{"id":114452,"date":"2024-03-20T12:25:49","date_gmt":"2024-03-20T10:25:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami"},"modified":"2024-03-20T12:25:49","modified_gmt":"2024-03-20T10:25:49","slug":"ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","title":{"rendered":"Ataque a alguns protocolos baseados em UDP, levando a um looping na troca de pacotes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O Centro de Coordena\u00e7\u00e3o CERT (Grupo de Resposta a Emerg\u00eancias de Computadores) publicou um aviso sobre uma s\u00e9rie de vulnerabilidades em implementa\u00e7\u00f5es de v\u00e1rios protocolos de aplicativo que utilizam o protocolo UDP como transporte. As vulnerabilidades podem ser exploradas para realizar nega\u00e7\u00e3o de servi\u00e7o devido \u00e0 possibilidade de um loop de troca de pacotes entre dois hosts. Por exemplo, atacantes podem causar a exaust\u00e3o da largura de banda dispon\u00edvel na rede, interromper servi\u00e7os de rede (como criando alta carga e excedendo o limite de taxa de solicita\u00e7\u00f5es) e implementar amplificadores de tr\u00e1fego para ataques DDoS. <\/p>\n

Dos protocolos, algumas implementa\u00e7\u00f5es vulner\u00e1veis incluem DNS, NTP, TFTP, Echo (RFC862), Chargen (RFC864) e QOTD (RFC865). A presen\u00e7a da vulnerabilidade (CVE-2024-2169) foi confirmada em produtos espec\u00edficos das empresas Cisco, Microsoft, Broadcom, Brother, Honeywell (CVE-2024-1309) e MikroTik. Como medidas paliativas para mitigar as vulnerabilidades, recomenda-se ativar a prote\u00e7\u00e3o contra spoofing (uRPF) no firewall, limitar o acesso a servi\u00e7os UDP desnecess\u00e1rios e configurar limites de taxa de tr\u00e1fego (rate-limit e QoS). <\/p>\n

As vulnerabilidades s\u00e3o causadas pela falta de prote\u00e7\u00e3o do protocolo UDP contra o spoofing de endere\u00e7os \u2014 na aus\u00eancia de prote\u00e7\u00e3o contra spoofing nos roteadores de tr\u00e2nsito, um atacante pode especificar no pacote UDP um endere\u00e7o IP de um servidor qualquer e enviar esse pacote para outro servidor, que retornar\u00e1 uma resposta ao endere\u00e7o falsificado indicado. O m\u00e9todo de ataque consiste em criar uma situa\u00e7\u00e3o de looping de troca de pacotes entre servidores que utilizam implementa\u00e7\u00f5es vulner\u00e1veis do protocolo. Por exemplo, em resposta ao pacote recebido, o servidor-alvo pode enviar uma resposta com um c\u00f3digo de erro, enquanto o servidor cujo endere\u00e7o foi inserido pelo atacante retornar\u00e1 sua resposta, que, por sua vez, levar\u00e1 novamente ao retorno de um pacote com o c\u00f3digo de erro. Assim, servidores<\/a> come\u00e7ar\u00e1 a jogar pacotes entre si em um 'ping-pong' infinito.

\"Ataque<\/center> <\/p>\n

Vale ressaltar que esse m\u00e9todo de ataque n\u00e3o \u00e9 novo e servidor<\/a> A sincroniza\u00e7\u00e3o de tempo ntpd teve uma das vulnerabilidades atacadas eliminada em 2009 (CVE-2009-3563) nas vers\u00f5es 4.2.4p8 e 4.2.5. O ataque consistia no envio de um pacote NTP com um endere\u00e7o falsificado e o sinalizador MODE_PRIVATE ativado, que, ao ser processado, fazia com que o servidor-alvo retornasse uma resposta de que n\u00e3o era poss\u00edvel utilizar o modo privado, mantendo o sinalizador MODE_PRIVATE ativado na resposta. Consequentemente, outro servidor tamb\u00e9m n\u00e3o conseguia processar esse sinalizador e retornava sua pr\u00f3pria resposta, resultando em um loop de troca de pacotes entre dois servidores NTP. Para o protocolo DNS, um aviso sobre a possibilidade de um ataque semelhante foi publicado em 1996. <\/p>\n

Uma varredura global de endere\u00e7os na internet revelou que atualmente h\u00e1 pelo menos 23 mil servidores TFTP vulner\u00e1veis, 63 mil servidores DNS, 89 mil servidores NTP, 56 mil servi\u00e7os Echo\/RFC862, 22 mil servi\u00e7os Chargen\/RFC864 e 21 mil servi\u00e7os QOTD\/RFC865. Sup\u00f5e-se que, no caso dos servidores NTP, a presen\u00e7a de vulnerabilidades n\u00e3o corrigidas esteja relacionada ao uso de vers\u00f5es muito antigas do ntpd, lan\u00e7adas antes de 2010. Os servi\u00e7os Echo, Chargen e QOTD s\u00e3o vulner\u00e1veis por sua pr\u00f3pria arquitetura. A situa\u00e7\u00e3o com os servidores TFTP e DNS requer investiga\u00e7\u00e3o junto a seus administradores. Os servidores atftpd e tftpd n\u00e3o est\u00e3o sujeitos a esse problema, pois utilizam um n\u00famero aleat\u00f3rio de porta de rede de origem ao enviar respostas. Entre os servidores DNS vulner\u00e1veis, menciona-se o dproxy-nexgen. Nos produtos Microsoft, o problema se manifesta nos WDS (Servi\u00e7os de Implanta\u00e7\u00e3o do Windows), e nos produtos Cisco, a vulnerabilidade est\u00e1 presente nos roteadores das s\u00e9ries 2800 e 2970.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b UDP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u0445\u043e\u0441\u0442\u0430\u043c\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u043e\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0442\u0438, \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114453,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114452","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ataque a alguns protocolos baseados em UDP, resultando em um loop de troca de pacotes | ProHoster","description":"O Centro de Coordena\u00e7\u00e3o CERT (Grupo de Resposta a Emerg\u00eancias Computacionais) publicou um aviso sobre uma s\u00e9rie de vulnerabilidades em implementa\u00e7\u00f5es de v\u00e1rios protocolos de aplica\u00e7\u00e3o que utilizam como transporte.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 UDP, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044e \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 | ProHoster","og:description":"\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-20T10:25:49+00:00","article:modified_time":"2024-03-20T10:25:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114452","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:37:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=114452"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114452\/revisions"}],"predecessor-version":[{"id":159859,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114452\/revisions\/159859"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/114453"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=114452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=114452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=114452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}