Un grup de cercet\u0103tori de la Universitatea din California, Riverside, a publicat o nou\u0103 variant\u0103 a atacului SAD DNS (CVE-2021-20322), care func\u021bioneaz\u0103 \u00een ciuda protec\u021biei ad\u0103ugate anul trecut pentru a bloca vulnerabilitatea CVE-2020-25705. Noua metod\u0103 este \u00een general similar\u0103 cu vulnerabilitatea de anul trecut \u0219i se deosebe\u0219te doar prin utilizarea unui alt tip de pachete ICMP pentru a verifica porturile UDP active. Atacul propus permite substituirea datelor falsificate \u00een memoria cache a serverului DNS, ceea ce poate fi folosit pentru a schimba \u00een cache adresa IP a unui domeniu arbitrar \u0219i a redirec\u021biona cererile c\u0103tre domeniu pe serverul atacatorului. <\/p>\n
Metoda propus\u0103 func\u021bioneaz\u0103 doar \u00een stiva de re\u021bea Linux din cauza leg\u0103turii cu particularitatea de lucru a mecanismului de procesare a pachetelor ICMP \u00een Linux, care reprezint\u0103 sursa de scurgeri de date, care faciliteaz\u0103 determinarea num\u0103rului portului UDP utilizat. serverul<\/a> pentru a trimite cererea extern\u0103. Modific\u0103rile care blocheaz\u0103 scurgerea de informa\u021bii au fost acceptate \u00een nucleul Linux la sf\u00e2r\u0219itul lunii august (corec\u021bia a fost inclus\u0103 \u00een nucleul 5.15 \u0219i \u00een actualiz\u0103rile din septembrie ale ramurilor LTS ale nucleului). Corec\u021bia const\u0103 \u00een trecerea la utilizarea algoritmului de hashenare SipHash \u00een locul Jenkins Hash \u00een cache-urile de re\u021bea. Statutul remedierii vulnerabilit\u0103\u021bii \u00een distribu\u021bii poate fi evaluat pe aceste pagini: Debian, RHEL, Fedora, SUSE, Ubuntu. <\/p>\n Conform datelor cercet\u0103torilor care au descoperit problema, vulnerabilitatea afecteaz\u0103 aproximativ 38% din rezolvatoarele deschise aflate \u00een re\u021bea, incluz\u00e2nd servicii DNS populare, cum ar fi OpenDNS \u0219i Quad9 (9.9.9.9). \u00cen ceea ce prive\u0219te software-ul serverului, atacul poate fi realizat pe un server Linux utiliz\u00e2nd pachete precum BIND, Unbound \u0219i dnsmasq. La serverele DNS care ruleaz\u0103 pe sisteme Windows \u0219i BSD, problema nu se manifest\u0103. Pentru a efectua cu succes atacul, este necesar s\u0103 se utilizeze spoofing IP, adic\u0103 este necesar ca providerul atacatorului s\u0103 nu blocheze pachetele cu o adres\u0103 IP de origine falsificat\u0103. <\/p>\n Amintim c\u0103 atacul SAD DNS permite ocolirea protec\u021biei ad\u0103ugate la serverele DNS pentru a bloca metoda clasic\u0103 de otr\u0103vire a cache-ului DNS, propus\u0103 \u00een 2008 de Dan Kaminsky. Metoda Kaminsky manipuleaz\u0103 dimensiunea nesemnificativ\u0103 a c\u00e2mpului cu identificatorul cererii DNS, care este de doar 16 bi\u021bi. Pentru a g\u0103si identificatorul corect al tranzac\u021biei DNS, necesar pentru spoofing-ul numelui gazdelor, este suficient s\u0103 se trimit\u0103 aproximativ 7000 de cereri \u0219i s\u0103 se simuleze \u00een jur de 140 de mii de r\u0103spunsuri fictive. Atacul const\u0103 \u00een trimiterea c\u0103tre rezolvatorul DNS a unui num\u0103r mare de pachete cu o leg\u0103tur\u0103 fictiv\u0103 la IP \u0219i cu diferite identificatoare ale tranzac\u021biei DNS. Pentru a preveni cache-irea primului r\u0103spuns, fiecare r\u0103spuns fictiv indic\u0103 un nume de domeniu u\u0219or modificat (1.example.com, 2.example.com, 3.example.com etc.). <\/p>\n Pentru a proteja \u00eempotriva acestui tip de atac, produc\u0103torii de servere DNS au implementat distribu\u021bia aleatorie a numerelor porturilor de re\u021bea de origine, de unde se trimit cererile de rezolvare, ceea ce a compensat dimensiunea insuficient de mare a identificatorului. Dup\u0103 implementarea protec\u021biei, pentru a trimite un r\u0103spuns fictiv, pe l\u00e2ng\u0103 g\u0103sirea identificatorului de 16 bi\u021bi, a devenit necesar s\u0103 fie g\u0103sit \u0219i unul dintre cele 64 de mii de porturi, ceea ce a crescut num\u0103rul de variante posibile la 2^32. <\/p>\n Metoda SAD DNS simplific\u0103 semnificativ identificarea num\u0103rului de porturi de re\u021bea \u0219i reduce atacul la metoda clasic\u0103 Kaminsky. Atacatorul poate identifica accesul la porturile UDP neutilizate \u0219i active, folosindu-se de scurgerea de informa\u021bii despre activitatea porturilor de re\u021bea \u00een timpul proces\u0103rii pachetelor ICMP de r\u0103spuns. Metoda permite o reducere cu 4 ordine a num\u0103rului de variante de \u00eencercare \u2014 2^16+2^16 \u00een loc de 2^32 (131_072 \u00een loc de 4_294_967_296). Scurgerea de informa\u021bii care permit identificarea rapid\u0103 a porturilor UDP active este cauzat\u0103 de o deficien\u021b\u0103 \u00een codul de procesare a pachetelor ICMP cu cereri de fragmentare (flamul ICMP Fragmentation Needed) sau redirec\u021bionare (flamul ICMP Redirect). \u00centre\u021binerea acestor pachete modific\u0103 starea cache-ului \u00een stiva de re\u021bea, ceea ce permite, pe baza reac\u021biei serverului, s\u0103 se determine care dintre porturile UDP este activ \u0219i care nu. <\/p>\n Scenariul atacului: Atunci c\u00e2nd un rezolvator DNS \u00eencearc\u0103 s\u0103 determine un nume de domeniu, acesta trimite o solicitare UDP c\u0103tre serverul DNS care deserve\u0219te domeniul. \u00cen momentul \u00een care rezolvatorul a\u0219teapt\u0103 un r\u0103spuns, atacatorul poate determina rapid num\u0103rul portului de origine folosit pentru a trimite solicitarea \u0219i pentru a trimite un r\u0103spuns fals, pretinz\u00e2nd c\u0103 este serverul DNS care deserve\u0219te domeniul, folosind spoofing. adrese IP<\/a>Rezolvatorul DNS va stoca \u00een cache datele transmise \u00een r\u0103spunsul fals \u0219i pentru o perioad\u0103, pentru toate celelalte solicit\u0103ri DNS ale numelui de domeniu, va returna adresa IP falsificat\u0103 de atacator. \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-25705. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0432 \u0446\u0435\u043b\u043e\u043c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0442\u0438\u043f\u0430 ICMP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 UDP-\u043f\u043e\u0440\u0442\u043e\u0432. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102308","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Noua variant\u0103 a atacului SAD DNS pentru inserarea de date false \u00een cache-ul DNS | ProHoster","description":"Un grup de cercet\u0103tori de la Universitatea din California, Riverside, a publicat o nou\u0103 variant\u0103 a atacului SAD DNS (CVE-2021-20322), care func\u021bioneaz\u0103 \u00een ciuda protec\u021biei ad\u0103ugate anul trecut pentru a bloca aceast\u0103 vulnerabilitate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-17T19:36:54+00:00","article:modified_time":"2021-11-17T19:36:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102308","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-17 19:38:17","updated":"2026-02-09 21:46:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=102308"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102308\/revisions"}],"predecessor-version":[{"id":160307,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102308\/revisions\/160307"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=102308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=102308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=102308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"