{"id":110728,"date":"2023-10-11T03:10:14","date_gmt":"2023-10-11T01:10:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-protokole-http-2-zadejstvovannaya-v-krupnejshej-ddos-atake"},"modified":"2023-10-11T03:10:14","modified_gmt":"2023-10-11T01:10:14","slug":"uyazvimost-v-protokole-http-2-zadejstvovannaya-v-krupnejshej-ddos-atake","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-protokole-http-2-zadejstvovannaya-v-krupnejshej-ddos-atake","title":{"rendered":"Vulnera n\u00eb protokollin HTTP\/2, t\u00eb angazhuar n\u00eb sulmin m\u00eb t\u00eb madhen DDoS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania Google regjistroi sulmin m\u00eb t\u00eb madh DDoS ndaj infrastruktur\u00ebs s\u00eb saj, me intensitet prej 398 milion k\u00ebrkesash n\u00eb sekond\u00eb. Sulmi i ri \u00ebsht\u00eb 7 her\u00eb m\u00eb intensiv se sulmi rekord t\u00eb kaluar, n\u00eb t\u00eb cilin sulmuesit arrit\u00ebn t\u00eb formonin nj\u00eb fluks prej 47 milion k\u00ebrkesash n\u00eb sekond\u00eb. P\u00ebr krahasim, t\u00ebr\u00eb trafiku n\u00eb Web k\u00ebndvizohet n\u00eb nj\u00eb nivel prej 1-3 miliard k\u00ebrkesash n\u00eb sekond\u00eb. P\u00ebrve\u00e7 Google, sulmi e p\u00ebrballuan gjithashtu kompanit\u00eb Amazon dhe Cloudflare. Mund\u00ebsia e realizimit t\u00eb nj\u00eb sulmi t\u00eb ri lidhet me identifikimin e nj\u00eb ndjeshm\u00ebrie n\u00eb protokollin HTTP\/2 (CVE-2023-44487), e cila lejon d\u00ebrgimin e nj\u00eb fluksi t\u00eb madh k\u00ebrkesash n\u00eb server me nj\u00eb ngarkes\u00eb minimale n\u00eb klient. <\/p>\n

Teknika e re e sulmit quhet \"Rapid Reset\" dhe shfryt\u00ebzon mjetet e ofruara n\u00eb HTTP\/2 p\u00ebr shum\u00ebzimin e kanaleve t\u00eb komunikimit, duke lejuar formimin e nj\u00eb rrjedhe k\u00ebrkesash brenda nj\u00eb lidhjeje t\u00eb vendosur tashm\u00eb, pa hapur lidhje t\u00eb reja rrjeti dhe pa pritur konfirmimin e marrjes s\u00eb paketave. Dob\u00ebsia konsiderohet si pasoj\u00eb e mang\u00ebsive t\u00eb protokollit HTTP\/2, n\u00eb specifikimin e t\u00eb cilit thuhet se kur p\u00ebrpiqet t\u00eb hap\u00eb numrin e tep\u00ebrt t\u00eb rrjedhjeve, duhet t\u00eb anullohen vet\u00ebm rrjedhjet q\u00eb e tejkalojn\u00eb kufirin, por t\u00eb mos mbyllet e gjith\u00eb lidhja rrjetore. <\/p>\n

N\u00eb p\u00ebrputhje me metodat e m\u00ebparshme t\u00eb sulmeve ndaj HTTP\/2, n\u00eb sulmin e ri krijohet gjithashtu nj\u00eb num\u00ebr i madh rrjedhash brenda nj\u00eb lidhjeje. Dallimi ky\u00e7 i sulmit t\u00eb ri \u00ebsht\u00eb se, n\u00eb vend t\u00eb pritjes p\u00ebr nj\u00eb p\u00ebrgjigje pas \u00e7do k\u00ebrkese t\u00eb d\u00ebrguar, d\u00ebrgohet nj\u00eb korniz\u00eb me flamurin RST_STREAM, e cila anulon menj\u00ebher\u00eb k\u00ebrkes\u00ebn. Anulimi i k\u00ebrkes\u00ebs n\u00eb nj\u00eb faz\u00eb t\u00eb hershme lejon shmangien e trafik\u00ebs p\u00ebr n\u00eb klient dhe kalimin p\u00ebrmes kufizimeve t\u00eb pranishme n\u00eb server\u00ebt HTTP p\u00ebr numrin maksimal t\u00eb rrjedhash t\u00eb hapura n\u00eb kuad\u00ebr t\u00eb nj\u00eb lidhjeje n\u00eb HTTP\/2. K\u00ebshtu, n\u00eb sulmin e ri, volumi i k\u00ebrkesave t\u00eb d\u00ebrguara n\u00eb serverin HTTP nuk varet nga vonesat midis d\u00ebrgimit t\u00eb k\u00ebrkes\u00ebs dhe marrjes s\u00eb p\u00ebrgjigjes (RTT, koh\u00eb e kthyer), por p\u00ebrqendrohet vet\u00ebm n\u00eb kapacitetin e kanalit t\u00eb komunikimit.

\"Vulnera<\/center> <\/p>\n

Duke pasur parasysh se p\u00ebr t\u00eb realizuar sulmin nga ana e klientit mjafton t\u00eb d\u00ebrgohen k\u00ebrkesa pa marr\u00eb p\u00ebrgjigje, sulmi mund t\u00eb realizohet me shpenzime minimale. P\u00ebr shembull, sulmi i regjistruar nga kompania Cloudflare me 201 milion k\u00ebrkesa n\u00eb sekond\u00eb u realizua me nj\u00eb botnet relativisht t\u00eb vog\u00ebl prej 20 mij\u00eb kompjuter\u00ebsh. N\u00eb an\u00ebn server<\/a> shpenzimet p\u00ebr p\u00ebrpunimin e k\u00ebrkesave t\u00eb ardhura jan\u00eb ndjesh\u00ebm m\u00eb t\u00eb larta, megjith\u00ebse ato anullohen, pasi duhet t\u00eb kryhen operacione si alokimi i strukturave t\u00eb dh\u00ebnash p\u00ebr rrjedha t\u00eb reja, analizimi i k\u00ebrkes\u00ebs, zhbllokimi i titullit dhe p\u00ebrputhja e URL-s\u00eb me burimin. N\u00eb sulmin ndaj proxy-ve t\u00eb prapme, sulmi mund t\u00eb p\u00ebrhapet n\u00eb backend, pasi proxy mund t\u00eb arrij\u00eb t\u00eb ridrejtoj\u00eb k\u00ebrkes\u00ebn n\u00eb backend para se korniza RST_STREAM t\u00eb p\u00ebrpunoj\u00eb. <\/p>\n

Suli mund t\u00eb b\u00ebhet vet\u00ebm mbi server\u00ebt e ndjesh\u00ebm q\u00eb mb\u00ebshtesin HTTP\/2 (skripti p\u00ebr t\u00eb verifikuar manifestimin e ndjeshm\u00ebris\u00eb n\u00eb servera, instrumenti p\u00ebr kryerjen e sulmit). Nuk jan\u00eb regjistruar ende sulme mbi HTTP\/3 dhe mund\u00ebsit\u00eb p\u00ebr realizimin e tyre nuk jan\u00eb analizuar plot\u00ebsisht, por p\u00ebrfaq\u00ebsuesit e Google rekomandojn\u00eb zhvilluesit servera<\/a> t\u00eb shtojn\u00eb n\u00eb implementimet e HTTP\/3 masa mbrojt\u00ebse t\u00eb ngjashme me ato t\u00eb realizuara p\u00ebr bllokimin e sulmeve ndaj HTTP\/2. <\/p>\n

Ndjeshm\u00ebria ndaj ndjeshm\u00ebris\u00eb dhe disponueshm\u00ebria e rregullimeve p\u00ebr server\u00ebt HTTP dhe proxy: <\/p>\n