{"id":120072,"date":"2024-10-07T13:09:25","date_gmt":"2024-10-07T11:09:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah"},"modified":"2024-10-07T13:09:25","modified_gmt":"2024-10-07T11:09:25","slug":"uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","title":{"rendered":"O vulnerabilitate \u00een CUPS s-a dovedit util\u0103 pentru amplificarea traficului \u00een atacurile DDoS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Grupul responsabil pentru securitatea re\u021belei de livrare a con\u021binutului Akamai a identificat un nou vector de atac asupra procesului cups-browsed, pe l\u00e2ng\u0103 utilizarea acestuia ca una dintre componentele unui exploit care duce la execu\u021bia de cod \u00een sistem. Prin trimiterea de cereri c\u0103tre procesul cups-browsed, care accept\u0103 conexiuni f\u0103r\u0103 restric\u021bii pe portul 631, se poate realiza trimiterea de date c\u0103tre un alt host, m\u0103rimea acestora put\u00e2nd dep\u0103\u0219i cererea ini\u021bial\u0103 de p\u00e2n\u0103 la 600 de ori. Spre compara\u021bie, coeficientul de amplificare pentru memcached poate atinge \u00eentre 10-50 de mii de ori, NTP \u2014 556 de ori, DNS \u2014 28-54, RIPv2 \u2014 21, SNMPv2 \u2014 6. <\/p>\n

Aceast\u0103 caracteristic\u0103 permite utilizarea sistemelor cu cups-browsed ca amplificatoare de trafic \u00een timpul atacurilor DDoS. Metoda de atac care utilizeaz\u0103 amplificatoare de trafic se bazeaz\u0103 pe faptul c\u0103 cererile din computerele participante la atacurile DDoS sunt direc\u021bionate nu direct c\u0103tre sistemul victimei, ci printr-un amplificator intermediar. \u00cen urma scan\u0103rii re\u021belei, au fost identificate peste 198.000 de sisteme vulnerabile cu CUPS, din care 34% (58.000 de sisteme) s-au dovedit a fi potrivite pentru amplificarea traficului \u00een atacurile DDoS. <\/p>\n

Spre deosebire de metodele de amplificare a traficului care necesit\u0103 trimiterea de pachete UDP cu o adres\u0103 de \u00eentoarcere falsificat\u0103 a victimei, utilizarea cups-browsed permite evitarea spofing-ului. Serviciul cups-browsed are o capacitate nativ\u0103 de a \u00eenc\u0103rca fi\u0219ierul PPD de la un URL extern. server<\/a> \u00een r\u0103spuns la o cerere extern\u0103 neautorizat\u0103, \u00een cadrul c\u0103reia clientul transmite un URL, iar cups-browsed \u00eencearc\u0103 s\u0103 \u00eencarce fi\u0219ierul PPD de pe serverul specificat. <\/p>\n

Atunci c\u00e2nd se trimite o cerere pentru desc\u0103rcarea unui fi\u0219ier PPD \u00een cups-browsed, se poate ob\u021bine ata\u0219area la valoarea \u201eIPP URI\u201d a unui supliment de completare care poate ajunge p\u00e2n\u0103 la 989 de octe\u021bi. \u00cen acest proces ini\u021biat de cups-browsed, valoarea \u201eIPP URI\u201d este duplicat\u0103 \u2014 o dat\u0103 \u00een antetul HTTP \u0219i a doua oar\u0103 \u00een corpul cererii POST, iar cererile sunt repetate ciclic dup\u0103 \u00eencerc\u0103rile e\u0219uate de desc\u0103rcare \u0219i returnare. serverul<\/a> codului de eroare 404. <\/p>\n

Pe 62% (35900) dintre sistemele verificate, cups-browsed a trimis cel pu\u021bin 10 cereri TCP\/IPP\/HTTP c\u0103tre sistemul atacat ca r\u0103spuns la o cerere UDP ini\u021bial\u0103. \u00cen medie, pentru 58000 de sisteme afectate, num\u0103rul de apeluri repetate a fost de 45. \u00cen scenariul optim, trimiterea unei cereri ini\u021biale de 30 de octe\u021bi cu 45 de \u00eencerc\u0103ri repetate de \u00eenc\u0103rcare va duce la trimiterea a 18000 de octe\u021bi de date c\u0103tre sistemul \u021bint\u0103, ceea ce va duce la o amplificare a traficului de 600 de ori. \u00cen cel mai r\u0103u scenariu, amplificarea este de 108 ori. <\/p>\n

De asemenea, se poate men\u021biona c\u0103 compania Cloudflare a reflectat o atac DDoS record, \u00een urma c\u0103ruia a fost direc\u021bionat un flux de 3.8 tera bi\u021bi pe secund\u0103 (2.14 miliarde de pachete pe secund\u0103) c\u0103tre sistemul victimei. Se raporteaz\u0103 c\u0103 atacul a fost organizat folosind un num\u0103r mare de routere domestice compromise de Asus \u0219i Mikrotik, precum \u0219i dispozitive DVR \u0219i servere web, compromise printre altele prin utilizarea unor vulnerabilit\u0103\u021bi relativ recente.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0430\u044f \u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Akamai, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 cups-browsed, \u043f\u043e\u043c\u0438\u043c\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0432\u0435\u043d\u044c\u0435\u0432 \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u043c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0427\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 cups-browsed, \u0431\u0435\u0437 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u044e\u0449\u0435\u043c\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043d\u0430 631 \u043f\u043e\u0440\u0442\u0443, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u0445\u043e\u0441\u0442, \u0440\u0430\u0437\u043c\u0435\u0440 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0435\u0432\u044b\u0448\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120072","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilitatea din CUPS s-a dovedit a fi util\u0103 pentru amplificarea traficului \u00een atacurile DDoS | ProHoster","description":"Grupul responsabil cu securitatea re\u021belei de livrare a con\u021binutului Akamai a identificat un vector suplimentar de atac asupra procesului cups-browsed, pe l\u00e2ng\u0103 utilizarea sa ca unul dintre linkurile din exploit, care duce la.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CUPS \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u0430 \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u0440\u0438 DDoS-\u0430\u0442\u0430\u043a\u0430\u0445 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0430\u044f \u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Akamai, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 cups-browsed, \u043f\u043e\u043c\u0438\u043c\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0432\u0435\u043d\u044c\u0435\u0432 \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u043c \u043a.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-10-07T11:09:25+00:00","article:modified_time":"2024-10-07T11:09:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120072","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:46:25","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 07:07:19","updated":"2026-02-22 15:46:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120072","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=120072"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120072\/revisions"}],"predecessor-version":[{"id":162469,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120072\/revisions\/162469"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=120072"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=120072"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=120072"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}