{"id":82929,"date":"2020-05-26T19:42:01","date_gmt":"2020-05-26T17:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range"},"modified":"2020-05-26T19:42:01","modified_gmt":"2020-05-26T17:42:01","slug":"rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","title":{"rendered":"RangeAmp \u2014 r\u00fcndesari CDN-i vastu, mis manipuleerib HTTP pealkirja Range","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pekingi \u00fclikooli, Tsinghua \u00fclikooli ja Texas Dallas \u00fclikooli teadlaste grupp tuvastas<\/a><\/noindex> uus klass DoS-r\u00fcnnakuid \u2014 RangeAmp, mis p\u00f5hineb HTTP-pealkirja kasutamisel Range<\/a><\/noindex> sisu tugevdamiseks sisu edastamise v\u00f5rkude kaudu (CDN). Meetodi p\u00f5him\u00f5te on see, et paljude CDN-ide Range-pealkirjade t\u00f6\u00f6tlemise erip\u00e4ra t\u00f5ttu v\u00f5ib r\u00fcndaja paluda CDN-l suurtest failidest \u00fche bait, kuid CDN laadib sihtserverist kogu faili v\u00f5i palju suurema andmeploki, et salvestada see vahem\u00e4llu. R\u00fcnnaku ajal suureneb liiklus, s\u00f5ltuvalt CDN-ist, 724 kuni 43330 korda, mis v\u00f5ib kasutada CDN-i sissetuleva liikluse \u00fclekoormamiseks v\u00f5i aja suurenemise v\u00e4hendamiseks sihitud veebisaidi l\u00f5ppkanali l\u00e4bilaskev\u00f5ime.<\/p>\n

\"RangeAmp<\/center><\/p>\n

Pealkiri Range annab kliendile v\u00f5imaluse m\u00e4\u00e4rata faile, mille osi tuleks laadida, mitte edastada kogu faili. N\u00e4iteks v\u00f5ib klient m\u00e4rkida \u201eRange: bytes=0-1023\u201d ja server edastab ainult esimesed 1024 baiti andmeid. Selline v\u00f5imalus on n\u00f5udlik suurte failide allalaadimisel \u2014 kasutaja v\u00f5ib allalaadimise peatada ja seej\u00e4rel j\u00e4tkata katkestatud kohalt. Kui m\u00e4\u00e4rata \u201ebytes=0-0\u201d, n\u00e4eb standard ette, et edastatakse faili esimene bait, \u201ebytes=-1\u201d \u2014 viimane, \u201ebytes=1-\u201d \u2014 alates 1. bait kuni faili l\u00f5puni. Samuti on lubatud edastada mitu vahemikku \u00fches pealkirjas, n\u00e4iteks \u201eRange: bytes=0-1023,8192-10240\u201d.<\/p>\n

Lisaks on ettepanekut teise r\u00fcnnaku variandi kohta, mille eesm\u00e4rk on suurendada v\u00f5rgukoormust, suunates liiklust l\u00e4bi teise CDN, mis tegutseb proksina (n\u00e4iteks kui front-endina (FCDN) on Cloudflare ja back-endina (BCDN) Akamai). Meetod sarnaneb esimese r\u00fcnnakuga, kuid toimub CDN-v\u00f5rkude sees ja v\u00f5imaldab suurendada liiklust, kui p\u00f6\u00f6rduda l\u00e4bi teiste CDN-ide, suurendades infrastruktuuri koormust ja v\u00e4hendades teenuse kvaliteeti. <\/p>\n

Idee on selles, et r\u00fcndaja suunab CDN-i Range-p\u00e4ringud mitmete vahemike osas, nagu \u201ebytes=0-,0-,0-\u2026\u201d, \u201ebytes=1-,0-,0-\u2026\u201d v\u00f5i \u201ebytes=-1024,0-,0-\u2026\u201d. P\u00e4ringud sisaldavad suurt hulka vahemike \u201e0-\u201d, mis n\u00e4itavad, et fail tuleb edastada nullpositsioonist kuni l\u00f5puni. Vale vahemike t\u00f6\u00f6tlemise t\u00f5ttu esimese CDN-i poolel teisega, edastatakse iga vahemiku \u201e0-\u201d puhul t\u00e4iskood (vahemikke ei koguta, vaid k\u00e4iakse j\u00e4rjestikku l\u00e4bi), kui algses r\u00fcndaja saadetud p\u00e4ringus esineb vahemike dubleerimine ja kattumine. Liiklusv\u00f5imenduse aste sellise r\u00fcnnaku puhul on vahemikus 53 kuni 7432 korda.<\/p>\n

\"RangeAmp<\/center><\/p>\n

Uuringu k\u00e4igus uuriti 13 CDN-i k\u00e4itumist \u2014
\nAkamai, Alibaba Cloud, Azure, CDN77, CDNsun, Cloudflare, CloudFront, Fastly, G-Core Labs, Huawei Cloud, KeyCDN, StackPath ja Tencent Cloud. K\u00f5ik vaadeldud CDN-id lubasid esimest t\u00fc\u00fcpi r\u00fcnnakut l\u00f5pp-serverile. Teise t\u00fc\u00fcbi r\u00fcnnakule CDN-ile osutusid vastuv\u00f5tlikuks 6 teenust, millest neli v\u00f5ivad r\u00fcnnakus m\u00e4ngida esiplaani rolli (CDN77, CDNsun, Cloudflare ja StackPath) ja kolm tagaplaani rolli (Akamai, Azure ja StackPath). Suurim v\u00f5imendus saavutatakse Akamai ja StackPath'i puhul, mis lubavad Range'i p\u00e4ises m\u00e4\u00e4rata rohkem kui 10 tuhat vahemikku. CDN-i omanikke teavitati haavatavustest umbes 7 kuud tagasi, ning avalikustamise hetkel olid 12 13 CDN-ist leidnud probleemid v\u00f5i v\u00e4ljendanud valmisolekut need lahendada (ainus, kes reageerinud ei olnud StackPath).<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041f\u0435\u043a\u0438\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0426\u0438\u043d\u0445\u0443\u0430 \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0414\u0430\u043b\u043b\u0430\u0441\u0435 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043a\u043b\u0430\u0441\u0441 DoS-\u0430\u0442\u0430\u043a — RangeAmp, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 Range \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 (CDN). \u0421\u0443\u0442\u044c \u043c\u0435\u0442\u043e\u0434\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0438\u0437-\u0437\u0430 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Range-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 CDN \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 CDN \u043e\u0434\u0438\u043d \u0431\u0430\u0439\u0442 \u0438\u0437 \u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430, \u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82930,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82929","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47RangeAmp \u2014 seeria r\u00fcnnakuid CDN-idele, mis manipuleerib HTTP vahemiku p\u00e4isega | ProHoster","description":"R\u00fchma teadlasi Pekingi \u00dclikoolist, Tsinghua \u00dclikoolist ja Texase \u00dclikoolist Dallasest","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47RangeAmp \u2014 \u0441\u0435\u0440\u0438\u044f \u0430\u0442\u0430\u043a \u043d\u0430 CDN, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0430\u044f HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Range | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041f\u0435\u043a\u0438\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0426\u0438\u043d\u0445\u0443\u0430 \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0414\u0430\u043b\u043b\u0430\u0441\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-26T17:42:01+00:00","article:modified_time":"2020-05-26T17:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82929","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:28:37","updated":"2022-10-02 22:54:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=82929"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82929\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/82930"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=82929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=82929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=82929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}