{"id":82460,"date":"2020-05-21T19:42:00","date_gmt":"2020-05-21T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery"},"modified":"2020-05-21T19:42:00","modified_gmt":"2020-05-21T17:42:00","slug":"ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","title":{"rendered":"R\u00fcnnak NXNSAttack, mis m\u00f5jutab k\u00f5iki DNS-resolvereid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tel Avivi \u00fclikooli ja Herzliya interdistsiplinaarse keskuse teadlaste grupp (Iisrael) arendas<\/a><\/noindex> uus r\u00fcnnakumeetod NXNSAttack<\/a><\/noindex> (PDF<\/a><\/noindex>), mis v\u00f5imaldab kasutada mis tahes DNS-i lahendajaid liikluse tugevdamiseks, tagades kuni 1621-kordse tugevuse pakettide arvu osas (iga saadetud p\u00e4ringu kohta lahendajale saab saavutada 1621 p\u00e4ringu saatmise sihtm\u00e4rgi serverisse) ja kuni 163-kordse tugevuse andmevoos. <\/p>\n

Probleem on seotud protokolli t\u00f6\u00f6spetsiifika ning see puudutab k\u00f5iki DNS-servereid, mis toetavad rekursiivset p\u00e4ringute t\u00f6\u00f6tlemist, sealhulgas BIND<\/a><\/noindex> (CVE-2020-8616), Knot<\/a><\/noindex> (CVE-2020-12667), PowerDNS<\/a><\/noindex> (CVE-2020-10995), Windows DNS Server<\/a><\/noindex> ja Unbound<\/a><\/noindex> (CVE-2020-12662), samuti avalikud DNS-teenused Google, Cloudflare, Amazon, Quad9, ICANN ja teised ettev\u00f5tted. Probleemi lahendamine oli koordineeritud DNS-serverite arendajatega, kes v\u00e4ljastasid samal ajal oma toodete haavatavuse k\u00f5rvaldamiseks uuendusi. R\u00fcnnaku kaitse on rakendatud v\u00e4ljaannetes
\nUnbound 1.10.1<\/a><\/noindex>, Knot Resolver 5.1.1<\/a><\/noindex>, PowerDNS Recursor 4.3.1, 4.2.2, 4.1.16<\/a><\/noindex>, BIND 9.11.19, 9.14.12, 9.16.3<\/a><\/noindex>.<\/p>\n

R\u00fcnnak p\u00f5hineb r\u00fcnnakutegija poolt saadetud p\u00e4ringutel, mis viitavad suurele hulgale varem mittekohtunud vale NS-kirjadele, millele antakse volitus nime m\u00e4\u00e4ramiseks, kuid vastuses ei esitada glue-kirjeid NS-serverite IP-aadresside kohta. N\u00e4iteks saadab r\u00fcnnakutegija p\u00e4ringu nime m\u00e4\u00e4ramiseks sd1.attacker.com, kontrollides DNS-serverit, mis vastutab domeeni attacker.com eest. Vastuseks r\u00fcnnavale DNS-serverile antud lahendaja p\u00e4ringule v\u00e4ljastatakse vastus, mis volitab sd1.attacker.com aadressi m\u00e4\u00e4ramist sihtm\u00e4rgi DNS-serverile, osutades vastuses NS-kirjetele, ilma et oleks detailide esitamist NS-serverite IP-de kohta. Kuna nimetatud NS-serverit pole varem kohatud ja selle IP-aadress ei ole m\u00e4rgitud, \u00fcritab lahendaja m\u00e4\u00e4rata NS-serveri IP-aadressi, suunates p\u00e4ringu sihtm\u00e4rgi domeeni haldava DNS-serveri poole (victim.com).<\/p>\n

\"R\u00fcnnak<\/a><\/noindex><\/center><\/p>\n

Probleem on see, et r\u00fcndaja v\u00f5ib vastuses esitada tohutu loetelu kordumatutest NS-serveritest, millel on eksisteerimata vale alamdomeenide nimed (fake-1.victim.com, fake-2.victim.com, ... fake-1000.victim.com). Resolvoor p\u00fc\u00fcab saata p\u00e4ringu ohvri DNS-serverile, kuid saab vastuseks, et domeeni ei leitud, mille j\u00e4rel proovib ta m\u00e4\u00e4rata j\u00e4rgmise NS-serveri loendis ja nii edasi, kuni on \u00e4ra proovitud k\u00f5ik r\u00fcndaja loetletud NS-kirjed. Seet\u00f5ttu saadab resolvoor \u00fche r\u00fcndaja p\u00e4ringu puhul tohutu hulga p\u00e4ringuid NS-hostide m\u00e4\u00e4ramiseks. Kuna NS-serverite nimed genereeritakse juhuslikult ja viitavad mitteeksisteerivatele alamdomeenidele, ei ala laadita need vahem\u00e4lust ja iga r\u00fcndaja p\u00e4ring p\u00f5hjustab DNS-serverile, mis teenindab ohvri domeeni, koormava p\u00e4ringute voo.<\/p>\n

\"R\u00fcnnak<\/a><\/noindex><\/center><\/p>\n

Uurijad uurisid avalike DNS-resolveerijate haavatavuse taset ja tuvastasid, et CloudFlare'i resolveerijale (1.1.1.1) p\u00e4ringute saatmisel v\u00f5ib saavutada pakettide suurendamise teguri (PAF, Packet Amplification Factor) 48 korda, Google'ile (8.8.8.8) \u2014 30 korda, FreeDNS (37.235.1.174) \u2014 50 korda, OpenDNS (208.67.222.222) \u2014 32 korda. M\u00e4rkimisv\u00e4\u00e4rselt k\u00f5rgemad n\u00e4itajad on observed for
\nLevel3 (209.244.0.3) \u2014 273 korda, Quad9 (9.9.9.9) \u2014 415 korda
\nSafeDNS (195.46.39.39) \u2014 274 korda, Verisign (64.6.64.6) \u2014 202 korda,
\nUltra (156.154.71.1) \u2014 405 korda, Comodo Secure (8.26.56.26) \u2014 435 korda, DNS.Watch (84.200.69.80) \u2014 486 korda, ja Norton ConnectSafe (199.85.126.10) \u2014 569 korda. BIND 9.12.3 p\u00f5hiselt serverite puhul v\u00f5ib paralleliseerimise t\u00f5ttu suurendamisaste ulatuda kuni 1000. Knot Resolver 5.1.0 puhul on suurendamisaste umbes paarik\u00fcmne korra (24-48), kuna NS-nimede m\u00e4\u00e4ramine toimub j\u00e4rjestikku ja see on piiratud siseselt lubatud nime lahendamise sammu arvuga, mis on \u00fche p\u00e4ringu jaoks lubatud.<\/p>\n

Esile t\u00f5stetakse kahte peamist kaitsestrateegiat. DNSSEC-i s\u00fcsteemide jaoks pakutud<\/a><\/noindex> kasutama RFC-8198<\/a><\/noindex> kuna p\u00e4ringud saadetakse juhuslike nimedega. Meetodi olemus seisneb negatiivsete vastuste genereerimises ilma autoriteetsetele DNS-serveritele p\u00f6\u00f6rdumata, rakendades vahemike kontrollimist DNSSEC-i kaudu. Lihtsam viis oleks piirata nimede arvu, mida saab \u00fche volitatud p\u00e4ringu t\u00f6\u00f6tlemisel m\u00e4\u00e4rata, kuid see meetod v\u00f5ib p\u00f5hjustada probleeme m\u00f5nede olemasolevate konfiguratsioonidega, kuna piirangud ei ole protokollis m\u00e4\u00e4ratletud.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c) \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 NXNSAttack (PDF), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043b\u044e\u0431\u044b\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0441\u0442\u0435\u043f\u0435\u043d\u044c \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0434\u043e 1621 \u0440\u0430\u0437 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (\u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043a \u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u0443 \u0437\u0430\u043f\u0440\u043e\u0441, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b 1621 \u0437\u0430\u043f\u0440\u043e\u0441) \u0438 \u0434\u043e 163 \u0440\u0430\u0437 \u043f\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82460","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47NXNSAttack r\u00fcnnak, mis kahjustab k\u00f5iki DNS-resolverite | ProHoster","description":"Tel Avivi \u00fclikooli ja Herzliya interdistsiplinaarse keskuse teadlaste grupp (Iisrael)","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 NXNSAttack, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c)","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-21T17:42:00+00:00","article:modified_time":"2020-05-21T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82460","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:37:29","updated":"2022-09-29 14:28:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=82460"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82460\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/82461"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=82460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=82460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=82460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}