{"id":114452,"date":"2024-03-20T12:25:49","date_gmt":"2024-03-20T10:25:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami"},"modified":"2024-03-20T12:25:49","modified_gmt":"2024-03-20T10:25:49","slug":"ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","title":{"rendered":"Atacul asupra anumitor protocoale bazate pe UDP, care duce la o bucl\u0103 de schimb de pachete","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Centrul de coordonare CERT (echipa de r\u0103spuns pentru incidente cibernetice) a publicat un avertisment cu privire la o serie de vulnerabilit\u0103\u021bi ale implement\u0103rilor diferitelor protocoale aplica\u021bii care utilizeaz\u0103 protocolul UDP ca transport. Vulnerabilit\u0103\u021bile pot fi folosite pentru a organiza un atac de tip denial of service, din cauza posibilei circulariz\u0103ri a schimbului de pachete \u00eentre dou\u0103 gazde. De exemplu, atacatorii pot epuiza l\u0103\u021bimea de band\u0103 disponibil\u0103 a re\u021belei, bloca func\u021bionarea serviciilor de re\u021bea (de exemplu, prin generarea unei \u00eenc\u0103rc\u0103ri mari \u0219i dep\u0103\u0219irea limitelor ratei de cereri) \u0219i implementa amplificatori de trafic pentru atacurile DDoS. <\/p>\n

Printre protocoalele ai c\u0103ror implement\u0103ri sunt vulnerabile se num\u0103r\u0103 DNS, NTP, TFTP, Echo (RFC862), Chargen (RFC864) \u0219i QOTD (RFC865). Existen\u021ba vulnerabilit\u0103\u021bii (CVE-2024-2169) a fost confirmat\u0103 \u00een produse specifice ale companiilor Cisco, Microsoft, Broadcom, Brother, Honeywell (CVE-2024-1309) \u0219i MikroTik. Ca m\u0103suri compensatorii pentru blocarea vulnerabilit\u0103\u021bilor, se recomand\u0103 activarea bloc\u0103rii spoofing-ului (uRPF) pe firewall, limitarea accesului la serviciile UDP neesen\u021biale \u0219i configurarea rate-limit \u0219i QoS pentru limitarea intensit\u0103\u021bii traficului. <\/p>\n

Vulnerabilit\u0103\u021bile sunt cauzate de lipsa de securitate a protocolului UDP fa\u021b\u0103 de spoofing-ul adreselor \u2014 \u00een absen\u021ba unui sistem de protec\u021bie \u00eempotriva spoofing-ului pe routerele de tranzit, un atacator poate specifica \u00een pachetul UDP o adres\u0103 IP a unui server arbitrar \u0219i poate trimite acest pachet c\u0103tre un alt server, care va returna un r\u0103spuns la adresa fals\u0103 indicat\u0103. Metoda de atac const\u0103 \u00een crearea unei situa\u021bii de schimb de pachete \u00een bucl\u0103 \u00eentre servere care folosesc implement\u0103ri vulnerabile ale protocolului. De exemplu, ca r\u0103spuns la pachetul primit, serverul \u021bint\u0103 poate trimite un r\u0103spuns cu un cod de eroare, iar serverul al c\u0103rui adres\u0103 a fost inserat\u0103 de atacator va returna propriul r\u0103spuns, care, la r\u00e2ndul s\u0103u, va duce din nou la returnarea unui pachet cu codul de eroare. Astfel, servere<\/a> pachetele vor continua s\u0103 joace \u00eentre ele \u00een \u201eping-pong\u201d p\u00e2n\u0103 la infinit.

\"Atacul<\/center> <\/p>\n

Este remarcabil c\u0103 o astfel de metod\u0103 de atac nu este nou\u0103 \u0219i \u00een server<\/a> Sincronizarea timpului ntpd a avut una dintre variantele de atac eliminate \u00eenc\u0103 din 2009 (CVE-2009-3563) \u00een versiunile 4.2.4p8 \u0219i 4.2.5. Atacul consta \u00een trimiterea unui pachet NTP cu o adres\u0103 falsificat\u0103 \u0219i cu flag-ul MODE_PRIVATE setat, iar \u00een urma proces\u0103rii, serverul \u021bint\u0103 returna un r\u0103spuns prin care indica imposibilitatea utiliz\u0103rii modului privat, l\u0103s\u00e2nd flag-ul MODE_PRIVATE setat \u00een r\u0103spuns. Prin urmare, un alt server nu putea s\u0103 proceseze acest flag \u0219i returna propriul r\u0103spuns, ceea ce ducea la bucle de schimb de pachete \u00eentre cele dou\u0103 servere NTP. Pentru protocolul DNS, avertismentul privind posibilitatea unui astfel de atac a fost publicat \u00eenc\u0103 din 1996. <\/p>\n

Scanarea global\u0103 a adreselor de pe internet a ar\u0103tat c\u0103, \u00een prezent, exist\u0103 cel pu\u021bin 23 de mii de servere TFTP vulnerabile, 63 de mii de servere DNS, 89 de mii de servere NTP, 56 de mii de servicii Echo\/RFC862, 22 de mii de servicii Chargen\/RFC864 \u0219i 21 de mii de servicii QOTD\/RFC865. Se presupune c\u0103, \u00een cazul serverelor NTP, prezen\u021ba vulnerabilit\u0103\u021bilor necorectate este legat\u0103 de utilizarea versiunilor foarte vechi de ntpd, lansate \u00eenainte de 2010. Serviciile Echo, Chargen \u0219i QOTD sunt vulnerabile din cauza arhitecturii lor. Situa\u021bia cu serverele TFTP \u0219i DNS necesit\u0103 verific\u0103ri cu administratorii acestora. Serverele atftpd \u0219i tftpd nu sunt afectate de problem\u0103, deoarece utilizeaz\u0103 un num\u0103r aleator de port de re\u021bea surs\u0103 atunci c\u00e2nd trimit r\u0103spunsuri. Din serverele DNS vulnerabile, este men\u021bionat dproxy-nexgen. \u00cen produsele Microsoft, problema apare \u00een WDS (Windows Deployment Services), iar \u00een produsele Cisco problema este prezent\u0103 \u00een routerele din seriile 2800 \u0219i 2970.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b UDP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u0445\u043e\u0441\u0442\u0430\u043c\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u043e\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0442\u0438, \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114453,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114452","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atac asupra unor protocoale bazate pe UDP, duc\u00e2nd la bucle de schimb de pachete | ProHoster","description":"Centrul de coordonare CERT (grupul de r\u0103spuns la urgen\u021be informatice) a publicat un avertisment privind o serie de vulnerabilit\u0103\u021bi \u00een implement\u0103rile diferitelor protocoale aplica\u021bie, care utilizeaz\u0103 ca transport.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 UDP, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044e \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 | ProHoster","og:description":"\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-20T10:25:49+00:00","article:modified_time":"2024-03-20T10:25:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114452","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:37:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=114452"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114452\/revisions"}],"predecessor-version":[{"id":159859,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114452\/revisions\/159859"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/114453"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=114452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=114452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=114452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}