{"id":114452,"date":"2024-03-20T12:25:49","date_gmt":"2024-03-20T10:25:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami"},"modified":"2024-03-20T12:25:49","modified_gmt":"2024-03-20T10:25:49","slug":"ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","title":{"rendered":"Sulm ndaj disa protokolleve t\u00eb bazuara n\u00eb UDP, q\u00eb \u00e7on n\u00eb ciklikun e shk\u00ebmbimit t\u00eb paketave","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Qendra Koordinuese CERT (grupi kompjuterik i reagimit ndaj situatave emergjente) publikoi nj\u00eb paralajm\u00ebrim mbi nj\u00eb seri dob\u00ebsish n\u00eb zbatimet e protokolleve t\u00eb ndryshme aplikative q\u00eb p\u00ebrdorin protokollin UDP si transport. Dob\u00ebsit\u00eb mund t\u00eb shfryt\u00ebzohen p\u00ebr t\u00eb organizuar refuzimin e sh\u00ebrbimit p\u00ebr shkak t\u00eb mund\u00ebsis\u00eb p\u00ebr t\u00eb krijuar cikle n\u00eb shk\u00ebmbimin e paketimeve midis dy hosteve. P\u00ebr shembull, sulmuesit mund t\u00eb shkaktojn\u00eb shpenzimin e kapacitetit t\u00eb disponuesh\u00ebm t\u00eb rrjetit, bllokimin e sh\u00ebrbimeve t\u00eb rrjetit (p\u00ebr shembull, duke krijuar nj\u00eb ngarkes\u00eb t\u00eb lart\u00eb dhe duke tejkaluar kufizimin e intensitetit t\u00eb k\u00ebrkesave) dhe zbatimin e intensifikuesve t\u00eb trafikut p\u00ebr sulmet DDoS. <\/p>\n

Nga protokollet, disa realizime t\u00eb t\u00eb cilave jan\u00eb t\u00eb ndjeshme ndaj dob\u00ebsive, p\u00ebrmenden DNS, NTP, TFTP, Echo (RFC862), Chargen (RFC864) dhe QOTD (RFC865). Prania e dob\u00ebsis\u00eb (CVE-2024-2169) \u00ebsht\u00eb konfirmuar n\u00eb produkte t\u00eb caktuara t\u00eb kompanive Cisco, Microsoft, Broadcom, Brother, Honeywell (CVE-2024-1309) dhe MikroTik. Si masa p\u00ebr parandalimin e dob\u00ebsive, rekomandohet t\u00eb aktivizoni bllokimin e falsifikimit (uRPF) n\u00eb firewall, t\u00eb kufizoni qasjen n\u00eb sh\u00ebrbimet UDP t\u00eb panevojshme dhe t\u00eb konfiguroni kufizimin e intensitetit t\u00eb trafikut (rate-limit dhe QoS). <\/p>\n

Vulnerabilities are caused by the lack of protection of the UDP protocol against address spoofing \u2014 in the absence of spoofing protection on transit routers, an attacker can specify in the UDP packet the IP address of any server and send this packet to another server, which will return a response to the specified fake address. The attack method reduces to creating a situation of packet exchange looping between servers using vulnerable implementations of the protocol. For example, in response to an incoming packet, the target server may send a response with an error code, and the server whose address was provided by the attacker will return its response, which, in turn, will again lead to the return of a packet with an error code. Thus, server\u00ebt<\/a> they will start playing with packets in 'ping-pong' to infinity.

\"Sulm<\/center> <\/p>\n

Shquhet se nj\u00eb metod\u00eb e till\u00eb sulmi nuk \u00ebsht\u00eb e re dhe n\u00eb server<\/a> Sinchronizimi i koh\u00ebs NTPD, nj\u00eb nga variantet e sulmeve u eliminua q\u00eb n\u00eb vitin 2009 (CVE-2009-3563) n\u00eb versionet 4.2.4p8 dhe 4.2.5. Sulmi p\u00ebrfshinte d\u00ebrgimin e nj\u00eb pakete NTP me nj\u00eb adres\u00eb t\u00eb manipuluar dhe me flamurin MODE_PRIVATE t\u00eb vendosur, duke e detyruar serverin e synuar t\u00eb kthente nj\u00eb p\u00ebrgjigje p\u00ebr pamund\u00ebsin\u00eb e p\u00ebrdorimit t\u00eb modit privat, duke l\u00ebn\u00eb flamurin MODE_PRIVATE t\u00eb vendosur n\u00eb p\u00ebrgjigje. Si rezultat, nj\u00eb server tjet\u00ebr gjithashtu nuk mund t\u00eb p\u00ebrpunonte k\u00ebt\u00eb flamur dhe kthente p\u00ebrgjigjen e tij, duke \u00e7uar n\u00eb p\u00ebrs\u00ebritjen e shk\u00ebmbimit t\u00eb paketeve mes dy server\u00ebve NTP. N\u00eb lidhje me protokollin DNS, nj\u00eb paralajm\u00ebrim p\u00ebr mund\u00ebsin\u00eb e nj\u00eb sulmi t\u00eb till\u00eb u publikua q\u00eb n\u00eb vitin 1996. <\/p>\n

Skandimi global i adresave n\u00eb internet tregoi se aktualisht n\u00eb rrjet jan\u00eb t\u00eb pranish\u00ebm t\u00eb pakt\u00ebn 23 mij\u00eb server\u00eb TFTP t\u00eb preksh\u00ebm, 63 mij\u00eb server\u00eb DNS, 89 mij\u00eb server\u00eb NTP, 56 mij\u00eb sh\u00ebrbime Echo\/RFC862, 22 mij\u00eb sh\u00ebrbime Chargen\/RFC864 dhe 21 mij\u00eb sh\u00ebrbime QOTD\/RFC865. Supozohet se n\u00eb rastin e server\u00ebve NTP, prania e nj\u00eb dob\u00ebsie t\u00eb paadresuar lidhet me p\u00ebrdorimin e versioneve shum\u00eb t\u00eb vjetra t\u00eb ntpd, t\u00eb l\u00ebshuara para vitit 2010. Sh\u00ebrbimet Echo, Chargen dhe QOTD jan\u00eb fillimisht t\u00eb prekshme p\u00ebr shkak t\u00eb arkitektur\u00ebs s\u00eb tyre. Situata me server\u00ebt TFTP dhe DNS k\u00ebrkon hetim me administrator\u00ebt e tyre. Server\u00ebt atftpd dhe tftpd nuk jan\u00eb t\u00eb preksh\u00ebm nga ky problem pasi p\u00ebrdorin nj\u00eb num\u00ebr rast\u00ebsor t\u00eb portit t\u00eb rrjetit burimor kur d\u00ebrgojn\u00eb p\u00ebrgjigje. Nga server\u00ebt DNS t\u00eb preksh\u00ebm, p\u00ebrmendet dproxy-nexgen. N\u00eb produktet Microsoft, problemi shfaqet n\u00eb WDS (Sh\u00ebrbimet e Shkarkimit t\u00eb Windows), nd\u00ebrsa n\u00eb produktet Cisco, problemi \u00ebsht\u00eb i pranish\u00ebm n\u00eb router\u00ebt e serive 2800 dhe 2970.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b UDP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u0445\u043e\u0441\u0442\u0430\u043c\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u043e\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0442\u0438, \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114453,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114452","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sulmi ndaj disa protokolleve t\u00eb bazuara n\u00eb UDP, q\u00eb \u00e7on n\u00eb p\u00ebrs\u00ebritjen e shk\u00ebmbimit t\u00eb paketave | ProHoster","description":"Qendra Koordinuese CERT (grupi i reagimit p\u00ebr katastrofa kompjuterike) publikoi nj\u00eb paralajm\u00ebrim p\u00ebr nj\u00eb seri dob\u00ebsish n\u00eb realizimet e protokolleve t\u00eb ndryshme aplikative, q\u00eb p\u00ebrdorin si transport.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 UDP, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044e \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 | ProHoster","og:description":"\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-20T10:25:49+00:00","article:modified_time":"2024-03-20T10:25:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114452","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:37:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/114452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=114452"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/114452\/revisions"}],"predecessor-version":[{"id":159859,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/114452\/revisions\/159859"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/114453"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=114452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=114452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=114452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}