{"id":39289,"date":"2019-10-31T22:29:21","date_gmt":"2019-10-31T19:29:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ataka-cpdos-pozvolyayushhaya-sdelat-nedostupnymi-stranitsy-otdavaemye-cherez-cdn\/"},"modified":"2019-10-31T22:29:21","modified_gmt":"2019-10-31T19:29:21","slug":"ataka-cpdos-pozvolyayushhaya-sdelat-nedostupnymi-stranitsy-otdavaemye-cherez-cdn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/ataka-cpdos-pozvolyayushhaya-sdelat-nedostupnymi-stranitsy-otdavaemye-cherez-cdn","title":{"rendered":"De CPDoS-aanval, die het mogelijk maakt om pagina's, die via CDN worden aangeboden, ontoegankelijk te maken.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Onderzoekers van de universiteiten van Hamburg en Keulen<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/cpdos.org\/\">hebben ontwikkeld<\/a><\/noindex> nieuwe aanvalstechnieken op content delivery netwerken en cache proxy's \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/cpdos.org\/paper\/Your_Cache_Has_Fallen__Cache_Poisoned_Denial_of_Service_Attack__Preprint_.pdf\">CPDoS<\/a><\/noindex> (Cache-Poisoned Denial-of-Service). Deze aanval maakt het mogelijk om toegang tot een pagina te verhinderen door de cache te vervuilen. <\/p>\n<p>Het probleem houdt verband met het feit dat CDN's niet alleen succesvolle verzoeken cachen, maar ook situaties waarin de http-server een fout retourneert. Gewoonlijk geeft de server bij problemen met het indienen van verzoeken een foutcode 400 (Bad Request) terug, met uitzondering van IIS, dat bij te grote headers een foutcode 404 (Not Found) retourneert. De standaard staat alleen het cachen van fouten met de codes 404 (Not Found), 405 (Method Not Allowed), 410 (Gone) en 501 (Not Implemented) toe, maar sommige CDN's cachen ook antwoorden met code 400 (Bad Request), die afhankelijk is van het verzonden verzoek. <\/p>\n<p>Aanvallers kunnen een '400 Bad Request' foutmelding op de originele bron veroorzaken door een verzoek te verzenden met specifiek opgemaakte HTTP-headers. Deze headers worden niet door de CDN meegenomen, waardoor informatie over het onvermogen om toegang te krijgen tot de pagina in de cache komt, en alle andere geldige gebruikersverzoeken tot aan de timeout kunnen leiden tot de foutmelding, ondanks dat de oorspronkelijke site inhoud zonder problemen levert. <\/p>\n<p>Er worden drie aanvalsmethoden voorgesteld om de HTTP-server te dwingen een fout te retourneren:  <\/p>\n<ul>\n<li class=\"l\"> HMO (HTTP Method Override) \u2014 de aanvaller kan de oorspronkelijke methode van het verzoek wijzigen via de headers 'X-HTTP-Method-Override', 'X-HTTP-Method' of 'X-Method-Override', die door sommige servers worden ondersteund maar niet door de CDN worden genoteerd. Bijvoorbeeld, de oorspronkelijke methode 'GET' kan worden veranderd in de op de server verboden methode 'DELETE' of een voor statische inhoud niet toepasbare methode 'POST';\n<p><center><noindex><a rel=\"nofollow\" href=\"https:\/\/cpdos.org\/img\/HMO.png\"><img decoding=\"async\" alt=\"De CPDoS-aanval, die het mogelijk maakt om pagina&#039;s, die via CDN worden aangeboden, ontoegankelijk te maken.\" src=\"\/wp-content\/uploads\/2019\/10\/6449e613e38cfb3cb1f2f185921214e9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<li class=\"l\"> HHO (HTTP Header Oversize) \u2014 de aanvaller kan de grootte van de header zo aanpassen dat deze de limiet van de oorspronkelijke server overschrijdt, maar niet onder de beperkingen van de CDN valt. Bijvoorbeeld, Apache httpd beperkt de grootte van het header tot 8 KB, terwijl de CDN Amazon Cloudfront headers tot 20 KB toestaat;<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/cpdos.org\/img\/HHO.png\"><img decoding=\"async\" alt=\"De CPDoS-aanval, die het mogelijk maakt om pagina&#039;s, die via CDN worden aangeboden, ontoegankelijk te maken.\" src=\"\/wp-content\/uploads\/2019\/10\/2bbefaff1f9b5b1b4e568801cd7ac7cd.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<li class=\"l\"> HMC (HTTP Meta Character) \u2014 de aanvaller kan speciale tekens (\\n, \\r, \\a) in het verzoek invoegen die op de oorspronkelijke server als ongeldig worden beschouwd, maar die door de CDN worden genegeerd.\n<p><center><noindex><a rel=\"nofollow\" href=\"https:\/\/cpdos.org\/img\/HMC.png\"><img decoding=\"async\" alt=\"De CPDoS-aanval, die het mogelijk maakt om pagina&#039;s, die via CDN worden aangeboden, ontoegankelijk te maken.\" src=\"\/wp-content\/uploads\/2019\/10\/5e8426e93a48735796b600db00a5c99d.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<\/ul>\n<p>De meest kwetsbare aanval vond plaats bij CDN CloudFront, dat wordt gebruikt in Amazon Web Services (AWS). Op dit moment heeft Amazon het probleem al opgelost door fouten in de cache te verbieden, maar de onderzoekers hadden meer dan drie maanden nodig om beveiliging toe te voegen. Het probleem heeft ook invloed gehad op Cloudflare, Varnish, Akamai, CDN77 en<br \/>\nFastly, maar de aanval via hen is beperkt tot specifieke servers die IIS, ASP.NET gebruiken, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/pallets\/flask\">Flask<\/a><\/noindex> en <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/playframework\/play1\/issues\/1300\">Play 1<\/a><\/noindex>. <noindex><a rel=\"nofollow\" href=\"https:\/\/cpdos.org\/paper\/Your_Cache_Has_Fallen__Cache_Poisoned_Denial_of_Service_Attack__Preprint_.pdf\">Er wordt opgemerkt<\/a><\/noindex>, wat betekent dat tot 11% van de domeinen van het Amerikaanse ministerie van Defensie, 16% van de URL's uit de HTTP Archive-database en ongeveer 30% van de 500 grootste websites volgens Alexa potentieel kwetsbaar kunnen zijn voor de aanval.<\/p>\n<p>Als een omweg om aanvallen aan de serverzijde te blokkeren, kan de header 'Cache-Control: no-store' worden ingesteld, waardoor caching van antwoorden wordt verboden. In sommige CDN's, bijvoorbeeld bij<br \/>\n CloudFront en Akamai, kan foutcaching op profielniveau worden uitgeschakeld via de instellingen. Voor bescherming kunnen ook webapplicatie-firewalls (WAF) worden gebruikt, maar ze moeten aan de kant van de CDN worden ge\u00efmplementeerd, v\u00f3\u00f3r de hosts die cacheren.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Bron: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51753\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0430\u043c\u0431\u0443\u0440\u0433\u0441\u043a\u043e\u0433\u043e \u0438 \u041a\u0451\u043b\u044c\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0438 \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u043a\u0441\u0438 &#8212; CPDoS (Cache-Poisoned Denial-of-Service). \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u044d\u0448\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e CDN \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0442 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u043d\u043e \u0438 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438, \u043a\u043e\u0433\u0434\u0430 http-\u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443. \u041a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u043f\u0440\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445 \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39290,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-39289","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0430\u043c\u0431\u0443\u0440\u0433\u0441\u043a\u043e\u0433\u043e \u0438 \u041a\u0451\u043b\u044c\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0438 \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u043a\u0441\u0438 -\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/news\/ataka-cpdos-pozvolyayushhaya-sdelat-nedostupnymi-stranitsy-otdavaemye-cherez-cdn\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 CPDoS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b, \u043e\u0442\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 CDN | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0430\u043c\u0431\u0443\u0440\u0433\u0441\u043a\u043e\u0433\u043e \u0438 \u041a\u0451\u043b\u044c\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0438 \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u043a\u0441\u0438 -\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/news\/ataka-cpdos-pozvolyayushhaya-sdelat-nedostupnymi-stranitsy-otdavaemye-cherez-cdn\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:29:21+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:29:21+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 CPDoS-aanval, die pagina's die via CDN worden geleverd onbereikbaar maakt | ProHoster","description":"Onderzoekers van de universiteiten van Hamburg en Keulen hebben een nieuwe techniek ontwikkeld voor aanvallen op content delivery netwerken en cacheproxy's -","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/ataka-cpdos-pozvolyayushhaya-sdelat-nedostupnymi-stranitsy-otdavaemye-cherez-cdn","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 CPDoS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b, \u043e\u0442\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 CDN | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0430\u043c\u0431\u0443\u0440\u0433\u0441\u043a\u043e\u0433\u043e \u0438 \u041a\u0451\u043b\u044c\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0438 \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u043a\u0441\u0438 -","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/ataka-cpdos-pozvolyayushhaya-sdelat-nedostupnymi-stranitsy-otdavaemye-cherez-cdn","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:29:21+00:00","article:modified_time":"2019-10-31T19:29:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39289","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 01:34:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:52:27","updated":"2026-01-24 01:34:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/39289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=39289"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/39289\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media\/39290"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=39289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=39289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=39289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}