Zokonda ndi Zosakonda: DNS pa HTTPS

Timasanthula malingaliro okhudzana ndi mawonekedwe a DNS pa HTTPS, omwe posachedwapa akhala "fupa la mkangano" pakati pa opereka intaneti ndi opanga masakatuli.

/Chotsani / Steve Halama

Chiyambi cha kusagwirizana

Posachedwa, media zazikulu и nsanja zamaphunziro (kuphatikiza Habr) nthawi zambiri amalemba za DNS pa protocol ya HTTPS (DoH). Imabisa zopempha ndi mayankho a DNS. Njirayi imakulolani kuti mubise maina omwe amawagwiritsa ntchito. Kuchokera m'mabuku, titha kunena kuti protocol yatsopano (mu IETF adavomereza mu 2018) adagawa gulu la IT m'misasa iwiri.

Theka limakhulupirira kuti ndondomeko yatsopanoyi idzawonjezera chitetezo cha intaneti, ndikuchigwiritsa ntchito muzogwiritsira ntchito ndi ntchito zawo. Theka lina likukhulupirira kuti ukadaulo umangosokoneza ntchito ya oyang'anira machitidwe. Tiyeni tione mkangano wa mbali zonse ziwiri.

Momwe DoH Imagwirira Ntchito

Tisanakambirane chifukwa chake ma ISP ndi ena omwe akuchita nawo msika ali a DNS kapena akutsutsana ndi HTTPS, tiyeni tiwone mwachangu momwe zimagwirira ntchito.

Pankhani ya DoH, pempho loti mudziwe adilesi ya IP yasungidwa mumayendedwe a HTTPS. Kenako imapita ku seva ya HTTP, komwe imakonzedwa pogwiritsa ntchito API. Nayi pempho lachitsanzo lochokera ku RFC 8484 (tsamba 6):

   :method = GET
   :scheme = https
   :authority = dnsserver.example.net
   :path = /dns-query?
           dns=AAABAAABAAAAAAAAAWE-NjJjaGFyYWN0ZXJsYWJl
           bC1tYWtlcy1iYXNlNjR1cmwtZGlzdGluY3QtZnJvbS1z
           dGFuZGFyZC1iYXNlNjQHZXhhbXBsZQNjb20AAAEAAQ
   accept = application/dns-message

Chifukwa chake magalimoto a DNS amabisika mumayendedwe a HTTPS. Wothandizira ndi seva amalankhulana pa doko lodziwika bwino 443. Zotsatira zake, zopempha ku dongosolo la dzina lachidziwitso zimakhalabe zosadziwika.

Chifukwa chiyani sakulandiridwa

Otsutsa DNS pa HTTPS nenanikuti protocol yatsopano idzachepetsa chitetezo cha maulumikizidwe. Wolemba malinga ndi Paul Vixie, membala wa gulu lachitukuko la DNS, zipangitsa kuti zikhale zovuta kuti ma sysadmins atseke masamba omwe angakhale oyipa. Ogwiritsa ntchito wamba adzataya kuthekera kokhazikitsa zowongolera za makolo pazosakatula.

Lingaliro la Paulo likugawidwa ndi UK ISPs. Malamulo adziko kukakamiza kuti aletse zinthu zomwe zili ndi zoletsedwa. Koma thandizo la DoH mu asakatuli limasokoneza ntchito yosefa magalimoto. Otsutsa ndondomeko yatsopanoyi akuphatikizanso Boma la Communications Center ku England (GCHQ) ndi Internet Watch Foundation (IWF), yomwe imasunga zolembera zazinthu zotsekedwa.

Mu blog yathu pa Habré:

• Nkhondo yaku US robocall - ndani akupambana ndipo chifukwa chiyani
• Ma telecoms aku Britain azilipira olembetsa chindapusa chifukwa cholumikizidwa

Akatswiri amazindikira kuti DNS pa HTTPS ikhoza kukhala chiwopsezo ku cybersecurity. Kumayambiriro kwa Julayi, akatswiri achitetezo azidziwitso ochokera ku Netlab anapeza kachilombo koyamba komwe kamagwiritsa ntchito protocol yatsopano kuchita DDoS - Godlua. Pulogalamu yaumbanda idafikira ku DoH kuti ipeze zolemba (.txt) ndikuchotsa ma URL a maseva olamula ndi owongolera.

Zopempha zobisika za DoH sizinazindikiridwe ndi pulogalamu ya antivayirasi. akatswiri achitetezo chazidziwitso manthakuti pambuyo pa Godlua pulogalamu yaumbanda ina idzabwera, yosaoneka ndi kuwunika kwa DNS.

Koma si onse amene amatsutsa

Kuteteza DNS pa HTTPS pabulogu yanga analankhula APNIC injiniya Geoff Houston. Malinga ndi iye, ndondomeko yatsopanoyi ithandiza kulimbana ndi DNS kulanda kuukira, zomwe zafala kwambiri posachedwapa. Mfundo imeneyi zimatsimikizira Lipoti la Januware la kampani yoteteza zidziwitso FireEye. Kukula kwa protocol kunathandizidwanso ndi makampani akuluakulu a IT.

Kumayambiriro kwa chaka chatha, DoH idayamba kuyesedwa ku Google. Ndipo mwezi wapitawo kampaniyo представила Kupezeka Kwanthawi Zonse kwa ntchito yawo ya DoH. Google chiyembekezokuti idzawonjezera chitetezo cha deta yanu pa intaneti ndikuteteza ku MITM.

Wopanga msakatuli wina - Mozilla - zogwiriziza DNS pa HTTPS kuyambira chilimwe chatha. Nthawi yomweyo, kampaniyo ikulimbikitsa ukadaulo watsopano m'malo a IT. Pachifukwa ichi, Internet Services Providers Association (ISPA) ngakhale osankhidwa Mozilla ndi Woyipa wapaintaneti wa Chaka. Poyankha, oimira kampaniyo adazindikiraomwe akhumudwitsidwa ndi kusafuna kwa opanga ma telecom kuti apititse patsogolo zida zapaintaneti zakale.

/Chotsani / TREbbien

Mothandizidwa ndi Mozilla atolankhani akulu adalankhula ndi ena opereka intaneti. Makamaka, ku British Telecom lingaliranikuti protocol yatsopano sidzakhudza kusefa zomwe zili mkati ndikuwonjezera chitetezo cha ogwiritsa ntchito aku UK. Mokakamizidwa ndi anthu ISPA anayenera kuchoka "zoyipa" kusankhidwa.

Othandizira pamtambo adalimbikitsanso kukhazikitsidwa kwa DNS pa HTTPS, mwachitsanzo Cloudflare. Amapereka kale ntchito za DNS kutengera protocol yatsopano. Kuti mupeze mndandanda wathunthu wamasakatuli ndi makasitomala omwe ali ndi DoH, onani GitHub.

Mulimonsemo, sikoyenera kukamba za kutha kwa mkangano pakati pa misasa iwiriyi. Ubwino wa IT umaneneratu kuti ngati DNS pa HTTPS ikhala gawo lalikulu laukadaulo wapaintaneti, zitenga osati khumi.

Zomwe timalemba mu blog yathu yamakampani:

• Momwe network ya ISP imapangidwira
• Ntchito zoyambira pamanetiweki a ISP
• Convergence ndi mgwirizano - ntchito zingapo pa chipangizo chimodzi

Source: www.habr.com