{"id":38012,"date":"2019-10-31T22:21:11","date_gmt":"2019-10-31T19:21:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/realizatsiya-ddio-v-chipah-intel-dopuskaet-setevuyu-ataku-po-opredeleniyu-nazhatij-klavish-v-seanse-ssh\/"},"modified":"2019-10-31T22:21:11","modified_gmt":"2019-10-31T19:21:11","slug":"realizatsiya-ddio-v-chipah-intel-dopuskaet-setevuyu-ataku-po-opredeleniyu-nazhatij-klavish-v-seanse-ssh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/realizatsiya-ddio-v-chipah-intel-dopuskaet-setevuyu-ataku-po-opredeleniyu-nazhatij-klavish-v-seanse-ssh","title":{"rendered":"A implementa\u00e7\u00e3o do DDIO em chips Intel permite um ataque de rede que detecta pressionamentos de teclas durante uma sess\u00e3o SSH.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Um grupo de pesquisadores da Universidade Livre de Amsterd\u00e3 e da ETH Zurich desenvolveu uma t\u00e9cnica de ataque de rede. NetCAT<\/a><\/noindex> ((Network Cache ATtack), que permite, utilizando m\u00e9todos de an\u00e1lise de dados por canais alternativos, identificar remotamente quais teclas o usu\u00e1rio pressiona durante uma sess\u00e3o SSH. O problema ocorre apenas em servidores que utilizam as tecnologias RDMA<\/a><\/noindex> (Acesso direto \u00e0 mem\u00f3ria remota) e DDIO<\/a><\/noindex> (I\/O Direto de Dados).<\/p>\n

A Intel considera<\/a><\/noindex>, tornando o ataque dif\u00edcil de realizar na pr\u00e1tica, pois requer que o invasor tenha acesso \u00e0 rede local, condi\u00e7\u00f5es est\u00e9reis e a organiza\u00e7\u00e3o de comunica\u00e7\u00e3o entre hosts usando tecnologias RDMA e DDIO, que geralmente s\u00e3o aplicadas em redes isoladas, como as que operam clusters de computa\u00e7\u00e3o. O problema recebeu um n\u00edvel de gravidade baixo (CVSS 2.6, CVE-2019-11184<\/a><\/noindex>) e \u00e9 recomendado n\u00e3o habilitar DDIO e RDMA em redes locais onde o per\u00edmetro de seguran\u00e7a n\u00e3o est\u00e1 garantido e onde clientes n\u00e3o confi\u00e1veis possam ser conectados. O DDIO \u00e9 aplicado em processadores de servidor Intel a partir de 2012 (Intel Xeon E5, E7 e SP). Sistemas baseados em processadores da AMD e de outros fabricantes n\u00e3o est\u00e3o sujeitos ao problema, pois n\u00e3o suportam a reten\u00e7\u00e3o de dados transmitidos pela rede no cache da CPU.<\/p>\n

O m\u00e9todo utilizado para o ataque lembra a vulnerabilidade «Throwhammer<\/a><\/noindex>«, que permite modificar o conte\u00fado de bits individuais na RAM atrav\u00e9s da manipula\u00e7\u00e3o de pacotes de rede em sistemas com RDMA. O novo problema \u00e9 uma consequ\u00eancia do trabalho para minimizar lat\u00eancias ao aplicar o mecanismo DDIO, que proporciona intera\u00e7\u00e3o direta entre a placa de rede e outros dispositivos perif\u00e9ricos com o cache do processador (durante o processamento dos pacotes da placa de rede, os dados s\u00e3o armazenados no cache e recuperados desse cache, sem acessar a mem\u00f3ria).<\/p>\n

Gra\u00e7as ao DDIO, tamb\u00e9m s\u00e3o armazenados no cache do processador dados gerados durante atividades de rede maliciosas. O ataque NetCAT se baseia no fato de que as placas de rede armazenam ativamente dados em cache, e a velocidade de processamento de pacotes em redes locais modernas \u00e9 suficiente para influenciar o preenchimento do cache e determinar a presen\u00e7a ou aus\u00eancia de dados no cache atrav\u00e9s da an\u00e1lise das lat\u00eancias durante a transmiss\u00e3o de dados. <\/p>\n

Ao usar sess\u00f5es interativas, como via SSH, o pacote de rede \u00e9 enviado imediatamente ap\u00f3s a tecla ser pressionada, ou seja, as lat\u00eancias entre os pacotes correlacionam-se com as lat\u00eancias entre as press\u00f5es das teclas. Usando m\u00e9todos de an\u00e1lise estat\u00edstica e considerando que as lat\u00eancias entre as press\u00f5es das teclas geralmente dependem da posi\u00e7\u00e3o da tecla no teclado, \u00e9 poss\u00edvel recriar a informa\u00e7\u00e3o digitada com uma certa probabilidade. Por exemplo, a maioria das pessoas geralmente digita «s» ap\u00f3s «a» significativamente mais r\u00e1pido do que «g» ap\u00f3s «s».<\/p>\n

A informa\u00e7\u00e3o que se acumula no cache do processador tamb\u00e9m permite inferir o tempo exato dos pacotes enviados pela placa de rede ao processar conex\u00f5es como SSH. Ao gerar um fluxo espec\u00edfico de tr\u00e1fego, o atacante pode determinar o momento em que novos dados aparecem no cache, relacionados a uma determinada atividade no sistema. Para analisar o conte\u00fado do cache, \u00e9 utilizado o m\u00e9todo Prime+Probe<\/a><\/noindex>, que envolve preencher o cache com um conjunto de valores de refer\u00eancia e medir o tempo de acesso a eles durante o preenchimento repetido para determinar as mudan\u00e7as. <\/p>\n

\"A<\/a><\/noindex><\/center><\/p>\n

N\u00e3o se exclui a aplica\u00e7\u00e3o da t\u00e9cnica proposta para determinar n\u00e3o apenas as press\u00f5es das teclas, mas tamb\u00e9m outros tipos de dados confidenciais que se acumulam no cache da CPU. Potencialmente, um ataque pode ser realizado mesmo com o RDMA desativado, mas sem RDMA sua efic\u00e1cia diminui e a execu\u00e7\u00e3o se torna significativamente mais complicada. Tamb\u00e9m \u00e9 poss\u00edvel usar DDIO para organizar um canal de comunica\u00e7\u00e3o oculto, usado para transmitir dados ap\u00f3s a comprometimento do servidor, desviando-se dos sistemas de seguran\u00e7a.<\/p>\n

\r\n \"Por\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 NetCAT (Network Cache ATtack), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044f \u043c\u0435\u0442\u043e\u0434\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c, \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0442\u044c \u043a\u043b\u0430\u0432\u0438\u0448\u0438, \u043d\u0430\u0436\u0438\u043c\u0430\u0435\u043c\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0441\u0435\u0430\u043d\u0441\u0435 SSH. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 RDMA (Remote direct memory access) \u0438 DDIO […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28530,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38012","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A implementa\u00e7\u00e3o do DDIO em chips Intel permite um ataque de rede para determinar pressionamentos de teclas em sess\u00f5es SSH | ProHoster","description":"Um grupo de pesquisadores da Universidade Livre de Amsterd\u00e3 e da ETH Zurich desenvolveu uma t\u00e9cnica de ataque de rede.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/realizatsiya-ddio-v-chipah-intel-dopuskaet-setevuyu-ataku-po-opredeleniyu-nazhatij-klavish-v-seanse-ssh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f DDIO \u0432 \u0447\u0438\u043f\u0430\u0445 Intel \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044e \u043d\u0430\u0436\u0430\u0442\u0438\u0439 \u043a\u043b\u0430\u0432\u0438\u0448 \u0432 \u0441\u0435\u0430\u043d\u0441\u0435 SSH | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u0442\u0430\u043a\u0438","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/realizatsiya-ddio-v-chipah-intel-dopuskaet-setevuyu-ataku-po-opredeleniyu-nazhatij-klavish-v-seanse-ssh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:21:11+00:00","article:modified_time":"2019-10-31T19:21:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38012","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 20:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 22:50:57","updated":"2026-01-23 20:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/38012","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=38012"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/38012\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/28530"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=38012"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=38012"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=38012"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}