{"id":102321,"date":"2021-11-18T21:36:40","date_gmt":"2021-11-18T19:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere"},"modified":"2021-11-18T21:36:40","modified_gmt":"2021-11-18T19:36:41","slug":"predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","title":{"rendered":"Metoda e sulmit p\u00ebr t\u00eb p\u00ebrcaktuar me larg\u00ebsi fragmente t\u00eb memories n\u00eb server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb grup k\u00ebrkuesish nga Universiteti Teknik i Grazit (Austria), i njohur m\u00eb par\u00eb p\u00ebr zhvillimin e sulmeve MDS, NetSpectre, Throwhammer dhe ZombieLoad, publikoi nj\u00eb metod\u00eb t\u00eb re sulmi (CVE-2021-3714) p\u00ebr kanalet an\u00ebsore n\u00eb mekanizmin e dedupikimit t\u00eb faqeve t\u00eb memories (Memory-Deduplication), e cila lejon p\u00ebrcaktimin e pranis\u00eb s\u00eb t\u00eb dh\u00ebnave t\u00eb caktuara n\u00eb memory, organizimin e rrjedhjes s\u00eb p\u00ebrmbajtjes s\u00eb memories n\u00eb m\u00ebnyr\u00eb byte-pas-byte, ose p\u00ebrcaktimin e struktur\u00ebs s\u00eb memories p\u00ebr t\u00eb anashkaluar mbrojtjen e bazuar n\u00eb randomizimin e adresave (ASLR). Metoda e re e sulmit dallohet nga variantet e m\u00ebparshme duke realizuar sulmin nga nj\u00eb host t\u00eb jasht\u00ebm, duke p\u00ebrdorur si kriter ndryshimin e koh\u00ebs s\u00eb p\u00ebrgjigjes p\u00ebr k\u00ebrkesat e d\u00ebrguara nga sulmuesi p\u00ebr protokollet HTTP\/1 dhe HTTP\/2. Mund\u00ebsia e realizimit t\u00eb sulmit \u00ebsht\u00eb demonstruar p\u00ebr server\u00ebt me baz\u00eb Linux dhe Windows. <\/p>\n

Sulmet ndaj mekanizmit t\u00eb dedupikimit t\u00eb memories p\u00ebrdorin ndryshimin n\u00eb koh\u00ebn e p\u00ebrpunimit t\u00eb operacionit t\u00eb shkruar si kanal p\u00ebr rrjedhjen e informacionit, n\u00eb situata kur ndryshimi i t\u00eb dh\u00ebnave p\u00ebrfaq\u00ebson klonimin e faqeve t\u00eb dedupikuara t\u00eb memories p\u00ebrmes mekanizmit Copy-On-Write (COW). Gjat\u00eb pun\u00ebs, b\u00ebrthama p\u00ebrcakton faqet e nj\u00ebjta t\u00eb memories nga procese t\u00eb ndryshme dhe i bashkon ato, duke shfaqur faqet identike t\u00eb memories n\u00eb nj\u00eb zon\u00eb fizike t\u00eb memories p\u00ebr ruajtjen e vet\u00ebm nj\u00eb kopje. Kur nj\u00eb nga proceset p\u00ebrpiqet t\u00eb ndryshoj\u00eb t\u00eb dh\u00ebnat q\u00eb lidhen me faqet e dedupikuara, ndodh nj\u00eb p\u00ebrjashtim (page fault) dhe p\u00ebrmes mekanizmit Copy-On-Write krijohet automatikisht nj\u00eb kopje e ve\u00e7ant\u00eb e faqes s\u00eb memories, e cila i ngjitet procesit. Koha e shtuar p\u00ebr p\u00ebrfundimin e kopjimit mund t\u00eb jet\u00eb nj\u00eb tregues i ndryshimit t\u00eb t\u00eb dh\u00ebnave q\u00eb pranohen nga nj\u00eb proces tjet\u00ebr. <\/p>\n

K\u00ebrkuesit treguan se vonesat q\u00eb ndodhin si rezultat i funksionimit t\u00eb mekanizmit COW mund t\u00eb kapen jo vet\u00ebm lokalisht, por edhe duke analizuar ndryshimin e koh\u00ebs s\u00eb dor\u00ebzimit t\u00eb p\u00ebrgjigjeve n\u00eb rrjet. Jan\u00eb propozuar disa metoda p\u00ebr p\u00ebrcaktimin e p\u00ebrmbajtjes s\u00eb memories nga nj\u00eb host t\u00eb jasht\u00ebm p\u00ebrmes analiz\u00ebs s\u00eb koh\u00ebs s\u00eb p\u00ebrfundimit t\u00eb k\u00ebrkesave p\u00ebr protokollet HTTP\/1 dhe HTTP\/2. P\u00ebr t\u00eb ruajtur modelet q\u00eb po k\u00ebrkohen, p\u00ebrdoren aplikacione web standarde, q\u00eb ruajn\u00eb informacionin e ardhur n\u00eb k\u00ebrkesa n\u00eb memory. <\/p>\n

Parimi i p\u00ebrgjithsh\u00ebm i sulmit \u00ebsht\u00eb t\u00eb mbush\u00eb faqet e memorjes me \u0441\u0435\u0440\u0432\u0435\u0440\u0435<\/a> t\u00eb dh\u00ebna q\u00eb potencialisht p\u00ebrs\u00ebrisin p\u00ebrmbajtjen e nj\u00eb faqe memorjeje q\u00eb tashm\u00eb ekziston n\u00eb server. Pastaj, sulmuesi pret koh\u00ebn e nevojshme p\u00ebr t\u00eb b\u00ebr\u00eb deduplikimin dhe bashkimin e faqes s\u00eb memorjes nga b\u00ebrthama, pas s\u00eb cil\u00ebs kryen nj\u00eb ndryshim t\u00eb kopjes t\u00eb kontrolluar t\u00eb t\u00eb dh\u00ebnave dhe vler\u00ebson koh\u00ebn e reagimit p\u00ebr t\u00eb p\u00ebrcaktuar suksesin e sulmit.

\"Metoda<\/center> <\/p>\n

N\u00eb eksperimente t\u00eb zhvilluara, shpejt\u00ebsia maksimale e rrjedhjes s\u00eb informacionit arriti 34.41 byte n\u00eb or\u00eb gjat\u00eb sulmit p\u00ebrmes rrjetit global dhe 302.16 byte n\u00eb or\u00eb gjat\u00eb sulmit p\u00ebrmes rrjetit lokal, q\u00eb \u00ebsht\u00eb m\u00eb e shpejt\u00eb se metodat e tjera t\u00eb nxjerrjes s\u00eb t\u00eb dh\u00ebnave p\u00ebrmes kanaleve t\u00eb jashtme (p.sh., gjat\u00eb sulmit NetSpectre, shpejt\u00ebsia e transmetimit t\u00eb t\u00eb dh\u00ebnave \u00ebsht\u00eb 7.5 byte n\u00eb or\u00eb). <\/p>\n

T\u00eb tre variantet e pun\u00ebs s\u00eb sulmit jan\u00eb propozuar. Varianti i par\u00eb lejon identifikimin e t\u00eb dh\u00ebnave n\u00eb memorje servert web<\/a>, i cili p\u00ebrdor Memcached. Sulmi p\u00ebrfshin ngarkimin e grupeve t\u00eb caktuara t\u00eb t\u00eb dh\u00ebnave n\u00eb depozit\u00ebn Memcached, pastrimin e bllokut t\u00eb deduplikimit, rikthimin e nj\u00ebjtit element dhe krijimin e kushteve p\u00ebr shfaqjen e COW-kopjimit p\u00ebrmes ndryshimit t\u00eb p\u00ebrmbajtjes s\u00eb bllokut. Gjat\u00eb eksperimentit me Memcached, arrit\u00ebm t\u00eb identifikohet versione libc, e instaluar n\u00eb sistemin e p\u00ebrfshir\u00eb n\u00eb makin\u00eb virtuale, p\u00ebr 166.51 sekonda. <\/p>\n

Varianti i dyt\u00eb ofroi mund\u00ebsin\u00eb p\u00ebr t\u00eb zbuluar p\u00ebrmbajtjen e regjistrimeve n\u00eb DBMS MariaDB, duke p\u00ebrdorur depozit\u00ebn InnoDB, p\u00ebrmes rigjenerimit t\u00eb p\u00ebrmbajtjes byte p\u00ebr byte. Sulmi realizohet duke d\u00ebrguar k\u00ebrkesa t\u00eb modifikuara posa\u00e7\u00ebrisht, q\u00eb \u00e7ojn\u00eb n\u00eb moskoincidenca nj\u00eb byte n\u00eb faqet e memorjes dhe analizimin e koh\u00ebs s\u00eb reagimit p\u00ebr t\u00eb p\u00ebrcaktuar n\u00ebse hipoteza p\u00ebr p\u00ebrmbajtjen e bytes ishte e sakt\u00eb. Shpejt\u00ebsia e till\u00eb e rrjedhjes \u00ebsht\u00eb e vog\u00ebl dhe arrin 1.5 byte n\u00eb or\u00eb gjat\u00eb sulmit nga rrjeti lokal. Nj\u00eb avantazh i k\u00ebtij metode \u00ebsht\u00eb se mund t\u00eb p\u00ebrdoret p\u00ebr rikuperimin e p\u00ebrmbajtjes s\u00eb panjohur t\u00eb memorjes. <\/p>\n

T\u00eb tret\u00ebn variant e lejoi q\u00eb brenda 4 minutave t\u00eb shmang mekanizmin e mbrojtjes KASLR dhe t\u00eb merr informacion mbi zhvendosjen n\u00eb memorie t\u00eb imazhit t\u00eb b\u00ebrtham\u00ebs s\u00eb makin\u00ebs virtuale, n\u00eb situat\u00ebn kur adresa e zhvendosjes ndodhet n\u00eb faqen e memories, t\u00eb dh\u00ebnat e tjera n\u00eb t\u00eb cil\u00ebn nuk ndryshojn\u00eb. Sulmi u realizua nga nj\u00eb host q\u00eb ndodhej 14 hopa nga sistemi i sulmuar. Shembujt e kodit p\u00ebr realizimin e sulmeve t\u00eb paraqitura premtojn\u00eb t\u00eb publikohen n\u00eb GitHub.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u043d\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0434\u0435\u0434\u0443\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 (Memory-Deduplication), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0431\u0430\u0439\u0442\u043e\u0432\u0443\u044e \u0443\u0442\u0435\u0447\u043a\u0443 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u043a\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 (ASLR). \u041e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102322,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Propozohet nj\u00eb metod\u00eb sulmi p\u00ebr identifikimin e distancuar t\u00eb fragmenteve t\u00eb memories n\u00eb server | ProHoster","description":"Nj\u00eb grup hulumtuesish nga Universiteti Teknik i Grazit (Austria), i njohur m\u00eb par\u00eb p\u00ebr zhvillimin e sulmeve MDS, NetSpectre, Throwhammer dhe ZombieLoad, publikoi nj\u00eb metod\u00eb t\u00eb re sulmi (CVE-2021-3714) p\u00ebrmes kanaleve t\u00eb jashtme.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0430\u0442\u0430\u043a MDS, NetSpectre, Throwhammer \u0438 ZombieLoad, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 (CVE-2021-3714) \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/predlozhen-metod-ataki-dlya-udalyonnogo-opredeleniya-fragmentov-pamyati-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-18T19:36:41+00:00","article:modified_time":"2021-11-18T19:36:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102321","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-18 19:37:43","updated":"2026-02-09 21:39:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=102321"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102321\/revisions"}],"predecessor-version":[{"id":159967,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102321\/revisions\/159967"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/102322"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=102321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=102321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=102321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}