{"id":82460,"date":"2020-05-21T19:42:00","date_gmt":"2020-05-21T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery"},"modified":"2020-05-21T19:42:00","modified_gmt":"2020-05-21T17:42:00","slug":"ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","title":{"rendered":"Sulmi NXNSAttack, i cili prek t\u00eb gjitha DNS-resolvers","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb grup k\u00ebrkuesish nga Universiteti i Tel Avivit dhe Qendra Nd\u00ebrdisiplinore n\u00eb Herzli\u00eb (Izrael) zhvilluan<\/a><\/noindex> metoda e re e sulmit NXNSAttack<\/a><\/noindex> (PDF<\/a><\/noindex>), e cila lejon p\u00ebrdorimin e \u00e7do DNS-resolveri si amplifikator trafiku, duke ofruar nj\u00eb shkall\u00eb amplifikimi deri n\u00eb 1621 her\u00eb p\u00ebr numrin e paketave (p\u00ebr \u00e7do k\u00ebrkes\u00eb t\u00eb d\u00ebrguar te resolveri, mund t\u00eb arrihet d\u00ebrgimi i 1621 k\u00ebrkesave n\u00eb serverin e viktim\u00ebs) dhe deri n\u00eb 163 her\u00eb p\u00ebr trafik. <\/p>\n

Problemi \u00ebsht\u00eb i lidhur me ve\u00e7orit\u00eb e pun\u00ebs s\u00eb protokollit dhe preku t\u00eb gjitha serverat DNS q\u00eb mb\u00ebshtesin p\u00ebrpunimin rekurziv t\u00eb k\u00ebrkesave, p\u00ebrfshir\u00eb BIND<\/a><\/noindex> (CVE-2020-8616), Knot<\/a><\/noindex> (CVE-2020-12667), PowerDNS<\/a><\/noindex> (CVE-2020-10995), Windows DNS Server<\/a><\/noindex> dhe Unbound<\/a><\/noindex> (CVE-2020-12662), si dhe sh\u00ebrbimet publike t\u00eb DNS si Google, Cloudflare, Amazon, Quad9, ICANN dhe kompani t\u00eb tjera. Rregullimi i problemit u koordinua me zhvilluesit e server\u00ebve DNS, t\u00eb cil\u00ebt n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb l\u00ebshuan p\u00ebrdit\u00ebsime p\u00ebr t\u00eb eliminuar dob\u00ebsin\u00eb n\u00eb produktet e tyre. Mbrojtja nga sulmi \u00ebsht\u00eb realizuar n\u00eb l\u00ebshimet
\nUnbound 1.10.1<\/a><\/noindex>, Knot Resolver 5.1.1<\/a><\/noindex>, PowerDNS Recursor 4.3.1, 4.2.2, 4.1.16<\/a><\/noindex>, BIND 9.11.19, 9.14.12, 9.16.3<\/a><\/noindex>.<\/p>\n

Sulmi bazohet n\u00eb p\u00ebrdorimin nga sulmuesi t\u00eb k\u00ebrkesave q\u00eb referohen n\u00eb nj\u00eb num\u00ebr t\u00eb madh t\u00eb NS-rekordeve fiktive t\u00eb pa p\u00ebrdorura m\u00eb par\u00eb, t\u00eb cil\u00ebve u delegohet p\u00ebrcaktimi i emrit, por pa specifikuar n\u00eb p\u00ebrgjigje NS-rekordeve me informacion mbi adresat IP t\u00eb server\u00ebve NS. P\u00ebr shembull, sulmuesi d\u00ebrgon nj\u00eb k\u00ebrkes\u00eb p\u00ebr p\u00ebrcaktimin e emrit sd1.attacker.com, duke kontrolluar serverin DNS q\u00eb p\u00ebrgjigjet p\u00ebr domenin attacker.com. N\u00eb p\u00ebrgjigje t\u00eb k\u00ebrkes\u00ebs s\u00eb resolverit p\u00ebr serverin DNS t\u00eb sulmuesit, jepet nj\u00eb p\u00ebrgjigje q\u00eb delegon p\u00ebrcaktimin e adres\u00ebs sd1.attacker.com te serveri DNS i viktim\u00ebs, duke treguar NS-rekordet n\u00eb p\u00ebrgjigje pa detajet IP t\u00eb server\u00ebve NS. Duke qen\u00eb se serveri NS i p\u00ebrmendur nuk \u00ebsht\u00eb par\u00eb m\u00eb par\u00eb dhe adresa IP e tij nuk \u00ebsht\u00eb e specifikuar, resolveri p\u00ebrpiqet t\u00eb p\u00ebrcaktoj\u00eb adres\u00ebn IP t\u00eb serverit NS duke d\u00ebrguar nj\u00eb k\u00ebrkes\u00eb n\u00eb serverin DNS t\u00eb viktim\u00ebs, i cili sh\u00ebrben domenin e synuar (victim.com).<\/p>\n

\"Sulmi<\/a><\/noindex><\/center><\/p>\n

Problemi \u00ebsht\u00eb se sulmuesi mund t\u00eb dor\u00ebzoj\u00eb nj\u00eb list\u00eb t\u00eb madhe t\u00eb server\u00ebve NS q\u00eb nuk p\u00ebrs\u00ebriten, me emra n\u00ebn-domenesh t\u00eb pacaktuar t\u00eb viktim\u00ebs (fake-1.victim.com, fake-2.victim.com, \u2026 fake-1000.victim.com). Rezolvuesi do t\u00eb p\u00ebrpiqet t\u00eb d\u00ebrgoj\u00eb nj\u00eb k\u00ebrkes\u00eb DNS n\u00eb serverin e viktim\u00ebs, por do t\u00eb marr\u00eb nj\u00eb p\u00ebrgjigje q\u00eb domeni nuk ekziston, pas s\u00eb cil\u00ebs do t\u00eb p\u00ebrpiqet t\u00eb identifikoj\u00eb serverin tjet\u00ebr NS n\u00eb list\u00eb dhe k\u00ebshtu me radh\u00eb, derisa t\u00eb provoj\u00eb t\u00eb gjitha regjistrimet NS t\u00eb renditura nga sulmuesi. Prandaj, p\u00ebr \u00e7do k\u00ebrkes\u00eb nga sulmuesi, do t\u00eb d\u00ebrgohen nj\u00eb num\u00ebr i madh k\u00ebrkesash p\u00ebr t\u00eb p\u00ebrcaktuar hostet NS. Duke qen\u00eb se emrat e server\u00ebve NS krijohen rast\u00ebsisht dhe referohen n\u00eb n\u00ebn-domena q\u00eb nuk ekzistojn\u00eb, ato nuk nxirren nga cache dhe \u00e7do k\u00ebrkes\u00eb nga sulmuesi shkakton nj\u00eb fluks k\u00ebrkesash n\u00eb serverin DNS q\u00eb sh\u00ebrben domenin e viktim\u00ebs.<\/p>\n

\"Sulmi<\/a><\/noindex><\/center><\/p>\n

Hulumtuesit shqyrtuan nivelin e ndjeshm\u00ebris\u00eb s\u00eb problemeve t\u00eb rezolvuesve publik\u00eb DNS dhe zbuluan se duke d\u00ebrguar k\u00ebrkesa n\u00eb rezolvuesin CloudFlare (1.1.1.1) mund t\u00eb arrihet nj\u00eb rritje e numrit t\u00eb paketave (PAF, Packet Amplification Factor) deri n\u00eb 48 her\u00eb, Google (8.8.8.8) \u2014 30 her\u00eb, FreeDNS (37.235.1.174) \u2014 50 her\u00eb, OpenDNS (208.67.222.222) \u2014 32 her\u00eb. T\u00eb dh\u00ebna m\u00eb t\u00eb dukshme v\u00ebrehen p\u00ebr
\nLevel3 (209.244.0.3) \u2014 273 her\u00eb, Quad9 (9.9.9.9) \u2014 415 her\u00eb
\nSafeDNS (195.46.39.39) \u2014 274 her\u00eb, Verisign (64.6.64.6) \u2014 202 her\u00eb,
\nUltra (156.154.71.1) \u2014 405 her\u00eb, Comodo Secure (8.26.56.26) \u2014 435 her\u00eb, DNS.Watch (84.200.69.80) \u2014 486 her\u00eb, dhe Norton ConnectSafe (199.85.126.10) \u2014 569 her\u00eb. P\u00ebr server\u00ebt e bazuar n\u00eb BIND 9.12.3, p\u00ebr shkak t\u00eb paralelizmit t\u00eb k\u00ebrkesave, niveli i amplifikimit mund t\u00eb arrij\u00eb deri n\u00eb 1000. N\u00eb Knot Resolver 5.1.0, niveli i amplifikimit \u00ebsht\u00eb rreth disa dhjetra her\u00eb (24-48), pasi identifikimi i emrave NS b\u00ebhet n\u00eb m\u00ebnyr\u00eb sekondare dhe p\u00ebrfundohet n\u00eb nj\u00eb kufizim t\u00eb brendsh\u00ebm mbi numrin e hapave t\u00eb zgjidhjes s\u00eb emrave q\u00eb lejohen p\u00ebr nj\u00eb k\u00ebrkes\u00eb t\u00eb vetme.<\/p>\n

Dalin dy strategji kryesore mbrojtjeje. P\u00ebr sistemet me DNSSEC propozuar<\/a><\/noindex> p\u00ebrdorimi RFC-8198<\/a><\/noindex> p\u00ebr t\u00eb parandaluar kalimin p\u00ebrmes cache-it DNS, pasi k\u00ebrkesat d\u00ebrgohen me emra rast\u00ebsor\u00eb. Thelbi i metod\u00ebs \u00ebsht\u00eb gjenerimi i p\u00ebrgjigjeve negative pa u drejtuar n\u00eb server\u00ebt DNS autoritativ\u00eb, duke p\u00ebrdorur verifikimin p\u00ebrmes diapazoneve me DNSSEC. Nj\u00eb m\u00ebnyr\u00eb m\u00eb e thjesht\u00eb \u00ebsht\u00eb kufizimi i numrit t\u00eb emrave q\u00eb mund t\u00eb p\u00ebrcaktohen gjat\u00eb p\u00ebrpunimit t\u00eb nj\u00eb k\u00ebrkese t\u00eb deleguar, por kjo metod\u00eb mund t\u00eb sjell\u00eb probleme me disa konfiguracione ekzistuese, pasi kufizimet nuk p\u00ebrcaktohen n\u00eb protokoll.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c) \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 NXNSAttack (PDF), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043b\u044e\u0431\u044b\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0441\u0442\u0435\u043f\u0435\u043d\u044c \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0434\u043e 1621 \u0440\u0430\u0437 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (\u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043a \u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u0443 \u0437\u0430\u043f\u0440\u043e\u0441, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b 1621 \u0437\u0430\u043f\u0440\u043e\u0441) \u0438 \u0434\u043e 163 \u0440\u0430\u0437 \u043f\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82460","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Sulmi NXNSAttack, q\u00eb prek t\u00eb gjitha DNS-resolver\u00ebt | ProHoster","description":"Nj\u00eb grup k\u00ebrkuesish nga Universiteti i Tel Avivit dhe Qendra Nd\u00ebrdisiplinore n\u00eb Herzli\u00eb (Izrael)","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 NXNSAttack, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c)","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-21T17:42:00+00:00","article:modified_time":"2020-05-21T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82460","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:37:29","updated":"2022-09-29 14:28:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/82460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=82460"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/82460\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/82461"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=82460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=82460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=82460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}