{"id":82460,"date":"2020-05-21T19:42:00","date_gmt":"2020-05-21T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery"},"modified":"2020-05-21T19:42:00","modified_gmt":"2020-05-21T17:42:00","slug":"ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","title":{"rendered":"Ataque NXNSAttack, afetando todos os resolvers DNS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Um grupo de pesquisadores da Universidade de Tel Aviv e do Centro Interdisciplinar de Herzliya (Israel) desenvolveu<\/a><\/noindex> um novo m\u00e9todo de ataque NXNSAttack<\/a><\/noindex> (PDF<\/a><\/noindex>), permitindo o uso de qualquer resolvedor DNS como amplificadores de tr\u00e1fego, proporcionando um n\u00edvel de amplifica\u00e7\u00e3o de at\u00e9 1621 vezes no n\u00famero de pacotes (para cada consulta enviada ao resolvedor, \u00e9 poss\u00edvel gerar at\u00e9 1621 consultas para o servidor da v\u00edtima) e at\u00e9 163 vezes no tr\u00e1fego. <\/p>\n

O problema est\u00e1 relacionado \u00e0s caracter\u00edsticas do funcionamento do protocolo e afeta todos os servidores DNS que suportam o processamento recursivo de consultas, incluindo BIND<\/a><\/noindex> (CVE-2020-8616), Knot<\/a><\/noindex> (CVE-2020-12667), PowerDNS<\/a><\/noindex> (CVE-2020-10995), Windows DNS Server<\/a><\/noindex> e Unbound<\/a><\/noindex> (CVE-2020-12662), bem como os servi\u00e7os DNS p\u00fablicos do Google, Cloudflare, Amazon, Quad9, ICANN e outras empresas. A corre\u00e7\u00e3o do problema foi coordenada com os desenvolvedores dos servidores DNS, que ao mesmo tempo lan\u00e7aram atualiza\u00e7\u00f5es para corrigir a vulnerabilidade em seus produtos. A prote\u00e7\u00e3o contra o ataque foi implementada nas vers\u00f5es
\nUnbound 1.10.1<\/a><\/noindex>, Knot Resolver 5.1.1<\/a><\/noindex>, PowerDNS Recursor 4.3.1, 4.2.2, 4.1.16<\/a><\/noindex>, BIND 9.11.19, 9.14.12, 9.16.3<\/a><\/noindex>.<\/p>\n

O ataque baseia-se na utiliza\u00e7\u00e3o de consultas pelo atacante que referenciam um grande n\u00famero de registros NS fict\u00edcios que nunca foram encontrados anteriormente, os quais s\u00e3o delegados para resolver um nome, mas sem a inclus\u00e3o de registros glue na resposta com informa\u00e7\u00f5es sobre os endere\u00e7os IP dos servidores NS. Por exemplo, o atacante envia uma consulta para resolver o nome sd1.attacker.com, controlando o servidor DNS respons\u00e1vel pelo dom\u00ednio attacker.com. Em resposta \u00e0 consulta do resolvedor ao servidor DNS do atacante, \u00e9 dada uma resposta que delega a resolu\u00e7\u00e3o do endere\u00e7o sd1.attacker.com ao servidor DNS da v\u00edtima, atrav\u00e9s da inclus\u00e3o de registros NS na resposta sem detalhamento dos IPs dos servidores NS. Como o servidor NS mencionado n\u00e3o foi encontrado anteriormente e seu endere\u00e7o IP n\u00e3o est\u00e1 especificado, o resolvedor tenta determinar o endere\u00e7o IP do servidor NS, enviando uma consulta ao servidor DNS da v\u00edtima que gerencia o dom\u00ednio alvo (victim.com).<\/p>\n

\"Ataque<\/a><\/noindex><\/center><\/p>\n

O problema \u00e9 que um atacante pode retornar uma enorme lista de servidores NS n\u00e3o repetidos com nomes de subdom\u00ednio fict\u00edcios inexistentes da v\u00edtima (fake-1.victim.com, fake-2.victim.com,\u2026 fake-1000.victim.com). O resolvedor tentar\u00e1 enviar uma solicita\u00e7\u00e3o ao servidor DNS da v\u00edtima, mas receber\u00e1 uma resposta informando que o dom\u00ednio n\u00e3o foi encontrado, ap\u00f3s o que tentar\u00e1 consultar o pr\u00f3ximo servidor NS na lista e assim por diante, at\u00e9 que consulte todos os registros NS listados pelo atacante. Assim, para uma \u00fanica solicita\u00e7\u00e3o do atacante, o resolvedor enviar\u00e1 um enorme n\u00famero de consultas para determinar os hosts NS. Como os nomes dos servidores NS s\u00e3o gerados aleatoriamente e referem-se a subdom\u00ednios inexistentes, eles n\u00e3o s\u00e3o extra\u00eddos do cache e cada solicita\u00e7\u00e3o do atacante resulta em uma enxurrada de consultas ao servidor DNS que atende o dom\u00ednio da v\u00edtima.<\/p>\n

\"Ataque<\/a><\/noindex><\/center><\/p>\n

Os pesquisadores investigaram o grau de vulnerabilidade dos resolvedores DNS p\u00fablicos e determinaram que ao enviar consultas ao resolvedor CloudFlare (1.1.1.1) \u00e9 poss\u00edvel obter um aumento no n\u00famero de pacotes (PAF, Fator de Amplifica\u00e7\u00e3o de Pacotes) de 48 vezes, Google (8.8.8.8) \u2014 30 vezes, FreeDNS (37.235.1.174) \u2014 50 vezes, OpenDNS (208.67.222.222) \u2014 32 vezes. Indicadores mais not\u00e1veis s\u00e3o observados para
\nLevel3 (209.244.0.3) \u2014 273 vezes, Quad9 (9.9.9.9) \u2014 415 vezes
\nSafeDNS (195.46.39.39) \u2014 274 vezes, Verisign (64.6.64.6) \u2014 202 vezes,
\nUltra (156.154.71.1) \u2014 405 vezes, Comodo Secure (8.26.56.26) \u2014 435 vezes, DNS.Watch (84.200.69.80) \u2014 486 vezes, e Norton ConnectSafe (199.85.126.10) \u2014 569 vezes. Para servidores baseados em BIND 9.12.3, devido \u00e0 paraleliza\u00e7\u00e3o de consultas, o n\u00edvel de amplifica\u00e7\u00e3o pode chegar a 1000. No Knot Resolver 5.1.0, o n\u00edvel de amplifica\u00e7\u00e3o \u00e9 de aproximadamente v\u00e1rias dezenas de vezes (24-48), j\u00e1 que a determina\u00e7\u00e3o dos nomes NS \u00e9 realizada sequencialmente e esbarra em uma limita\u00e7\u00e3o interna do n\u00famero de etapas de resolu\u00e7\u00e3o de nomes permitidas para uma \u00fanica consulta.<\/p>\n

Duas estrat\u00e9gias principais de prote\u00e7\u00e3o s\u00e3o destacadas. Para sistemas com DNSSEC proposto<\/a><\/noindex> utilizados RFC-8198<\/a><\/noindex> para evitar a contornada do cache DNS, j\u00e1 que as solicita\u00e7\u00f5es s\u00e3o enviadas com nomes aleat\u00f3rios. A ess\u00eancia do m\u00e9todo \u00e9 gerar respostas negativas sem recorrer a servidores DNS autoritativos, utilizando verifica\u00e7\u00e3o de intervalos atrav\u00e9s do DNSSEC. Um m\u00e9todo mais simples \u00e9 limitar o n\u00famero de nomes que podem ser determinados durante o processamento de uma \u00fanica solicita\u00e7\u00e3o delegada, mas esse m\u00e9todo pode levar a problemas com algumas configura\u00e7\u00f5es existentes, pois os limites n\u00e3o s\u00e3o definidos no protocolo.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c) \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 NXNSAttack (PDF), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043b\u044e\u0431\u044b\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0441\u0442\u0435\u043f\u0435\u043d\u044c \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0434\u043e 1621 \u0440\u0430\u0437 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (\u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043a \u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u0443 \u0437\u0430\u043f\u0440\u043e\u0441, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b 1621 \u0437\u0430\u043f\u0440\u043e\u0441) \u0438 \u0434\u043e 163 \u0440\u0430\u0437 \u043f\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82460","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ataque NXNSAttack, afetando todos os resolvedores DNS | ProHoster","description":"Um grupo de pesquisadores da Universidade de Tel Aviv e do Centro Interdisciplinar de Herzliya (Israel)","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 NXNSAttack, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c)","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-21T17:42:00+00:00","article:modified_time":"2020-05-21T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82460","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:37:29","updated":"2022-09-29 14:28:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/82460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=82460"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/82460\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/82461"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=82460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=82460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=82460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}