><\/noindex> (PDF<\/a><\/noindex>), mis v\u00f5imaldab kasutada mis tahes DNS-resolveereid kui liikluse tugevdamise seadmeid, mis tagavad kuni 1621 kordse tugevdamise pakettide arvu (iga saadetud p\u00e4ringu kohta resolverile on v\u00f5imalik saata 1621 p\u00e4ringut sihtserverisse) ja kuni 163 korda liikluses. <\/p>\n

Probleem on seotud protokolli t\u00f6\u00f6 erip\u00e4radega ja see m\u00f5jutab k\u00f5iki DNS-servereid, mis toetavad p\u00e4ringute rekursiivset t\u00f6\u00f6tlemist, sealhulgas BIND<\/a><\/noindex> (CVE-2020-8616), Knot<\/a><\/noindex> (CVE-2020-12667), PowerDNS<\/a><\/noindex> (CVE-2020-10995), Windows DNS Server<\/a><\/noindex> ja Unbound<\/a><\/noindex> (CVE-2020-12662), samuti avalikud DNS-teenused Google, Cloudflare, Amazon, Quad9, ICANN ja teised ettev\u00f5tted. Probleemi parandamine oli koosk\u00f5lastatud DNS-serverite arendajatega, kes samal ajal vabastasid uuendused haavatavuse eemaldamiseks oma toodetest. Kaitse r\u00fcnnaku eest on rakendatud v\u00e4ljaannetes
\nUnbound 1.10.1<\/a><\/noindex>, Knot Resolver 5.1.1<\/a><\/noindex>, PowerDNS Recursor 4.3.1, 4.2.2, 4.1.16<\/a><\/noindex>, BIND 9.11.19, 9.14.12, 9.16.3<\/a><\/noindex>.<\/p>\n

R\u00fcnnak p\u00f5hineb r\u00fcndaja poolt esitatud p\u00e4ringute kasutamisel, mis viitavad suurele hulgale varem n\u00e4htamatutele vale NS-kirjadele, mille kohaselt delegeeritakse nime m\u00e4\u00e4ramine, kuid vastuses ei ole glue-kirju NS-serverite IP-aadresside teabega. N\u00e4iteks saadab r\u00fcndaja p\u00e4ringu sd1.attacker.com nime m\u00e4\u00e4ramiseks, kontrollides DNS-serverit, mis vastutab domeeni attacker.com eest. Vastuseks r\u00fcndaja DNS-serverile suunatud resolveri p\u00f6\u00f6rdumisele antakse vastus, mis delegeerib sd1.attacker.com adressi m\u00e4\u00e4ramise ohvri DNS-serverile, m\u00e4rkides vastuses NS-kirjad, kuid ilma NS-serverite IP-aadresside detailideta. Kuna nimetatud NS-server ei ole varem teada ja tema IP-aadress ei ole toodud, \u00fcritab resolver m\u00e4\u00e4rata NS-serveri IP-aadressi, suunates p\u00e4ringu ohvri DNS-serverile, mis teenindab sihtdomeeni (victim.com).<\/p>\n

\"NXNSAttack<\/a><\/noindex><\/center><\/p>\n

Probleem on selles, et r\u00fcndaja v\u00f5ib vastuses esitada tohutu hulga unikaalsete NS-serverite nimekirja, kus on vale alamdomeenide nimed ohvri domeeni all (fake-1.victim.com, fake-2.victim.com, ... fake-1000.victim.com). Resolvider \u00fcritab saata p\u00e4ringu ohvri DNS-serverile, kuid saab vastuseks, et domeeni ei leitud, p\u00e4rast mida \u00fcritab ta kindlaks teha j\u00e4rgmise NS-serveri nimekirjas ja nii edasi, kuni k\u00f5ik r\u00fcndaja poolt loetletud NS-kirjed on l\u00e4bi k\u00e4idud. Seega saadetakse \u00fche r\u00fcndaja p\u00e4ringu kohta resolvideriga tohutu hulk p\u00e4ringuid NS-hostide m\u00e4\u00e4ramiseks. Kuna NS-serverite nimed genereeritakse juhuslikult ja viitavad mitteeksisteerivatele alamdomeenidele, ei salvestata neid vahem\u00e4lu ning iga r\u00fcndaja p\u00e4ring toob kaasa suure arvu p\u00e4ringuid DNS-serverile, mis teenindab ohvri domeeni.<\/p>\n

\"NXNSAttack<\/a><\/noindex><\/center><\/p>\n

Uurijad uurisid, kui suurel m\u00e4\u00e4ral on avalikud DNS-resolvijad selle probleemile alluvad ja leidis, et CloudFlare'i (1.1.1.1) resolverdile p\u00e4ringute saatmisel v\u00f5ib pakkide hulka (PAF, Packet Amplification Factor) suurendada 48 korda, Google (8.8.8.8) \u2014 30 korda, FreeDNS (37.235.1.174) \u2014 50 korda, OpenDNS (208.67.222.222) \u2014 32 korda. M\u00e4rkimisv\u00e4\u00e4rsemad n\u00e4itajad ilmnevad
\nLevel3 (209.244.0.3) \u2014 273 korda, Quad9 (9.9.9.9) \u2014 415 korda
\nSafeDNS (195.46.39.39) \u2014 274 korda, Verisign (64.6.64.6) \u2014 202 korda,
\nUltra (156.154.71.1) \u2014 405 korda, Comodo Secure (8.26.56.26) \u2014 435 korda, DNS.Watch (84.200.69.80) \u2014 486 korda, ja Norton ConnectSafe (199.85.126.10) \u2014 569 korda. BIND 9.12.3 p\u00f5hjal serveritel v\u00f5ib p\u00e4ringute paralleelse t\u00f6\u00f6tlemise t\u00f5ttu tugevdamise tase ulatuda kuni 1000. Knot Resolver 5.1.0 puhul on tugevdamise tase ligikaudu paarik\u00fcmne korra (24-48), kuna NS-nimede m\u00e4\u00e4ramine toimub j\u00e4rjestikku ja takerdub sisemisele piirangule lubatud nimede m\u00e4\u00e4ramise sammude arvu suhtes \u00fche p\u00e4ringu kohta.<\/p>\n

M\u00e4\u00e4ratletakse kaks peamist kaitsestrateegiat. DNSSEC-iga s\u00fcsteemide jaoks ettepanek<\/a><\/noindex> kasutada RFC-8198<\/a><\/noindex> kuna p\u00e4ringud saadetakse juhuslike nimedega, et v\u00e4ltida DNS vahem\u00e4lu \u00fcmbers\u00f5itu. Meetodi p\u00f5hiolemus on negatiivsete vastuste genereerimine ilma volitatud DNS-serveritele p\u00f6\u00f6rdumata, kasutades DNSSEC-i kaudu vahemike kontrollimist. Lihtsam viis on piirata nime hulka, mida saab \u00fches volitatud p\u00e4ringus m\u00e4\u00e4rata, kuid see viis v\u00f5ib teatud olemasolevate konfiguratsioonide t\u00f5ttu probleeme tekitada, kuna protokollis ei ole m\u00e4\u00e4ratud limiite.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c) \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 NXNSAttack (PDF), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043b\u044e\u0431\u044b\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0441\u0442\u0435\u043f\u0435\u043d\u044c \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0434\u043e 1621 \u0440\u0430\u0437 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (\u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043a \u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u0443 \u0437\u0430\u043f\u0440\u043e\u0441, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b 1621 \u0437\u0430\u043f\u0440\u043e\u0441) \u0438 \u0434\u043e 163 \u0440\u0430\u0437 \u043f\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82460","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47NXNSAttack, mis m\u00f5jutab k\u00f5iki DNS-resolvende | ProHoster","description":"Teadlaste r\u00fchm Tel Avivi \u00fclikoolist ja Interdistsiplinaarsest keskusest Herzliyas (Iisrael)","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 NXNSAttack, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c)","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-21T17:42:00+00:00","article:modified_time":"2020-05-21T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82460","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:37:29","updated":"2022-09-29 14:28:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=82460"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82460\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/82461"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=82460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=82460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=82460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}