{"id":82460,"date":"2020-05-21T19:42:00","date_gmt":"2020-05-21T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery"},"modified":"2020-05-21T19:42:00","modified_gmt":"2020-05-21T17:42:00","slug":"ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","title":{"rendered":"Atacul NXNSAttack, afect\u00e2nd toate rezolvatoarele DNS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Universitatea din Tel Aviv \u0219i Centrul Interdisciplinar din Herzliya (Israel) a dezvoltat<\/a><\/noindex> a dezvoltat o nou\u0103 metod\u0103 de atac NXNSAttack<\/a><\/noindex> (PDF<\/a><\/noindex>), care permite utilizarea oric\u0103ror rezolvatoare DNS ca amplificatoare de trafic, oferind o amplificare de p\u00e2n\u0103 la 1621 de ori \u00een num\u0103rul de pachete (pentru fiecare cerere trimis\u0103 la rezolvator, se pot ob\u021bine 1621 de cereri trimise c\u0103tre serverul victimei) \u0219i p\u00e2n\u0103 la 163 de ori \u00een trafic. <\/p>\n

Problema este legat\u0103 de modul de func\u021bionare al protocolului \u0219i afecteaz\u0103 toate serverele DNS care suport\u0103 procesarea recursiv\u0103 a cererilor, inclusiv BIND<\/a><\/noindex> (CVE-2020-8616), Knot<\/a><\/noindex> (CVE-2020-12667), PowerDNS<\/a><\/noindex> (CVE-2020-10995), Server DNS Windows<\/a><\/noindex> \u0219i Unbound<\/a><\/noindex> (CVE-2020-12662), precum \u0219i serviciile DNS publice Google, Cloudflare, Amazon, Quad9, ICANN \u0219i alte companii. Corectarea problemei a fost coordonat\u0103 cu dezvoltatorii serverelor DNS, care au lansat simultan actualiz\u0103ri pentru a remedia vulnerabilitatea din produsele lor. Protec\u021bia \u00eempotriva atacului a fost implementat\u0103 \u00een versiunile
\nUnbound 1.10.1<\/a><\/noindex>, Knot Resolver 5.1.1<\/a><\/noindex>, PowerDNS Recursor 4.3.1, 4.2.2, 4.1.16<\/a><\/noindex>, BIND 9.11.19, 9.14.12, 9.16.3<\/a><\/noindex>.<\/p>\n

Atacul se bazeaz\u0103 pe utilizarea de c\u0103tre atacator a cererilor care fac referire la un num\u0103r mare de \u00eenregistr\u0103ri NS fictive, care sunt delegate pentru rezolvarea numelui, dar f\u0103r\u0103 a specifica \u00een r\u0103spuns \u00eenregistr\u0103rile glue cu informa\u021bii despre adresele IP ale serverelor NS. De exemplu, atacatorul trimite o cerere pentru rezolvarea numelui sd1.attacker.com, control\u00e2nd serverul DNS responsabil pentru domeniul attacker.com. Ca r\u0103spuns la solicitarea rezolvatorului c\u0103tre serverul DNS al atacatorului, se furnizeaz\u0103 un r\u0103spuns care delege rezolvarea adresei sd1.attacker.com unui server DNS al victimei prin specificarea \u00een r\u0103spuns a \u00eenregistr\u0103rilor NS f\u0103r\u0103 detalii despre IP-urile serverelor NS. Deoarece serverul NS men\u021bionat nu a fost \u00eent\u00e2lnit anterior \u0219i adresa sa IP nu este specificat\u0103, rezolvatorul \u00eencearc\u0103 s\u0103 determine adresa IP a serverului NS, trimi\u021b\u00e2nd o cerere c\u0103tre serverul DNS al victimei, care gestioneaz\u0103 domeniul \u021bint\u0103 (victim.com).<\/p>\n

\"Atacul<\/a><\/noindex><\/center><\/p>\n

Problema este c\u0103 atacatorul poate r\u0103spunde cu o list\u0103 enorm\u0103 de servere NS unice, cu nume fictive de subdomenii inexistente ale victimei (fake-1.victim.com, fake-2.victim.com,\u2026 fake-1000.victim.com). Resolverul va \u00eencerca s\u0103 trimit\u0103 o cerere serverului DNS al victimei, dar va primi un r\u0103spuns c\u0103 domeniul nu a fost g\u0103sit, dup\u0103 care va \u00eencerca s\u0103 determine urm\u0103torul server NS din list\u0103 \u0219i a\u0219a mai departe, p\u00e2n\u0103 c\u00e2nd va \u00eencerca toate \u00eenregistr\u0103rile NS enumerate de atacator. A\u0219adar, pentru o cerere a atacatorului, resolverul va trimite un num\u0103r uria\u0219 de cereri pentru a determina gazdele NS. Deoarece numele serverelor NS sunt generate aleatoriu \u0219i se refer\u0103 la subdomenii inexistente, acestea nu sunt extrase din cache, iar fiecare cerere a atacatorului duce la un val de cereri c\u0103tre serverul DNS care deserve\u0219te domeniul victimei.<\/p>\n

\"Atacul<\/a><\/noindex><\/center><\/p>\n

Cercet\u0103torii au studiat gradul de vulnerabilitate al rezolutorelor DNS publice \u0219i au stabilit c\u0103, la trimiterea cererilor c\u0103tre resolverul CloudFlare (1.1.1.1), se poate ob\u021bine o amplificare a num\u0103rului de pachete (PAF, Packet Amplification Factor) de 48 de ori, Google (8.8.8.8) \u2014 30 de ori, FreeDNS (37.235.1.174) \u2014 50 de ori, OpenDNS (208.67.222.222) \u2014 32 de ori. Indicatorii mai semnificativi sunt observa\u021bi pentru
\nLevel3 (209.244.0.3) \u2014 273 de ori, Quad9 (9.9.9.9) \u2014 415 ori
\nSafeDNS (195.46.39.39) \u2014 274 de ori, Verisign (64.6.64.6) \u2014 202 ori,
\nUltra (156.154.71.1) \u2014 405 ori, Comodo Secure (8.26.56.26) \u2014 435 ori, DNS.Watch (84.200.69.80) \u2014 486 ori, \u0219i Norton ConnectSafe (199.85.126.10) \u2014 569 ori. Pentru serverele bazate pe BIND 9.12.3, prin paralelizarea cererilor, nivelul de amplificare poate ajunge la 1000. \u00cen Knot Resolver 5.1.0, nivelul de amplificare este de aproximativ c\u00e2teva zeci de ori (24-48), deoarece determinarea numelui NS se face secven\u021bial \u0219i este limitat\u0103 de o restric\u021bie intern\u0103 cu privire la num\u0103rul de pa\u0219i de rezolvare a numelui, permisi pentru o cerere.<\/p>\n

Se disting dou\u0103 strategii principale de ap\u0103rare. Pentru sistemele cu DNSSEC o solu\u021bie pentru problema prin extragerea certificatului din<\/a><\/noindex> folosi RFC-8198<\/a><\/noindex> pentru a preveni ocolirea cache-ului DNS, deoarece solicit\u0103rile sunt trimise cu nume aleatorii. Esen\u021ba metodei const\u0103 \u00een generarea r\u0103spunsurilor negative f\u0103r\u0103 a apela la servere DNS autoritative, utiliz\u00e2nd verificarea pe intervale prin DNSSEC. O metod\u0103 mai simpl\u0103 este de a limita num\u0103rul de nume care pot fi determinate prin procesarea unei singure solicit\u0103ri delega\u021bionate, dar aceast\u0103 metod\u0103 poate cauza probleme cu unele configura\u021bii existente, deoarece limitele nu sunt definite \u00een protocol.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c) \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 NXNSAttack (PDF), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043b\u044e\u0431\u044b\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0441\u0442\u0435\u043f\u0435\u043d\u044c \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0434\u043e 1621 \u0440\u0430\u0437 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (\u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043a \u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u0443 \u0437\u0430\u043f\u0440\u043e\u0441, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b 1621 \u0437\u0430\u043f\u0440\u043e\u0441) \u0438 \u0434\u043e 163 \u0440\u0430\u0437 \u043f\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82460","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atacul NXNSAttack, care afecteaz\u0103 toate rezolvatoarele DNS | ProHoster","description":"Un grup de cercet\u0103tori de la Universitatea din Tel Aviv \u0219i Centrul Interdisciplinar din Herzliya (Israel)","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 NXNSAttack, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c)","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-21T17:42:00+00:00","article:modified_time":"2020-05-21T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82460","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:37:29","updated":"2022-09-29 14:28:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=82460"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82460\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/82461"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=82460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=82460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=82460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}