{"id":94705,"date":"2020-09-20T07:42:30","date_gmt":"2020-09-20T05:42:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/organizacziya-effektivnyh-atak-po-vremeni-s-pomoshhyu-http-2-i-wpa3"},"modified":"2020-09-20T07:42:30","modified_gmt":"2020-09-20T05:42:30","slug":"organizacziya-effektivnyh-atak-po-vremeni-s-pomoshhyu-http-2-i-wpa3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/organizacziya-effektivnyh-atak-po-vremeni-s-pomoshhyu-http-2-i-wpa3","title":{"rendered":"Organiza\u00e7\u00e3o de ataques eficientes no tempo com HTTP\/2 e WPA3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Uma nova metodologia de ataque contorna o problema de 'jitter de rede', que pode afetar o sucesso de ataques por canais laterais.<\/p>\n

\"Organiza\u00e7\u00e3o
\n
\nA nova metodologia, desenvolvida por pesquisadores da Universidade de Leuven (B\u00e9lgica) e da Universidade de Nova Iorque em Abu Dhabi, demonstrou que invasores podem explorar caracter\u00edsticas de protocolos de rede para organizar vazamentos de informa\u00e7\u00f5es confidenciais.<\/p>\n

Esta metodologia, chamada de Ataques Temporais Atemporais<\/a><\/noindex>, apresentada este ano na confer\u00eancia Usenix, utiliza as caracter\u00edsticas de processamento de solicita\u00e7\u00f5es simult\u00e2neas pelos protocolos de rede para eliminar um dos problemas de ataques remotos baseados no tempo por canais laterais.
\n<\/a><\/noindex><\/p>\n

Problemas com ataques remotos baseados no tempo<\/h3>\n

\nNa execu\u00e7\u00e3o de ataques baseados no tempo, os invasores medem as diferen\u00e7as no tempo de execu\u00e7\u00e3o de diferentes comandos, tentando contornar a prote\u00e7\u00e3o oferecida pela criptografia e obter dados confidenciais, como chaves de criptografia, correspond\u00eancia privada e o comportamento dos usu\u00e1rios durante a navega\u00e7\u00e3o na web.<\/p>\n

Mas, para a execu\u00e7\u00e3o bem-sucedida de ataques baseados no tempo, o atacante precisa conhecer com precis\u00e3o o tempo que a aplica\u00e7\u00e3o alvo leva para processar a solicita\u00e7\u00e3o.<\/p>\n

Isso se torna um problema ao atacar sistemas remotos, como servidores web, porque a lat\u00eancia da rede (jitter) resulta em varia\u00e7\u00f5es no tempo de resposta, dificultando o c\u00e1lculo do tempo de processamento.<\/p>\n

Durante ataques remotos baseados no tempo, os agressores geralmente enviam cada comando v\u00e1rias vezes e realizam uma an\u00e1lise estat\u00edstica do tempo de resposta para reduzir o impacto do jitter da rede. Mas essa abordagem \u00e9 \u00fatil apenas at\u00e9 certo ponto.<\/p>\n

\"Quanto menor a diferen\u00e7a de tempo, mais solicita\u00e7\u00f5es s\u00e3o necess\u00e1rias, e em determinado momento o c\u00e1lculo se torna imposs\u00edvel\", explica o pesquisador de sistemas de prote\u00e7\u00e3o de dados e autor principal do artigo sobre esse novo tipo de ataque, Tom Van Gootem.<\/p>\n

\"Ataque Temporais Atemporais\"<\/h3>\n

\nA metodologia desenvolvida por Gootem e seus colegas realiza ataques remotos baseados no tempo de uma maneira que elimina o impacto do jitter da rede.<\/p>\n

O princ\u00edpio por tr\u00e1s do ataque temporal atemporal \u00e9 simples: as solicita\u00e7\u00f5es devem chegar ao servidor exatamente ao mesmo tempo, em vez de serem enviadas sequencialmente.<\/p>\n

A simultaneity ensures that all requests are under the same network conditions and that the route between the attacker and the server does not influence their processing. The order of receiving responses will provide the attacker with all the information needed to compare execution times.<\/p>\n

\u201cThe main advantage of timeless timing attacks is that they are much more accurate, so fewer requests are required. This allows the attacker to recognize execution time differences of up to 100 ns,\u201d says Van Goetem.<\/p>\n

The minimum time difference observed by researchers during a traditional timing attack over the Internet was 10 \u00b5s, which is 100 times greater than with simultaneous request attacks.<\/p>\n

How simultaneity is ensured<\/h3>\n

\n\u201cWe ensure simultaneity by placing both requests into a single network packet,\u201d explains Van Goetem. \u201cIn practice, the implementation mainly depends on the network protocol.\u201d<\/p>\n

To send simultaneous requests, researchers utilize the capabilities of different network protocols.<\/p>\n

For example, HTTP\/2, which is quickly becoming the de facto standard for web servers, supports \"request multiplexing\"\u2014a feature that allows a client to send multiple requests in parallel over a single TCP connection.<\/p>\n

\u201cIn the case of HTTP\/2, we simply need to make sure that both requests are placed in one packet (for example, by writing both to the socket simultaneously).\u201d However, this method has its nuances. For instance, in most content delivery networks like Cloudflare, which serves content for a large part of the web, the connection between edge servers and the site is done using the HTTP\/1.1 protocol, which does not support request multiplexing.<\/p>\n

While this reduces the effectiveness of timeless attacks, they still remain more accurate than classic remote timing attacks because they eliminate jitter between the attacker and the edge CDN server.<\/p>\n

In the case of protocols that do not support request multiplexing, attackers can use an intermediary network protocol that encapsulates requests.<\/p>\n

Pesquisadores demonstraram como um ataque atemporal funciona na rede Tor. Nesse caso, o atacante encapsula m\u00faltiplas requisi\u00e7\u00f5es em uma c\u00e9lula Tor \u2014 um pacote criptografado enviado entre os n\u00f3s da rede Tor em pacotes TCP \u00fanicos.<\/p>\n

\u201cComo a cadeia Tor para servi\u00e7os onion segue todo o caminho at\u00e9 o servidor, podemos garantir que as requisi\u00e7\u00f5es chegar\u00e3o ao mesmo tempo\u201d, diz Van Goetem.<\/p>\n

Ataques atemporais na pr\u00e1tica<\/h3>\n

\nEm seu artigo, os pesquisadores estudaram ataques atemporais em tr\u00eas situa\u00e7\u00f5es diferentes.<\/p>\n

Ao ataques diretos por tempo<\/b> o invasor conecta-se diretamente ao servidor e tenta organizar um vazamento de informa\u00e7\u00f5es secretas relacionadas ao aplicativo.<\/p>\n

\u201cComo na cria\u00e7\u00e3o da maioria das aplica\u00e7\u00f5es web n\u00e3o se considera que ataques por tempo podem ser muito pr\u00e1ticos e precisos, acreditamos que muitos sites est\u00e3o vulner\u00e1veis a tais ataques\u201d, diz Van Goetem.<\/p>\n

Ao ataques cross-site por tempo<\/b> o atacante envia requisi\u00e7\u00f5es a outros sites a partir do navegador da v\u00edtima e faz suposi\u00e7\u00f5es sobre o conte\u00fado de informa\u00e7\u00f5es confidenciais, observando a sequ\u00eancia de respostas.<\/p>\n

Os atacantes usaram esse esquema para explorar uma vulnerabilidade no programa de recompensas por bugs HackerOne e extrairam informa\u00e7\u00f5es como palavras-chave usadas em relat\u00f3rios confidenciais sobre vulnerabilidades n\u00e3o corrigidas.<\/p>\n

\u201cEu procurei por casos onde um ataque por tempo foi registrado anteriormente, mas n\u00e3o foi considerado eficaz. O bug no HackerOne j\u00e1 havia sido reportado pelo menos tr\u00eas vezes (IDs dos bugs: 350432<\/a><\/noindex>, 348168<\/a><\/noindex> e 4701<\/a><\/noindex>), mas n\u00e3o foi corrigido porque se considerava que esse ataque era imposs\u00edvel de ser utilizado. Ent\u00e3o, criei um simples projeto de pesquisa interno sobre ataques atemporais por tempo.<\/p>\n

Na \u00e9poca, ainda estava muito n\u00e3o otimizado, pois est\u00e1vamos lidando com os detalhes do ataque, mas, mesmo assim, se mostrou bastante preciso (na minha conex\u00e3o WiFi dom\u00e9stica, consegui resultados muito precisos).<\/p>\n

Os pesquisadores tamb\u00e9m tentaram realizar ataques atemporais ao protocolo WiFi WPA3.<\/b>.<\/p>\n

Um dos co-autores do artigo, Mati Vanhoef, j\u00e1 havia detectado uma potencial fuga de tempo no protocolo de confirma\u00e7\u00e3o de conex\u00e3o WPA3.<\/a><\/noindex>. Mas o tempo era muito curto para ser usado em dispositivos de alto desempenho, ou n\u00e3o podia ser utilizado contra servidores.<\/p>\n

\u00abCom um novo tipo de ataque temporal, mostramos que \u00e9 poss\u00edvel usar o authentication handshake (EAP-pwd) contra servidores, mesmo que estejam rodando hardware potente\u00bb, explica Van Goethem.<\/p>\n

O momento ideal<\/h3>\n

\nEm seu artigo, os pesquisadores apresentaram recomenda\u00e7\u00f5es para proteger servidores contra ataques temporais, como limitar a execu\u00e7\u00e3o em tempo constante e adicionar um atraso aleat\u00f3rio. Para implementar medidas pr\u00e1ticas de prote\u00e7\u00e3o contra ataques diretos de tempo que impactem minimamente a opera\u00e7\u00e3o da rede, mais pesquisas s\u00e3o necess\u00e1rias.<\/p>\n

\u00abAcreditamos que esta \u00e1rea de pesquisa est\u00e1 em um est\u00e1gio muito inicial e requer um estudo mais aprofundado\u00bb, diz Van Goethem.<\/p>\n

Em futuras pesquisas, pode-se explorar outras metodologias que os atacantes poderiam usar para realizar ataques temporais simult\u00e2neos, outros protocolos e camadas de rede intermedi\u00e1rias que poderiam ser alvo de ataques, al\u00e9m de avaliar a vulnerabilidade de websites populares que permitem conduzir tais pesquisas atrav\u00e9s de programas de busca de bugs.<\/p>\n

O nome 'temporal' foi escolhido porque, \u00abnesses ataques, n\u00e3o utilizamos nenhuma informa\u00e7\u00e3o (absoluta) sobre o tempo\u00bb, explica Van Goethem.<\/p>\n

\u00abAl\u00e9m disso, eles podem ser considerados 'temporal' uma vez que ataques (remotos) de tempo j\u00e1 s\u00e3o usados h\u00e1 muito tempo, e, de acordo com nossas pesquisas, a situa\u00e7\u00e3o s\u00f3 tende a piorar\u00bb.<\/p>\n

\r\n \"Por\r\n
<\/div>\r\n <\/div><\/center>
\nO texto completo do relat\u00f3rio com a Usenix est\u00e1 dispon\u00edvel aqui<\/a><\/noindex>.<\/p>\n

<\/p>\n

Em nome da publicidade<\/h4>\n

\nPotentes VDS<\/a><\/noindex> com prote\u00e7\u00e3o contra DDoS e hardware de \u00faltima gera\u00e7\u00e3o. Tudo isso sobre nossos servidores \u00e9picos<\/b>. Configura\u00e7\u00e3o m\u00e1xima - 128 n\u00facleos de CPU, 512 GB de RAM, 4000 GB NVMe.<\/p>\n

\"Organiza\u00e7\u00e3o<\/a><\/noindex>
\n
Fonte: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u043e\u0432\u0430\u044f \u043c\u0435\u0442\u043e\u0434\u0438\u043a\u0430 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u0440\u0435\u043e\u0434\u043e\u043b\u0435\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u00ab\u0434\u0436\u0438\u0442\u0442\u0435\u0440\u0430 \u0441\u0435\u0442\u0438\u00bb, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0432\u043b\u0438\u044f\u0442\u044c \u043d\u0430 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u041d\u043e\u0432\u0430\u044f \u043c\u0435\u0442\u043e\u0434\u0438\u043a\u0430, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u0430\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u041b\u0435\u0432\u0435\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0411\u0435\u043b\u044c\u0433\u0438\u044f) \u0438 \u041d\u044c\u044e-\u0419\u043e\u0440\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0410\u0431\u0443-\u0414\u0430\u0431\u0438, \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0442\u0435\u0447\u0435\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u0442\u0430 \u043c\u0435\u0442\u043e\u0434\u0438\u043a\u0430 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Timeless Timing Attacks, \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Usenix, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94706,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94705","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Organiza\u00e7\u00e3o de ataques temporais eficazes usando HTTP\/2 e WPA3 | ProHoster","description":"Uma nova metodologia de ataque contorna o problema de 'jitter de rede', que pode afetar o sucesso de ataques por canais laterais.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/organizacziya-effektivnyh-atak-po-vremeni-s-pomoshhyu-http-2-i-wpa3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e HTTP\/2 \u0438 WPA3 | ProHoster","og:description":"\u041d\u043e\u0432\u0430\u044f \u043c\u0435\u0442\u043e\u0434\u0438\u043a\u0430 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u0440\u0435\u043e\u0434\u043e\u043b\u0435\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u00ab\u0434\u0436\u0438\u0442\u0442\u0435\u0440\u0430 \u0441\u0435\u0442\u0438\u00bb, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0432\u043b\u0438\u044f\u0442\u044c \u043d\u0430 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c","og:url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/organizacziya-effektivnyh-atak-po-vremeni-s-pomoshhyu-http-2-i-wpa3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-20T05:42:30+00:00","article:modified_time":"2020-09-20T05:42:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94705","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:19:22","updated":"2022-09-27 17:10:32","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/94705","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=94705"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/94705\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/94706"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=94705"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=94705"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=94705"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}