{"id":110728,"date":"2023-10-11T03:10:14","date_gmt":"2023-10-11T01:10:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-protokole-http-2-zadejstvovannaya-v-krupnejshej-ddos-atake"},"modified":"2023-10-11T03:10:14","modified_gmt":"2023-10-11T01:10:14","slug":"uyazvimost-v-protokole-http-2-zadejstvovannaya-v-krupnejshej-ddos-atake","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-protokole-http-2-zadejstvovannaya-v-krupnejshej-ddos-atake","title":{"rendered":"Dob\u00ebsi n\u00eb protokollin HTTP\/2, e shfryt\u00ebzuar n\u00eb sulmin m\u00eb t\u00eb madh DDoS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania Google ka regjistruar sulmin m\u00eb t\u00eb madh DDoS n\u00eb infrastruktur\u00ebn e saj, me nj\u00eb intensitet prej 398 milion k\u00ebrkesash n\u00eb sekond\u00eb. Sulmi i ri \u00ebsht\u00eb 7 her\u00eb m\u00eb intensiv se sulmi rekord i kaluar DDoS, ku sulmuesit arrit\u00ebn t\u00eb formonin nj\u00eb rrjedh\u00eb prej 47 milion k\u00ebrkesash n\u00eb sekond\u00eb. P\u00ebr t\u00eb b\u00ebr\u00eb nj\u00eb krahasim, gjith\u00eb trafiku n\u00eb t\u00eb gjith\u00eb Web-in vler\u00ebsohet nga 1-3 miliard k\u00ebrkesash n\u00eb sekond\u00eb. P\u00ebrve\u00e7 Google, sulmit iu n\u00ebnshtruan gjithashtu kompanit\u00eb Amazon dhe Cloudflare. Mund\u00ebsia e realizimit t\u00eb nj\u00eb sulmi t\u00eb ri \u00ebsht\u00eb e lidhur me zbulimin e nj\u00eb dob\u00ebsie n\u00eb protokollin HTTP\/2 (CVE-2023-44487), q\u00eb lejon q\u00eb me nj\u00eb ngarkes\u00eb minimale nga klienti t\u00eb d\u00ebrgohet nj\u00eb rrjedh\u00eb e madhe k\u00ebrkesash n\u00eb server. <\/p>\n

Teknika e re e sulmit mori emrin \"Rapid Reset\" dhe shfryt\u00ebzon mjetet e ofruara n\u00eb HTTP\/2 p\u00ebr multiplikimin e kanaleve t\u00eb komunikimit, duke lejuar formimin e nj\u00eb rrjedhe k\u00ebrkesash brenda nj\u00eb lidhjeje t\u00eb vendosur tashm\u00eb, pa hapur lidhje t\u00eb reja rrjeti dhe pa pritur konfirmimin e marrjes s\u00eb paketeve. Vulnerabiliteti konsiderohet si pasoj\u00eb e pap\u00ebrsosm\u00ebris\u00eb s\u00eb protokollit HTTP\/2, n\u00eb specifikimin e t\u00eb cilit thuhet se n\u00eb rastin e p\u00ebrpjekjes p\u00ebr t\u00eb hapur nj\u00eb num\u00ebr shum\u00eb t\u00eb madh t\u00eb rrjedhave, duhet t\u00eb anulohet vet\u00ebm rrjedhat q\u00eb tejkalojn\u00eb limitin, por jo t\u00eb mbyllet e gjith\u00eb lidhja rrjetit. <\/p>\n

Si me metodat e m\u00ebparshme t\u00eb sulmeve n\u00eb HTTP\/2, n\u00eb sulmin e ri gjithashtu krijohet nj\u00eb num\u00ebr i madh rrjedhash brenda nj\u00eb lidhjeje. Dallimi kryesor i sulmit t\u00eb ri \u00ebsht\u00eb se, n\u00eb vend t\u00eb pritjes p\u00ebr nj\u00eb p\u00ebrgjigje pas \u00e7do k\u00ebrkese t\u00eb d\u00ebrguar, d\u00ebrgohet nj\u00eb kad\u00ebr me flamurin RST_STREAM, q\u00eb menj\u00ebher\u00eb anulon k\u00ebrkes\u00ebn. Anulimi i k\u00ebrkes\u00ebs n\u00eb nj\u00eb faz\u00eb t\u00eb hershme lejon q\u00eb t\u00eb eliminohet trafiku n\u00eb drejtim t\u00eb klientit dhe t\u00eb anashkalohet kufizimet e pranishme n\u00eb server\u00ebt HTTP p\u00ebr numrin maksimale t\u00eb rrjedhave, t\u00eb hapura nj\u00ebkoh\u00ebsisht brenda nj\u00eb lidhjeje n\u00eb HTTP\/2. K\u00ebshtu, n\u00eb sulmin e ri, volumi i k\u00ebrkesave t\u00eb d\u00ebrguara n\u00eb serverin HTTP nuk varet m\u00eb nga vonesat midis d\u00ebrgimit t\u00eb k\u00ebrkes\u00ebs dhe pranimit t\u00eb p\u00ebrgjigjes (RTT, koha e kthimit) dhe kufizohet vet\u00ebm n\u00eb kapacitetin e kanalit t\u00eb komunikimit.

\"Dob\u00ebsi<\/center> <\/p>\n

Pasi p\u00ebr t\u00eb kryer nj\u00eb sulm nga ana e klientit, mjafton t\u00eb d\u00ebrgosh k\u00ebrkesa pa marr\u00eb p\u00ebrgjigje, k\u00ebshtu q\u00eb sulmi mund t\u00eb kryhet me shpenzime minimale. P\u00ebr shembull, nj\u00eb sulm i regjistruar nga kompanit\u00eb Cloudflare me 201 milion k\u00ebrkesa n\u00eb sekond\u00eb u realizua me nj\u00eb botnet relativisht t\u00eb vog\u00ebl prej 20 mij\u00eb kompjuter\u00ebsh. Nga ana tjet\u00ebr, server\u00eb<\/a> kostot p\u00ebr p\u00ebrpunimin e k\u00ebrkesave q\u00eb mb\u00ebrrijn\u00eb jan\u00eb ndjesh\u00ebm m\u00eb t\u00eb larta, pavar\u00ebsisht se ato anulohen, pasi nevojitet t\u00eb kryhen operacione t\u00eb tilla si ndarja e strukturave t\u00eb t\u00eb dh\u00ebnave p\u00ebr rrjedhat e reja, analiza e k\u00ebrkes\u00ebs, shp\u00ebrb\u00ebrja e titullit dhe p\u00ebrputhja e URL me burimin. N\u00eb nj\u00eb sulm ndaj proxy-ve t\u00eb prapambetur, sulmi mund t\u00eb p\u00ebrhapet n\u00eb backend, pasi proxy mund t\u00eb arrij\u00eb t\u00eb redirectoj\u00eb k\u00ebrkes\u00ebn n\u00eb backend para se t\u00eb p\u00ebrpunoj\u00eb korniz\u00ebn RST_STREAM. <\/p>\n

Sulmi mund t\u00eb kryhet vet\u00ebm ndaj server\u00ebve t\u00eb cenuesh\u00ebm q\u00eb mb\u00ebshtesin HTTP\/2 (skedari p\u00ebr kontrollimin e shfaqjes s\u00eb cenueshm\u00ebris\u00eb n\u00eb servera, mjetet p\u00ebr kryerjen e sulmit). P\u00ebr HTTP\/3 nuk jan\u00eb regjistruar akoma sulme dhe mund\u00ebsia e kryerjes s\u00eb tyre nuk \u00ebsht\u00eb analizuar plot\u00ebsisht, por p\u00ebrfaq\u00ebsuesit e Google rekomandojn\u00eb zhvilluesve server\u00ebsh<\/a> t\u00eb shtojn\u00eb n\u00eb implementimet e HTTP\/3 masa mbrojt\u00ebse, t\u00eb ngjashme me ato t\u00eb zbatuara p\u00ebr bllokimin e sulmeve ndaj HTTP\/2. <\/p>\n

Cenueshm\u00ebria dhe disponueshm\u00ebria e rregullimeve p\u00ebr serverat dhe proxy-t HTTP: <\/p>\n