{"id":120072,"date":"2024-10-07T13:09:25","date_gmt":"2024-10-07T11:09:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah"},"modified":"2024-10-07T13:09:25","modified_gmt":"2024-10-07T11:09:25","slug":"uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","title":{"rendered":"The CUPS vulnerability has proven useful for amplifying traffic during DDoS attacks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Grupa odpowiedzialna za bezpiecze\u0144stwo sieci dostarczania tre\u015bci Akamai zidentyfikowa\u0142a dodatkowy wektor ataku na proces cups-browsed, opr\u00f3cz jego wykorzystania jako jednego z ogniw w exploicie, prowadz\u0105cym do wykonania kodu w systemie. Przez wysy\u0142anie zapyta\u0144 do procesu cups-browsed, kt\u00f3ry akceptuje po\u0142\u0105czenia bez ogranicze\u0144 na porcie 631, mo\u017cna spowodowa\u0107 wys\u0142anie danych do innego hosta, kt\u00f3rych rozmiar b\u0119dzie do 600 razy wi\u0119kszy ni\u017c oryginalne zapytanie. Dla por\u00f3wnania, wsp\u00f3\u0142czynnik wzmocnienia dla memcached mo\u017ce osi\u0105gn\u0105\u0107 10-50 tysi\u0119cy razy, NTP \u2014 556 razy, DNS \u2014 28-54, RIPv2 \u2014 21, SNMPv2 \u2014 6. <\/p>\n

Taka cecha pozwala na wykorzystanie system\u00f3w z cups-browsed jako wzmacniaczy ruchu podczas atak\u00f3w DDoS. Metoda ataku z wykorzystaniem wzmacniacza ruchu opiera si\u0119 na tym, \u017ce zapytania z komputer\u00f3w bior\u0105cych udzia\u0142 w atakach DDoS nie s\u0105 kierowane bezpo\u015brednio do systemu ofiary, lecz przez po\u015bredni wzmacniacz. W trakcie skanowania sieci zidentyfikowano ponad 198 tysi\u0119cy podatnych system\u00f3w z CUPS, z czego 34% (58 tysi\u0119cy system\u00f3w) okaza\u0142o si\u0119 zdolnych do wzmacniania ruchu w ataku DDoS. <\/p>\n

W przeciwie\u0144stwie do metod wzmacniania ruchu wymagaj\u0105cych wysy\u0142ania pakiet\u00f3w UDP z fa\u0142szywym adresem zwrotnym ofiary, u\u017cycie cups-browsed pozwala obej\u015b\u0107 si\u0119 bez spoofingu. Us\u0142uga cups-browsed ma wbudowan\u0105 mo\u017cliwo\u015b\u0107 pobierania plik\u00f3w PPD z dowolnego serwera<\/a> w odpowiedzi na nieautoryzowane zapytanie zewn\u0119trzne, podczas kt\u00f3rego klient przesy\u0142a URL, a cups-browsed pr\u00f3buje pobra\u0107 plik PPD z wskazanego serwera. <\/p>\n

Wysy\u0142aj\u0105c \u017c\u0105danie o za\u0142adowanie pliku PPD w cups-browsed, mo\u017cna osi\u0105gn\u0105\u0107 dodanie do warto\u015bci \u201eIPP URI\u201d dodatkowego wype\u0142nienia, kt\u00f3re mo\u017ce wynosi\u0107 do 989 bajt\u00f3w. W tym przypadku w inicjowanym \u017c\u0105daniu cups-browsed warto\u015b\u0107 \u201eIPP URI\u201d jest duplikowana \u2014 raz w nag\u0142\u00f3wku HTTP, a drugi raz wewn\u0105trz cia\u0142a \u017c\u0105dania POST, a zapytania s\u0105 cyklicznie powtarzane po nieudanych pr\u00f3bach za\u0142adunku i zwracaniu. serwerem<\/a> 404 kodu b\u0142\u0119du. <\/p>\n

Na 62% (35900) sprawdzonych system\u00f3w cups-browsed wys\u0142a\u0142 co najmniej 10 zapyta\u0144 TCP\/IPP\/HTTP do systemu atakowanego w odpowiedzi na jedno pierwotne zapytanie UDP. W \u015brednim przypadku dla 58000 podatnych system\u00f3w liczba powt\u00f3rnych pr\u00f3b wynios\u0142a 45. W najlepszym scenariuszu wys\u0142anie jednego 30-bajtowego pierwotnego zapytania przy 45 powt\u00f3rnych pr\u00f3bach zaowocuje wys\u0142aniem do systemu docelowego 18000 bajt\u00f3w danych, co oznacza, \u017ce zaobserwowane zostanie wzmocnienie ruchu o 600 razy. W najgorszym scenariuszu wzmocnienie wynosi 108 razy. <\/p>\n

Dodatkowo warto wspomnie\u0107 o odparciu przez firm\u0119 Cloudflare rekordowego ataku DDoS, w wyniku kt\u00f3rego na system ofiary skierowano ruch o przepustowo\u015bci 3.8 terabita na sekund\u0119 (2.14 miliarda pakiet\u00f3w na sekund\u0119). Zauwa\u017cono, \u017ce atak zosta\u0142 zorganizowany z wykorzystaniem du\u017cej liczby skompromitowanych domowych router\u00f3w Asus i Mikrotik, a tak\u017ce urz\u0105dze\u0144 DVR oraz serwer\u00f3w WWW, kt\u00f3re zosta\u0142y zhakowane, mi\u0119dzy innymi wykorzystuj\u0105c stosunkowo nowe luki w zabezpieczeniach.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0430\u044f \u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Akamai, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 cups-browsed, \u043f\u043e\u043c\u0438\u043c\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0432\u0435\u043d\u044c\u0435\u0432 \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u043c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0427\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 cups-browsed, \u0431\u0435\u0437 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u044e\u0449\u0435\u043c\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043d\u0430 631 \u043f\u043e\u0440\u0442\u0443, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u0445\u043e\u0441\u0442, \u0440\u0430\u0437\u043c\u0435\u0440 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0435\u0432\u044b\u0448\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120072","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wykryto podatno\u015b\u0107 w CUPS, kt\u00f3ra mo\u017ce zosta\u0107 wykorzystana do wzmocnienia ruchu podczas atak\u00f3w DDoS | ProHoster","description":"Grupa odpowiedzialna za bezpiecze\u0144stwo sieci dostarczania tre\u015bci Akamai zidentyfikowa\u0142a dodatkowy wektor ataku na proces cups-browsed, poza jego wykorzystaniem jako jednego z element\u00f3w w exploicie prowadz\u0105cym do.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CUPS \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u0430 \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u0440\u0438 DDoS-\u0430\u0442\u0430\u043a\u0430\u0445 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0430\u044f \u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Akamai, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 cups-browsed, \u043f\u043e\u043c\u0438\u043c\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0432\u0435\u043d\u044c\u0435\u0432 \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u043c \u043a.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-10-07T11:09:25+00:00","article:modified_time":"2024-10-07T11:09:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120072","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:46:25","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 07:07:19","updated":"2026-02-22 15:46:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/120072","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=120072"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/120072\/revisions"}],"predecessor-version":[{"id":162469,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/120072\/revisions\/162469"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=120072"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=120072"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=120072"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}