{"id":102308,"date":"2021-11-17T21:36:54","date_gmt":"2021-11-17T19:36:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns"},"modified":"2021-11-17T21:36:54","modified_gmt":"2021-11-17T19:36:54","slug":"novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","title":{"rendered":"Nj\u00eb variant i ri i sulmit SAD DNS p\u00ebr futjen e t\u00eb dh\u00ebnave t\u00eb rreme n\u00eb caches DNS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Grupi i hulumtuesve nga Universiteti i Kalifornis\u00eb n\u00eb Riverside publikoi nj\u00eb variant t\u00eb ri t\u00eb sulmit SAD DNS (CVE-2021-20322), i cili funksionon pavar\u00ebsisht mbrojtjes q\u00eb u shtua vitin e kaluar p\u00ebr t\u00eb bllokuar dob\u00ebsin\u00eb CVE-2020-25705. Metoda e re \u00ebsht\u00eb n\u00eb p\u00ebrgjith\u00ebsi e ngjashme me dob\u00ebsin\u00eb e vitit t\u00eb kaluar dhe ndryshon vet\u00ebm n\u00eb p\u00ebrdorimin e nj\u00eb lloji tjet\u00ebr pakete ICMP p\u00ebr t\u00eb verifikuar portet UDP aktiv\u00eb. Sulmi i propozuar lejon futjen e t\u00eb dh\u00ebnave false n\u00eb cache-n e serverit DNS, gj\u00eb q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb z\u00ebvend\u00ebsuar adres\u00ebn IP t\u00eb nj\u00eb domeni t\u00eb \u00e7far\u00ebdo dhe p\u00ebr t\u00eb redirectionuar k\u00ebrkesat p\u00ebr domenin n\u00eb serverin e sulmuesit. <\/p>\n

Metoda e propozuar funksionon vet\u00ebm n\u00eb stek\u00ebn rrjet\u00ebrore Linux p\u00ebr shkak se \u00ebsht\u00eb e lidhur me nj\u00eb ve\u00e7ori t\u00eb mekanizmit t\u00eb p\u00ebrpunimit t\u00eb paketeve ICMP n\u00eb Linux, i cili vepron si nj\u00eb burim i rrjedhjes s\u00eb t\u00eb dh\u00ebnave q\u00eb leht\u00ebson identifikimin e numrit t\u00eb portit UDP t\u00eb p\u00ebrdorur. server<\/a> p\u00ebr d\u00ebrgimin e k\u00ebrkes\u00ebs s\u00eb jashtme. Ndryshimet q\u00eb bllokojn\u00eb rrjedhjen e informacionit jan\u00eb pranuar n\u00eb b\u00ebrtham\u00ebn Linux n\u00eb fund t\u00eb gushtit (korrigjimi u p\u00ebrfshi n\u00eb b\u00ebrtham\u00ebn 5.15 dhe p\u00ebrdit\u00ebsimet e muajit shtator t\u00eb deg\u00ebve LTS t\u00eb b\u00ebrtham\u00ebs). Korrigjimi p\u00ebrfshin kalimin n\u00eb p\u00ebrdorimin e algoritmit t\u00eb hash-it SipHash n\u00eb vend t\u00eb Jenkins Hash n\u00eb cache-t rrjet\u00ebrore. Statusi i rregullimit t\u00eb dob\u00ebsis\u00eb n\u00eb shp\u00ebrndarjet mund t\u00eb vler\u00ebsohet nga k\u00ebto faqe: Debian, RHEL, Fedora, SUSE, Ubuntu. <\/p>\n

Sipas t\u00eb dh\u00ebnave t\u00eb hulumtuesve q\u00eb rind\u00ebrtuan problemin, rreth 38% e rezolutor\u00ebve t\u00eb hapur n\u00eb rrjet jan\u00eb t\u00eb ekspozuar ndaj dob\u00ebsis\u00eb, p\u00ebrfshir\u00eb sh\u00ebrbime t\u00eb njohura DNS si OpenDNS dhe Quad9 (9.9.9.9). Kur b\u00ebhet fjal\u00eb p\u00ebr softin e serverit, sulmi mund t\u00eb realizohet duke p\u00ebrdorur n\u00eb server \u00eb Linux paketat si BIND, Unbound dhe dnsmasq. N\u00eb serverat DNS t\u00eb drejtuar nga sistemet Windows dhe BSD, problemi nuk shfaqet. P\u00ebr t\u00eb realizuar me sukses sulmin, \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrdoret spoofing IP, dometh\u00ebn\u00eb, provajderi i sulmuesit nuk duhet t\u00eb bllokoj\u00eb paketat me nj\u00eb adres\u00eb IP origjinale t\u00eb falsifikuar. <\/p>\n

Kujtojm\u00eb se sulmi SAD DNS lejon t\u00eb anashkalojm\u00eb mbrojtjen e vendosur n\u00eb server\u00ebt DNS p\u00ebr t\u00eb bllokuar metod\u00ebn klasike t\u00eb helmimit t\u00eb caches DNS, t\u00eb propozuar n\u00eb vitin 2008 nga Dan Kaminsky. Metoda e Kaminsky manipuluar me madh\u00ebsin\u00eb e vog\u00ebl t\u00eb fush\u00ebs s\u00eb identifikimit t\u00eb k\u00ebrkes\u00ebs DNS, e cila \u00ebsht\u00eb vet\u00ebm 16 bit. P\u00ebr t\u00eb gjetur identifikuesin e sakt\u00eb t\u00eb transaksionit DNS, i nevojsh\u00ebm p\u00ebr falsifikimin e emrit t\u00eb hostit, mjafton t\u00eb d\u00ebrgoni rreth 7000 k\u00ebrkesa dhe t\u00eb simuloni rreth 140 mij\u00eb p\u00ebrgjigje t\u00eb rreme. Sulmi p\u00ebrfshin d\u00ebrgimin n\u00eb resolverin DNS t\u00eb nj\u00eb numri t\u00eb madh paketash me lidhje t\u00eb rreme me IP dhe me identifikues t\u00eb ndrysh\u00ebm t\u00eb transaksionit DNS. P\u00ebr t\u00eb parandaluar caching e p\u00ebrgjigjes s\u00eb par\u00eb, n\u00eb \u00e7do p\u00ebrgjigje t\u00eb rreme tregohet nj\u00eb em\u00ebr domene t\u00eb ndryshuar pak (1.example.com, 2.example.com, 3.example.com etj.). <\/p>\n

P\u00ebr t'u mbrojtur nga ky lloj sulmi, prodhuesit e server\u00ebve DNS implementuan shp\u00ebrndarjen rast\u00ebsore t\u00eb numrave t\u00eb porteve rrjet\u00ebs s\u00eb origjin\u00ebs, nga t\u00eb cilat d\u00ebrgohen k\u00ebrkesat p\u00ebr zgjidhje, gj\u00eb q\u00eb kompensoi madh\u00ebsin\u00eb e pamjaftueshme t\u00eb identifikuesit. Pas implementimit t\u00eb mbrojtjes, p\u00ebr t\u00eb d\u00ebrguar nj\u00eb p\u00ebrgjigje t\u00eb rreme, p\u00ebrve\u00e7 gjetjes s\u00eb identifikuesit 16-bit, tani \u00ebsht\u00eb e nevojshme t\u00eb gjejm\u00eb gjithashtu nj\u00eb nga 64 mij\u00eb portet, e cila rrit numrin e mund\u00ebsive p\u00ebr gjetje deri n\u00eb 2^32. <\/p>\n

Metoda SAD DNS lejon p\u00ebr t\u00eb thjeshtuar ndjesh\u00ebm p\u00ebrcaktimin e numrit t\u00eb portit rrjetor dhe p\u00ebr t\u00eb reduktuar sulmin n\u00eb metod\u00ebn klasike t\u00eb Kaminskit. Sulmuesi mund t\u00eb p\u00ebrcaktoj\u00eb aksesin n\u00eb portat UDP q\u00eb nuk p\u00ebrdoren dhe ata aktiv\u00eb, duke shfryt\u00ebzuar rrjedhjen e informacionit mbi aktiviteten e porteve rrjetore gjat\u00eb p\u00ebrpunimit t\u00eb paketave ICMP t\u00eb reagimit. Metoda zvog\u00eblon numrin e mund\u00ebsive t\u00eb provave me 4 rend, 2^16+2^16 n\u00eb vend t\u00eb 2^32 (131_072 n\u00eb vend t\u00eb 4_294_967_296). Rrjedhja e informacionit q\u00eb lejon t\u00eb p\u00ebrcaktohet shpejt portet UDP aktive shkaktohet nga nj\u00eb defekt n\u00eb kodin e p\u00ebrpunimit t\u00eb paketave ICMP me k\u00ebrkesat p\u00ebr fragmentimin (flamuri ICMP Fragmentation Needed) ose ridrejtime (flamuri ICMP Redirect). D\u00ebrgimi i paketeve t\u00eb till\u00eb ndryshon gjendjen e caches n\u00eb shtakun rrjetor, duke lejuar q\u00eb n\u00eb baz\u00eb t\u00eb reagimit t\u00eb serverit t\u00eb p\u00ebrcaktohet cili nga portat UDP \u00ebsht\u00eb aktiv dhe cili jo. <\/p>\n

Skema e sulmit: Kur nj\u00eb DNS resolv\u00ebr p\u00ebrpiqet t\u00eb p\u00ebrcaktoj\u00eb emrin e domainit, ai d\u00ebrgon nj\u00eb k\u00ebrkes\u00eb UDP n\u00eb serverin p\u00ebrkat\u00ebs t\u00eb domainit DNS. N\u00eb momentin q\u00eb resolv\u00ebri pret nj\u00eb p\u00ebrgjigje, sulmuesi mund t\u00eb p\u00ebrcaktoj\u00eb shpejt numrin e port\u00ebs s\u00eb origjin\u00ebs q\u00eb u p\u00ebrdor p\u00ebr d\u00ebrgimin e k\u00ebrkes\u00ebs, dhe t'i d\u00ebrgoj\u00eb atij nj\u00eb p\u00ebrgjigje t\u00eb falsifikuar, duke u paraqitur si serveri p\u00ebrkat\u00ebs i domainit DNS p\u00ebrmes spoofing. Adresa IP<\/a>DNS resolv\u00ebri do t\u00eb vendos\u00eb n\u00eb cache t\u00eb dh\u00ebnat e d\u00ebrguara n\u00eb p\u00ebrgjigjen e falsifikuar dhe p\u00ebr nj\u00eb periudh\u00eb t\u00eb caktuar do t\u00eb kthej\u00eb n\u00eb t\u00eb gjitha k\u00ebrkesat e tjera DNS p\u00ebr emrin e domainit adres\u00ebn IP t\u00eb ngjitur nga sulmuesi.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-25705. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0432 \u0446\u0435\u043b\u043e\u043c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0442\u0438\u043f\u0430 ICMP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 UDP-\u043f\u043e\u0440\u0442\u043e\u0432. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102308","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Variant i ri i sulmit SAD DNS p\u00ebr futjen e t\u00eb dh\u00ebnave t\u00eb rreme n\u00eb cache DNS | ProHoster","description":"Nj\u00eb grup k\u00ebrkuesish nga Universiteti i Kalifornis\u00eb n\u00eb Riverside publikoi nj\u00eb variant t\u00eb ri t\u00eb sulmit SAD DNS (CVE-2021-20322), q\u00eb funksionon pavar\u00ebsisht mbrojtjes t\u00eb shtuar vitin e kaluar p\u00ebr t\u00eb bllokuar k\u00ebt\u00eb dob\u00ebsi.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-17T19:36:54+00:00","article:modified_time":"2021-11-17T19:36:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102308","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-17 19:38:17","updated":"2026-02-09 21:46:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=102308"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102308\/revisions"}],"predecessor-version":[{"id":160307,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102308\/revisions\/160307"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=102308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=102308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=102308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}