{"id":97349,"date":"2020-10-17T14:42:14","date_gmt":"2020-10-17T12:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/minimizacziya-riskov-ispolzovaniya-dns-over-tls-dot-i-dns-over-https-doh"},"modified":"2020-10-17T14:42:14","modified_gmt":"2020-10-17T12:42:14","slug":"minimizacziya-riskov-ispolzovaniya-dns-over-tls-dot-i-dns-over-https-doh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/minimizacziya-riskov-ispolzovaniya-dns-over-tls-dot-i-dns-over-https-doh","title":{"rendered":"Riska samazin\u0101\u0161ana, izmantojot DNS-over-TLS (DoT) un DNS-over-HTTPS (DoH)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"RiskaRisku samazin\u0101\u0161ana, izmantojot DoH un DoT<\/p>\n

Aizsardz\u012bba pret DoH un DoT<\/h2>\n

Vai j\u016bs kontrol\u0113jat savu DNS trafiku? Organiz\u0101cijas iegulda daudz laika, naudas un p\u016b\u013cu, lai nodro\u0161in\u0101tu savu t\u012bklu dro\u0161\u012bbu. Tom\u0113r viena no jom\u0101m, kurai bie\u017ei nepietiekama uzman\u012bba tiek piev\u0113rsta, ir DNS. <\/p>\n

Labs risks, ko rada DNS, ir Verisign prezent\u0101cija<\/a><\/noindex> Infosecurity konferenc\u0113. <\/p>\n

\"Riska31% no aptauj\u0101t\u0101m izspied\u0113ju programmat\u016br\u0101m izmantoja DNS atsl\u0113gu apmai\u0146ai. P\u0113t\u012bjuma secin\u0101jumi<\/p>\n

31% no aptauj\u0101t\u0101m izspied\u0113ju programmat\u016br\u0101m izmantoja DNS atsl\u0113gu apmai\u0146ai.<\/p>\n

Probl\u0113ma ir nopietna. Saska\u0146\u0101 ar Palo Alto Networks Unit 42 p\u0113tniec\u012bbas laboratorijas datiem aptuveni 85% \u013caunpr\u0101t\u012bgas programmat\u016bras izmanto DNS, lai izveidotu vad\u012bbas un kontroles kan\u0101lu, \u013caujot uzbruc\u0113jiem viegli ieviest \u013caunprogrammat\u016bru j\u016bsu t\u012bkl\u0101 un ar\u012b nozagt datus. Kop\u0161 t\u0101s izveides DNS trafiks galvenok\u0101rt bija neapsarg\u0101ts, un t\u0101 anal\u012bzi aizsardz\u012bbas meh\u0101nismi NGFW var\u0113ja viegli veikt. <\/p>\n

Ir par\u0101d\u012bju\u0161ies jauni DNS protokoli, kas v\u0113rsti uz DNS savienojumu konfidencialit\u0101tes uzlabo\u0161anu. Tos akt\u012bvi atbalsta vado\u0161ie p\u0101rl\u016bkprogrammu pieg\u0101d\u0101t\u0101ji un citi programmat\u016bras nodro\u0161in\u0101t\u0101ji. Dr\u012bz korporat\u012bvaj\u0101s t\u012bklos s\u0101ks augt \u0161ifr\u0113t\u0101 DNS satiksme. \u0160ifr\u0113t\u0101 DNS satiksme, kuru pien\u0101c\u012bgi neanaliz\u0113 r\u012bki un kura ir at\u013cauta, rada dro\u0161\u012bbas apdraud\u0113jumu uz\u0146\u0113mumam. Piem\u0113ram, \u0161\u0101ds apdraud\u0113jums ir kriptovirusi, kas izmanto DNS \u0161ifr\u0113\u0161anas atsl\u0113gu apmai\u0146ai. Uzbruc\u0113ji pa\u0161laik pieprasa izpirkumu vair\u0101ku miljonu dol\u0101ru apm\u0113r\u0101 par piek\u013cuves atjauno\u0161anu j\u016bsu datiem. Uz\u0146\u0113mum\u0101 Garmin, piem\u0113ram, tika samaks\u0101ti 10 miljoni dol\u0101ru.<\/p>\n

Pareizi konfigur\u0113jot, NGFW var blo\u0137\u0113t vai aizsarg\u0101t DNS-over-TLS (DoT) izmanto\u0161anu, un t\u0101s var tikt izmantotas, lai blo\u0137\u0113tu DNS-over-HTTPS (DoH) izmanto\u0161anu, \u013caujot analiz\u0113t visu DNS trafiku j\u016bsu t\u012bkl\u0101.<\/p>\n

Kas ir \u0161ifr\u0113ts DNS?<\/h2>\n

Kas ir DNS<\/p>\n

Domenes v\u0101rdu sist\u0113ma (DNS) p\u0101rv\u0113r\u0161 cilv\u0113kam draudz\u012bgas dom\u0113nu nosaukumus (piem\u0113ram, adresi www.paloaltonetworks.com<\/a><\/noindex> ) uz IP adres\u0113m (piem\u0113ram, 34.107.151.202). Kad lietot\u0101js ievada dom\u0113na v\u0101rdu t\u012bmek\u013ca p\u0101rl\u016bk\u0101, p\u0101rl\u016bks nos\u016bta DNS piepras\u012bjumu uz DNS serveri, l\u016bdzot IP adresi, kas saist\u012bta ar \u0161o dom\u0113na v\u0101rdu. Atbildot, DNS serveris atgrie\u017e IP adresi, kuru izmantos \u0161is p\u0101rl\u016bks.<\/p>\n

DNS piepras\u012bjumi un atbildes tiek p\u0101rs\u016bt\u012bti pa t\u012bklu k\u0101 parasts teksts, nesl\u0113pt\u0101 veid\u0101, padarot tos uz\u0146\u0113m\u012bgus pret spiego\u0161anu vai atbildes mai\u0146u un p\u0101radres\u0101ciju uz \u013caunpr\u0101t\u012bgiem serveriem. DNS \u0161ifr\u0113\u0161ana apgr\u016btina DNS piepras\u012bjumu izseko\u0161anu vai to mai\u0146u p\u0101rs\u016bt\u012b\u0161anas laik\u0101. DNS piepras\u012bjumu un atbil\u017eu \u0161ifr\u0113\u0161ana pasarg\u0101 j\u016bs no Man-in-the-Middle uzbrukuma, vienlaikus veicot t\u0101s pa\u0161as funkcijas, ko tradicion\u0101lais DNS protokols (dom\u0113nu sist\u0113ma) ar atkl\u0101to tekstu. <\/p>\n

P\u0113d\u0113jo gadu laik\u0101 ir ieviesti divi DNS \u0161ifr\u0113\u0161anas protokoli:<\/p>\n

    \n
  1. \n

    DNS-over-HTTPS (DoH)<\/p>\n<\/li>\n

  2. \n

    DNS-over-TLS (DoT) <\/p>\n<\/li>\n<\/ol>\n

    \u0160iem protokoliem ir viena kop\u012bga iez\u012bme: tie apzin\u0101ti sl\u0113pj DNS piepras\u012bjumus no jebk\u0101da izseko\u0161anas\u2026 un ar\u012b no organiz\u0101cijas dro\u0161\u012bbas speci\u0101listiem. Protokoli galvenok\u0101rt izmanto TLS (Transport Layer Security) protokolu, lai nodro\u0161in\u0101tu \u0161ifr\u0113tu savienojumu starp klientu, kas veic piepras\u012bjumus, un DNS piepras\u012bjumu apstiprino\u0161o serveri, izmantojot portu, kas parasti netiek izmantots DNS satiksmei.<\/p>\n

    DNS piepras\u012bjumu konfidencialit\u0101te ir liela \u0161\u012b protokola priek\u0161roc\u012bba. Tom\u0113r tie rada probl\u0113mas dro\u0161\u012bbas speci\u0101listiem, kas ir atbild\u012bgi par t\u012bkla datu pl\u016bsmas uzraudz\u012bbu un \u013caunpr\u0101t\u012bgu savienojumu atkl\u0101\u0161anu un blo\u0137\u0113\u0161anu. Protokolu realiz\u0101cijas at\u0161\u0137ir\u012bbas noz\u012bm\u0113, ka anal\u012bzes metodes b\u016bs at\u0161\u0137ir\u012bgas starp DoH un DoT.<\/p>\n

    DNS over HTTPS (DoH)<\/h2>\n

    \"RiskaDNS iek\u0161\u0101 HTTPS<\/p>\n

    DoH izmanto labi zin\u0101mo 443. portu HTTPS, kuram RFC \u012bpa\u0161i nor\u0101da, ka m\u0113r\u0137is ir \"sajaukt DoH datu pl\u016bsmu ar citu HTTPS datu pl\u016bsmu taj\u0101 pa\u0161\u0101 savienojum\u0101\", \"apgr\u016btin\u0101t DNS datu pl\u016bsmas anal\u012bzi\" un t\u0101d\u0113j\u0101di apiet korporat\u012bv\u0101s kontroles pas\u0101kumus ( RFC 8484 DoH, 8.1. noda\u013ca<\/a><\/noindex> ). Protokols DoH izmanto TLS \u0161ifr\u0113\u0161anu un piepras\u012bjumu sintaksi, ko sniedz standarti HTTPS un HTTP\/2, pievienojot DNS piepras\u012bjumus un atbildes virs standarta HTTP piepras\u012bjumiem.<\/p>\n

    Riski, kas saist\u012bti ar DoH<\/h2>\n

    Ja j\u016bs nesp\u0113jat at\u0161\u0137irt parasto HTTPS trafiku no DoH piepras\u012bjumiem, tad j\u016bsu organiz\u0101cij\u0101 eso\u0161\u0101s lietojumprogrammas var (un dar\u012bs) apiet viet\u0113j\u0101s DNS iestat\u012bjumus, novirzot piepras\u012bjumus uz tre\u0161o pu\u0161u serveriem, kas atbild uz DoH piepras\u012bjumiem, t\u0101d\u0113j\u0101di apg\u0101\u017eot jebk\u0101du uzraudz\u012bbu, t.i., izn\u012bcinot iesp\u0113ju kontrol\u0113t DNS trafiku. Ide\u0101l\u0101 gad\u012bjum\u0101 jums j\u0101uzrauga DoH, izmantojot HTTPS at\u0161ifr\u0113\u0161anas funkcijas. <\/p>\n

    un Google un Mozilla ir \u012bstenoju\u0161i DoH iesp\u0113jas<\/a><\/noindex> savu p\u0101rl\u016bku jaun\u0101kaj\u0101 versij\u0101, un abas komp\u0101nijas str\u0101d\u0101 pie DoH izmanto\u0161anas noklus\u0113juma visiem DNS piepras\u012bjumiem. Microsoft ar\u012b izstr\u0101d\u0101 pl\u0101nus<\/a><\/noindex> DoH integr\u0101cijai sav\u0101s oper\u0113t\u0101jsist\u0113m\u0101s. M\u012bnuss ir tas, ka ne tikai cien\u012bjami programmat\u016bras izstr\u0101d\u0101t\u0101ji, bet ar\u012b \u013caunpr\u0101t\u012bgi lietot\u0101ji ir s\u0101ku\u0161i izmantot DoH k\u0101 l\u012bdzekli, lai apietu tradicion\u0101los uz\u0146\u0113muma ugunsm\u016bri. (Piem\u0113ram, skatiet \u0161\u0101das rakstus: PsiXBot tagad izmanto Google DoH<\/a><\/noindex> , PsiXBot turpina att\u012bst\u012bties ar atjaunin\u0101tu DNS infrastrukt\u016bru<\/a><\/noindex> un Godlua atpaka\u013cdurvju anal\u012bze<\/a><\/noindex> .) Katr\u0101 zi\u0146\u0101, gan labs, gan \u013caunpr\u0101t\u012bgs DoH trafiks paliks neredzams, atst\u0101jot organiz\u0101ciju aklu pret \u013caunpr\u0101t\u012bgu DoH izmanto\u0161anu k\u0101 kan\u0101lu \u013caunprogrammat\u016bras p\u0101rvald\u012bbai (C2) un konfidenci\u0101lu datu z\u0101dz\u012bbai.<\/p>\n

    DoH trafika redzam\u012bbas un kontroles nodro\u0161in\u0101\u0161ana<\/h2>\n

    K\u0101 lab\u0101ko risin\u0101jumu DoH kontrolei m\u0113s iesak\u0101m iestat\u012bt NGFW HTTPS trafika at\u0161ifr\u0113\u0161anu un DoH trafika blo\u0137\u0113\u0161anu (lietojumprogrammas nosaukums: dns-over-https). <\/p>\n

    Vispirms p\u0101rliecinieties, ka NGFW ir iestat\u012bts HTTPS at\u0161ifr\u0113\u0161anai, saska\u0146\u0101 ar lab\u0101ko praksi par at\u0161ifr\u0113\u0161anu<\/a><\/noindex>.<\/p>\n

    Otrk\u0101rt, izveidojiet noteikumu lietojumprogrammas \u00abdns-over-https\u00bb trafika blo\u0137\u0113\u0161anai, k\u0101 par\u0101d\u012bts zem\u0101k:<\/p>\n

    \"RiskaPalo Alto Networks NGFW noteikums DNS-over-HTTPS blo\u0137\u0113\u0161anai<\/p>\n

    K\u0101 starpposma alternat\u012bva (ja j\u016bsu organiz\u0101cija nav piln\u012bb\u0101 \u012bstenojusi HTTPS at\u0161ifr\u0113\u0161anu) NGFW var iestat\u012bt, lai piem\u0113rotu \u00abaizliegt\u00bb darb\u012bbu lietojumprogrammas \u00abdns-over-https\u00bb identifikatoram, ta\u010du efekts b\u016bs ierobe\u017eots ar zin\u0101mu DoH serveru blo\u0137\u0113\u0161anu, izmantojot to dom\u0113na nosaukumu, jo bez HTTPS at\u0161ifr\u0113\u0161anas DoH trafiku nav iesp\u0113jams piln\u012bb\u0101 p\u0101rbaud\u012bt (skat.  Palo Alto Networks Applipedia<\/a><\/noindex>   un mekl\u0113jiet fr\u0101zi \u00abdns-over-https\u00bb).<\/p>\n

    DNS over TLS (DoT)<\/h2>\n

    \"RiskaDNS iek\u0161 TLS<\/p>\n

    Kam\u0113r DoH protokols cen\u0161as sajaukt ar citu trafiku taj\u0101 pa\u0161\u0101 port\u0101, DoT t\u0101 viet\u0101 p\u0113c noklus\u0113juma izmanto \u012bpa\u0161u portu, kas rezerv\u0113ts tikai \u0161im nol\u016bkam, pat speci\u0101li aizliedzot izmantot to pa\u0161u portu tradicion\u0101lajam ne\u0161ifr\u0113tajam DNS trafikam ( RFC 7858, 3.1. noda\u013ca<\/a><\/noindex> ).<\/p>\n

    DoT protokols izmanto TLS protokolu, lai nodro\u0161in\u0101tu \u0161ifr\u0113\u0161anu, kas ietver standarta DNS protokola piepras\u012bjumus, ar trafiku, kas izmanto labi paz\u012bstamo portu 853 ( RFC 7858, 6. noda\u013ca<\/a><\/noindex> ). Protokols DoT tika izstr\u0101d\u0101ts, lai atvieglotu organiz\u0101cij\u0101m blo\u0137\u0113t satiksmi pa portu, vai nu piekr\u012bt to izmantot, bet iek\u013cauj de\u0161ifr\u0113\u0161anu \u0161aj\u0101 port\u0101.<\/p>\n

    Riski, kas saist\u012bti ar DoT<\/h2>\n

    Google ir \u012bstenojis DoT sav\u0101 klient\u0101 Android 9 Pie un v\u0113l\u0101kajos laidienos<\/a><\/noindex> , ar noklus\u0113juma iestat\u012bjumu autom\u0101tiski izmantot DoT, ja tas ir pieejams. Ja esat nov\u0113rt\u0113jis riskus un esat gatavs izmantot DoT organiz\u0101cijas l\u012bmen\u012b, t\u012bkla administr\u0101toriem skaidri j\u0101at\u013cauj izejo\u0161ais trafiks uz portu 853 caur savu perimetru \u0161im jaunajam protokolam.<\/p>\n

    DoT trafika redzam\u012bbas un kontroles nodro\u0161in\u0101\u0161ana<\/h2>\n

    K\u0101 lab\u0101ko praksi DoT kontroli m\u0113s iesak\u0101m k\u0101du no iepriek\u0161 min\u0113tajiem risin\u0101jumiem, pamatojoties uz j\u016bsu organiz\u0101cijas pras\u012bb\u0101m:<\/p>\n