{"id":82929,"date":"2020-05-26T19:42:01","date_gmt":"2020-05-26T17:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range"},"modified":"2020-05-26T19:42:01","modified_gmt":"2020-05-26T17:42:01","slug":"rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","title":{"rendered":"RangeAmp \u2014 o serie de atacuri asupra CDN, care manipuleaz\u0103 antetul HTTP Range","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Universitatea din Beijing, Universitatea Tsinghua \u0219i Universitatea din Texas din Dallas a eviden\u021biat<\/a><\/noindex> o nou\u0103 clas\u0103 de atacuri DoS - RangeAmp, bazat\u0103 pe utilizarea antetelor HTTP Range<\/a><\/noindex> pentru organizarea amplific\u0103rii traficului prin re\u021belele de livrare de con\u021binut (CDN). Esen\u021ba metodei este c\u0103, datorit\u0103 modului de procesare a antetelor Range \u00een multe CDN-uri, atacatorul poate solicita prin CDN un singur byte dintr-un fi\u0219ier mare, dar CDN-ul va desc\u0103rca de la serverul \u021bint\u0103 \u00eentregul fi\u0219ier sau un bloc de date semnificativ mai mare pentru a-l pune \u00een cache. Gradul de amplificare a traficului \u00een cadrul unui astfel de atac, \u00een func\u021bie de CDN, variaz\u0103 de la 724 la 43330 de ori, ceea ce poate fi folosit pentru a cople\u0219i traficul de intrare al CDN-ului sau pentru a reduce l\u0103\u021bimea de band\u0103 a canalului de comunica\u021bie final c\u0103tre site-ul victimei.<\/p>\n

\"RangeAmp<\/center><\/p>\n

Antetul Range permite clientului s\u0103 specifice intervalele de pozi\u021bii dintr-un fi\u0219ier care trebuie s\u0103 fie desc\u0103rcate \u00een loc s\u0103 fie livrat \u00eentregul fi\u0219ier. De exemplu, clientul poate specifica \u201eRange: bytes=0-1023\u201d \u0219i serverul va trimite doar primii 1024 de octe\u021bi de date. Aceast\u0103 func\u021bionalitate este cerut\u0103 la desc\u0103rcarea fi\u0219ierelor mari - utilizatorul poate suspenda desc\u0103rcarea \u0219i apoi o poate relua de la pozi\u021bia \u00eentrerupt\u0103. Prin specificarea \u201ebytes=0-0\u201d, standardul prevede livrarea primului octet din fi\u0219ier, \u201ebytes=-1\u201d - ultimul, \u201ebytes=1-\u201d - \u00eencep\u00e2nd cu 1 octet \u0219i p\u00e2n\u0103 la sf\u00e2r\u0219itul fi\u0219ierului. Este permis\u0103 transmiterea mai multor intervale \u00eentr-un singur antet, de exemplu \u201eRange: bytes=0-1023,8192-10240\u201d.<\/p>\n

De asemenea, a fost propus\u0103 o a doua variant\u0103 de atac, menit\u0103 s\u0103 creasc\u0103 \u00eenc\u0103rc\u0103tura de re\u021bea prin redirec\u021bionarea traficului printr-un alt CDN care este folosit ca proxy (de exemplu, atunci c\u00e2nd Cloudflare ac\u021bioneaz\u0103 ca frontend (FCDN), iar Akamai ca backend (BCDN)). Metoda este similar\u0103 primei atacuri, dar se localizeaz\u0103 \u00een cadrul re\u021belelor CDN \u0219i permite amplificarea traficului prin solicit\u0103ri din alte CDN-uri, cresc\u00e2nd astfel sarcina pe infrastructur\u0103 \u0219i reduc\u00e2nd calitatea serviciului. <\/p>\n

Ideea este c\u0103 atacatorul trimite c\u0103tre CDN cereri Range pentru mai multe intervale, cum ar fi \u201ebytes=0-,0-,0-\u2026\u201d, \u201ebytes=1-,0-,0-\u2026\u201d sau \u201ebytes=-1024,0-,0-\u2026\u201d. Cererile con\u021bin un num\u0103r mare de intervale \u201e0-\u201d, suger\u00e2nd livrarea fi\u0219ierului de la pozi\u021bia zero p\u00e2n\u0103 la final. Din cauza unei implement\u0103ri necorespunz\u0103toare a analizei intervalelor la solicitarea primului CDN c\u0103tre al doilea, pentru fiecare interval \u201e0-\u201d se trimite \u00eentregul fi\u0219ier (intervalele nu sunt agregate, ci parcurse secven\u021bial), dac\u0103 \u00een cererea ini\u021bial trimis\u0103 de atacator exist\u0103 duplic\u0103ri \u0219i intersec\u021bii ale intervalelor. Gradul de amplificare a traficului \u00een acest tip de atac variaz\u0103 de la 53 la 7432 de ori.<\/p>\n

\"RangeAmp<\/center><\/p>\n

\u00cen cadrul cercet\u0103rii a fost studiat comportamentul a 13 CDN -
\nAkamai, Alibaba Cloud, Azure, CDN77, CDNsun, Cloudflare, CloudFront, Fastly, G-Core Labs, Huawei Cloud, KeyCDN, StackPath \u0219i Tencent Cloud. Toate CDN-urile analizate au fost susceptibile la primul tip de atac asupra serverului final. Cel de-al doilea tip de atac \u00eempotriva CDN a afectat 6 servicii, dintre care patru pot ac\u021biona ca frontend \u00een atac (CDN77, CDNsun, Cloudflare \u0219i StackPath) \u0219i trei ca backend (Akamai, Azure \u0219i StackPath). Cele mai mari amplific\u0103ri au fost observate la Akamai \u0219i StackPath, care permit specificarea \u00een antetul Range a mai mult de 10.000 de intervale. Proprietarii CDN-urilor au fost informa\u021bi despre vulnerabilit\u0103\u021bile acum aproximativ 7 luni, iar p\u00e2n\u0103 la momentul divulg\u0103rii publice, 12 din 13 CDN-uri au remediat problemele identificate sau au exprimat disponibilitatea de a le rezolva (doar serviciul StackPath nu a reac\u021bionat).<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041f\u0435\u043a\u0438\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0426\u0438\u043d\u0445\u0443\u0430 \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0414\u0430\u043b\u043b\u0430\u0441\u0435 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043a\u043b\u0430\u0441\u0441 DoS-\u0430\u0442\u0430\u043a — RangeAmp, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 Range \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 (CDN). \u0421\u0443\u0442\u044c \u043c\u0435\u0442\u043e\u0434\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0438\u0437-\u0437\u0430 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Range-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 CDN \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 CDN \u043e\u0434\u0438\u043d \u0431\u0430\u0439\u0442 \u0438\u0437 \u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430, \u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82930,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82929","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47RangeAmp \u2014 o serie de atacuri asupra CDN-ului, care manipuleaz\u0103 antetul HTTP Range | ProHoster","description":"Un grup de cercet\u0103tori de la Universitatea din Beijing, Universitatea Tsinghua \u0219i Universitatea din Texas din Dallas","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47RangeAmp \u2014 \u0441\u0435\u0440\u0438\u044f \u0430\u0442\u0430\u043a \u043d\u0430 CDN, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0430\u044f HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Range | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041f\u0435\u043a\u0438\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0426\u0438\u043d\u0445\u0443\u0430 \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0414\u0430\u043b\u043b\u0430\u0441\u0435","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/rangeamp-seriya-atak-na-cdn-manipuliruyushhaya-http-zagolovkom-range","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-26T17:42:01+00:00","article:modified_time":"2020-05-26T17:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82929","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:28:37","updated":"2022-10-02 22:54:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=82929"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82929\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/82930"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=82929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=82929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=82929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}