{"id":102321,"date":"2021-11-18T21:36:40","date_gmt":"2021-11-18T19:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere"},"modified":"2021-11-18T21:36:40","modified_gmt":"2021-11-18T19:36:41","slug":"predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","title":{"rendered":"A fost propus\u0103 o metod\u0103 de atac pentru determinarea de la distan\u021b\u0103 a fragmentelor de memorie pe server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Universitatea Tehnic\u0103 din Graz (Austria), cunoscut anterior pentru dezvoltarea atacurilor MDS, NetSpectre, Throwhammer \u0219i ZombieLoad, a publicat o nou\u0103 metod\u0103 de atac (CVE-2021-3714) prin canale secundare asupra mecanismului de deduplicare a paginilor de memorie (Memory-Deduplication), care permite identificarea prezen\u021bei anumitor date \u00een memorie, organizarea unei scurgeri de con\u021binut pe byte sau determinarea aranjamentului memoriei pentru a ocoli protec\u021bia bazat\u0103 pe randomizarea adreselor (ASLR). Noua metod\u0103 se diferen\u021biaz\u0103 de variantele anterioare de atac asupra mecanismului de deduplicare prin faptul c\u0103 atacul se desf\u0103\u0219oar\u0103 de pe un gazd\u0103 extern\u0103, utiliz\u00e2nd ca criteriu varia\u021bia timpului de r\u0103spuns la cererile trimise de atacator prin protocoalele HTTP\/1 \u0219i HTTP\/2. Capacitatea de a realiza atacul a fost demonstrat\u0103 pentru servere bazate pe Linux \u0219i Windows. <\/p>\n

Atacurile asupra mecanismului de deduplicare a memoriei folosesc ca canal pentru scurgerea de informa\u021bii diferen\u021ba de timp \u00een procesarea opera\u021biunii de scriere, \u00een situa\u021biile \u00een care modificarea datelor duce la clonarea paginii de memorie deduplicat\u0103 prin mecanismul Copy-On-Write (COW). \u00cen procesul de lucru, kernel-ul identific\u0103 paginile de memorie identice din procese diferite \u0219i le combin\u0103, afi\u0219\u00e2nd paginile de memorie identice \u00eentr-o singur\u0103 zon\u0103 de memorie fizic\u0103 pentru a stoca doar o singur\u0103 copie. Atunci c\u00e2nd unul dintre procese \u00eencearc\u0103 s\u0103 schimbe datele asociate paginilor deduplicante, apare o excep\u021bie (page fault) \u0219i se creeaz\u0103 automat o copie separat\u0103 a paginii de memorie, care este alocat\u0103 procesului, prin mecanismul Copy-On-Write. Timpul suplimentar necesar pentru realizarea copiei poate fi un indiciu al modific\u0103rii datelor intersectante cu alt proces. <\/p>\n

Cercet\u0103torii au ar\u0103tat c\u0103 \u00eent\u00e2rzierile generate de func\u021bionarea mecanismului COW pot fi detectate nu doar local, ci \u0219i prin analiza varia\u021biei timpului de livrare a r\u0103spunsurilor prin re\u021bea. Au fost propuse mai multe metode de determinare a con\u021binutului memoriei de la un gazd\u0103 \u00eendep\u0103rtat\u0103 prin analiza timpului de execu\u021bie a cererilor prin protocoalele HTTP\/1 \u0219i HTTP\/2. Pentru a men\u021bine tiparele selectate, sunt utilizate aplica\u021bii web standard care p\u0103streaz\u0103 informa\u021biile primite \u00een cereri \u00een memorie. <\/p>\n

Principiul general al atacului const\u0103 \u00een umplerea server<\/a> pagina de memorie cu date ce pot repeta con\u021binutul deja existent pe server. Apoi, atacatorul a\u0219teapt\u0103 timpul necesar pentru ca nucleul s\u0103 efectueze deduplicarea \u0219i combinarea paginii de memorie, dup\u0103 care face modific\u0103ri \u00een copia controlat\u0103 a datelor \u0219i evalueaz\u0103 timpul de reac\u021bie pentru a determina succesul atacului.

\"A<\/center> <\/p>\n

\u00cen cadrul experimentelor efectuate, viteza maxim\u0103 de scurgere a informa\u021biilor a fost de 34.41 bi\u021bi pe or\u0103 \u00een timpul unui atac prin re\u021beaua global\u0103 \u0219i 302.16 bi\u021bi pe or\u0103 \u00een cadrul unui atac prin re\u021beaua local\u0103, ceea ce este mai rapid dec\u00e2t alte metode de extragere a datelor prin canale externe (de exemplu, la atacul NetSpectre, viteza de transfer este de 7.5 bi\u021bi pe or\u0103). <\/p>\n

Au fost propuse trei variante func\u021bionale ale atacului. Prima variant\u0103 permite identificarea datelor din memorie servere web<\/a>, utiliz\u00e2nd Memcached. Atacul const\u0103 \u00een \u00eenc\u0103rcarea unor seturi specifice de date \u00een stocarea Memcached, cur\u0103\u021barea blocului deduplicat, rescrierea aceluia\u0219i element \u0219i crearea unei condi\u021bii pentru apari\u021bia copierei COW prin modificarea con\u021binutului blocului. \u00cen cadrul experimentului cu Memcached, s-a reu\u0219it, \u00een 166.51 secunde, s\u0103 se determine versiunea libc instalat\u0103 \u00een sistemul care ruleaz\u0103 \u00eentr-o ma\u0219in\u0103 virtual\u0103. <\/p>\n

Cea de-a doua variant\u0103 a permis s\u0103 se afle con\u021binutul \u00eenregistr\u0103rilor din SGBD MariaDB, folosind stocarea InnoDB, prin recrearea con\u021binutului byte cu byte. Atacul se realizeaz\u0103 prin trimiterea unor cereri special alterate, care conduc la neconformit\u0103\u021bi de un byte \u00een paginile de memorie \u0219i analiza timpului de reac\u021bie pentru a determina dac\u0103 presupunerea privind con\u021binutul byte-ului a fost corect\u0103. Viteza unei astfel de scurgeri este mic\u0103, de 1.5 bi\u021bi pe or\u0103 \u00een timpul atacurilor din re\u021beaua local\u0103. Un avantaj al metodei este c\u0103 poate fi utilizat\u0103 pentru recuperarea con\u021binutului necunoscut al memoriei. <\/p>\n

A treia variant\u0103 a permis, \u00een 4 minute, ocolirea complet\u0103 a mecanismului de protec\u021bie KASLR \u0219i ob\u021binerea de informa\u021bii despre offset-ul din memoria imaginii nucleului ma\u0219inii virtuale, \u00een situa\u021bia \u00een care adresa offset-ului se afl\u0103 \u00eentr-o pagin\u0103 de memorie, iar alte date din aceasta nu sunt modificate. Atacul a fost efectuat de pe un host aflat la 14 salturi (hops) de sistemul atacat. Exemple de cod pentru realizarea atacurilor prezentate sunt promise a fi publicate pe GitHub.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u043d\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0434\u0435\u0434\u0443\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 (Memory-Deduplication), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0431\u0430\u0439\u0442\u043e\u0432\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u043a\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 (ASLR). \u041e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102322,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 A fost propus\u0103 o metod\u0103 de atac pentru determinarea de la distan\u021b\u0103 a fragmentelor de memorie pe server | ProHoster","description":"Un grup de cercet\u0103tori de la Universitatea Tehnic\u0103 din Graz (Austria), cunoscut anterior pentru dezvoltarea atacurilor MDS, NetSpectre, Throwhammer \u0219i ZombieLoad, a publicat o nou\u0103 metod\u0103 de atac (CVE-2021-3714) prin canale externe.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-18T19:36:41+00:00","article:modified_time":"2021-11-18T19:36:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102321","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-18 19:37:43","updated":"2026-02-09 21:39:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=102321"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102321\/revisions"}],"predecessor-version":[{"id":159967,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102321\/revisions\/159967"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/102322"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=102321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=102321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=102321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}