Um grupo de pesquisadores da Universidade da Calif\u00f3rnia em Riverside publicou uma nova variante do ataque SAD DNS (CVE-2021-20322), que continua a funcionar apesar da prote\u00e7\u00e3o adicionada no ano passado para bloquear a vulnerabilidade CVE-2020-25705. O novo m\u00e9todo \u00e9 essencialmente semelhante \u00e0 vulnerabilidade do ano passado, diferenciando-se apenas pelo uso de um tipo diferente de pacotes ICMP para verificar portas UDP ativas. O ataque proposto permite a inje\u00e7\u00e3o de dados falsos no cache do servidor DNS, o que pode ser usado para substituir o endere\u00e7o IP de um dom\u00ednio qualquer no cache e redirecionar solicita\u00e7\u00f5es para o dom\u00ednio para o servidor do atacante. <\/p>\n
O m\u00e9todo proposto \u00e9 funcional apenas na pilha de rede do Linux devido \u00e0 vincula\u00e7\u00e3o \u00e0s caracter\u00edsticas do mecanismo de processamento de pacotes ICMP no Linux, que \u00e9 a fonte de vazamento de dados, facilitando a identifica\u00e7\u00e3o do n\u00famero da porta UDP utilizada. servidor<\/a> para enviar uma solicita\u00e7\u00e3o externa. Mudan\u00e7as para bloquear o vazamento de informa\u00e7\u00f5es foram incorporadas ao n\u00facleo do Linux no final de agosto (a corre\u00e7\u00e3o foi inclu\u00edda no n\u00facleo 5.15 e nas atualiza\u00e7\u00f5es de setembro dos ramos LTS do n\u00facleo). A corre\u00e7\u00e3o consiste na altera\u00e7\u00e3o do uso do algoritmo de hash SipHash em vez do Jenkins Hash nos caches de rede. O status de corre\u00e7\u00e3o da vulnerabilidade nas distribui\u00e7\u00f5es pode ser avaliado nas seguintes p\u00e1ginas: Debian, RHEL, Fedora, SUSE, Ubuntu. <\/p>\n De acordo com os pesquisadores que descobriram o problema, cerca de 38% dos resolvedores abertos dispon\u00edveis na rede est\u00e3o vulner\u00e1veis, incluindo servi\u00e7os DNS populares, como OpenDNS e Quad9 (9.9.9.9). Em termos de software de servidor, o ataque pode ser realizado em servidores Linux utilizando pacotes como BIND, Unbound e dnsmasq. Em servidores DNS que operam com sistemas Windows e BSD, o problema n\u00e3o se manifesta. Para que o ataque seja bem-sucedido, \u00e9 necess\u00e1rio utilizar spoofing de IP, ou seja, \u00e9 preciso que o provedor do atacante n\u00e3o bloqueie pacotes com um endere\u00e7o IP de origem falso. <\/p>\n Lembramos que o ataque SAD DNS permite contornar as prote\u00e7\u00f5es adicionadas aos servidores DNS para bloquear o m\u00e9todo cl\u00e1ssico de envenenamento de cache DNS, proposto em 2008 por Dan Kaminsky. O m\u00e9todo de Kaminsky manipula o tamanho diminuto do campo do identificador da consulta DNS, que possui apenas 16 bits. Para descobrir o identificador da transa\u00e7\u00e3o DNS necess\u00e1rio para falsifica\u00e7\u00e3o de nome de host, basta enviar cerca de 7000 consultas e simular cerca de 140 mil respostas falsas. O ataque consiste no envio a um resolvedor DNS de um grande n\u00famero de pacotes com uma liga\u00e7\u00e3o falsa ao IP e com diferentes identificadores de transa\u00e7\u00e3o DNS. Para evitar o cache da primeira resposta, em cada resposta falsa \u00e9 especificado um nome de dom\u00ednio ligeiramente modificado (1.example.com, 2.example.com, 3.example.com, etc.). <\/p>\n Para proteger contra esse tipo de ataque, os fabricantes de servidores DNS implementaram a distribui\u00e7\u00e3o aleat\u00f3ria dos n\u00fameros das portas de rede de origem a partir das quais s\u00e3o enviados os pedidos de resolu\u00e7\u00e3o, o que compensou o tamanho insuficientemente grande do identificador. Ap\u00f3s a implementa\u00e7\u00e3o da prote\u00e7\u00e3o, para enviar uma resposta falsa al\u00e9m de descobrir o identificador de 16 bits, tornou-se necess\u00e1rio tamb\u00e9m adivinhar uma das 64 mil portas, o que aumentou o n\u00famero de combina\u00e7\u00f5es a 2^32. <\/p>\n O m\u00e9todo SAD DNS permite simplificar radicalmente a determina\u00e7\u00e3o do n\u00famero da porta de rede e reduzir o ataque ao m\u00e9todo cl\u00e1ssico de Kaminsky. O atacante pode determinar o acesso a portas UDP n\u00e3o utilizadas e ativas, aproveitando a vazamento de informa\u00e7\u00f5es sobre a atividade das portas de rede ao processar pacotes ICMP de resposta. O m\u00e9todo permite reduzir em 4 ordens de magnitude o n\u00famero de combina\u00e7\u00f5es poss\u00edveis \u2014 2^16+2^16 em vez de 2^32 (131_072 em vez de 4_294_967_296). O vazamento de informa\u00e7\u00f5es que permite identificar rapidamente portas UDP ativas \u00e9 causado por uma falha no c\u00f3digo de processamento de pacotes ICMP com solicita\u00e7\u00f5es de fragmenta\u00e7\u00e3o (flag ICMP Fragmentation Needed) ou redirecionamento (flag ICMP Redirect). O envio de tais pacotes altera o estado do cache na pilha de rede, o que permite, com base na rea\u00e7\u00e3o do servidor, determinar qual das portas UDP est\u00e1 ativa e qual n\u00e3o est\u00e1. <\/p>\n Cen\u00e1rio de ataque: Quando o resolvedor DNS tenta determinar um nome de dom\u00ednio, ele envia uma consulta UDP para o servidor DNS do dom\u00ednio em quest\u00e3o. No momento em que o resolvedor aguarda a resposta, o atacante pode rapidamente identificar o n\u00famero da porta de origem que foi usada para enviar a solicita\u00e7\u00e3o e enviar uma resposta falsa, se passando pelo servidor DNS leg\u00edtimo, usando spoofing. endere\u00e7os IP<\/a>O resolvedor DNS armazenar\u00e1 em cache os dados fornecidos na resposta falsa e por um tempo retornar\u00e1 o endere\u00e7o IP enganoso fornecido pelo atacante para todas as outras consultas DNS do nome de dom\u00ednio. \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-25705. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0432 \u0446\u0435\u043b\u043e\u043c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0442\u0438\u043f\u0430 ICMP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 UDP-\u043f\u043e\u0440\u0442\u043e\u0432. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102308","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nova variante do ataque SAD DNS para inser\u00e7\u00e3o de dados falsos no cache DNS | ProHoster","description":"Um grupo de pesquisadores da Universidade da Calif\u00f3rnia, em Riverside, publicou uma nova variante do ataque SAD DNS (CVE-2021-20322), que funciona apesar das prote\u00e7\u00f5es adicionadas no ano passado para bloquear essa vulnerabilidade.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-17T19:36:54+00:00","article:modified_time":"2021-11-17T19:36:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102308","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-17 19:38:17","updated":"2026-02-09 21:46:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/102308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=102308"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/102308\/revisions"}],"predecessor-version":[{"id":160307,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/102308\/revisions\/160307"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=102308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=102308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=102308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"