{"id":82460,"date":"2020-05-21T19:42:00","date_gmt":"2020-05-21T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery"},"modified":"2020-05-21T19:42:00","modified_gmt":"2020-05-21T17:42:00","slug":"ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","title":{"rendered":"Sulmi NXNSAttack, e cila prek t\u00eb gjith\u00eb zgjidh\u00ebsit DNS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb grup k\u00ebrkuesish nga Universiteti i Tel Avivit dhe Qendra Nd\u00ebrdisiplinore n\u00eb Herzliya (Izrael) ka zhvilluar<\/a><\/noindex> nj\u00eb metod\u00eb t\u00eb re sulmi NXNSAttack<\/a><\/noindex> (PDF<\/a><\/noindex>), e cila lejon p\u00ebrdorimin e \u00e7do zgjidh\u00ebsi DNS si forcues trafiku, q\u00eb ofron nj\u00eb grad\u00eb forcimi deri n\u00eb 1621 her\u00eb n\u00eb numrin e paketave (p\u00ebr \u00e7do k\u00ebrkes\u00eb q\u00eb d\u00ebrgohet n\u00eb zgjidh\u00ebsin, mund t\u00eb arrihet d\u00ebrgimi n\u00eb serverin e viktim\u00ebs t\u00eb 1621 k\u00ebrkesave) dhe deri n\u00eb 163 her\u00eb p\u00ebr trafik. <\/p>\n

Problemi \u00ebsht\u00eb i lidhur me ve\u00e7orit\u00eb e funksionimit t\u00eb protokollit dhe prek t\u00eb gjith\u00eb server\u00ebt DNS q\u00eb mb\u00ebshtesin p\u00ebrpunimin rekurziv t\u00eb k\u00ebrkesave, p\u00ebrfshir\u00eb BIND<\/a><\/noindex> (CVE-2020-8616), Knot<\/a><\/noindex> (CVE-2020-12667), PowerDNS<\/a><\/noindex> (CVE-2020-10995), Windows DNS Server<\/a><\/noindex> dhe Unbound<\/a><\/noindex> (CVE-2020-12662), si dhe sh\u00ebrbimet publike DNS t\u00eb Google, Cloudflare, Amazon, Quad9, ICANN dhe kompanive t\u00eb tjera. Rregullimi i problemit u koordinua me zhvilluesit e server\u00ebve DNS, t\u00eb cil\u00ebt n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb l\u00ebshuan p\u00ebrdit\u00ebsime me rregullimin e dob\u00ebsis\u00eb n\u00eb produktet e tyre. Mbrojtja ndaj sulmit \u00ebsht\u00eb implementuar n\u00eb versionet
\nUnbound 1.10.1<\/a><\/noindex>, Knot Resolver 5.1.1<\/a><\/noindex>, PowerDNS Recursor 4.3.1, 4.2.2, 4.1.16<\/a><\/noindex>, BIND 9.11.19, 9.14.12, 9.16.3<\/a><\/noindex>.<\/p>\n

Sulmi bazohet n\u00eb p\u00ebrdorimin nga sulmuesi t\u00eb k\u00ebrkesave q\u00eb referohen n\u00eb nj\u00eb num\u00ebr t\u00eb madh NS-rekordesh fiktive q\u00eb nuk jan\u00eb hasur m\u00eb par\u00eb, t\u00eb cilave u delegohet p\u00ebrcaktimi i emrit, por pa treguar n\u00eb p\u00ebrgjigje rekordet glue me informacion mbi adresat IP t\u00eb server\u00ebve NS. P\u00ebr shembull, sulmuesi d\u00ebrgon nj\u00eb k\u00ebrkes\u00eb p\u00ebr p\u00ebrcaktimin e emrit sd1.attacker.com, duke kontrolluar serverin DNS q\u00eb \u00ebsht\u00eb p\u00ebrgjegj\u00ebs p\u00ebr domenin attacker.com. N\u00eb p\u00ebrgjigje t\u00eb k\u00ebrkes\u00ebs s\u00eb zgjidh\u00ebsit ndaj serverit DNS t\u00eb sulmuesit, jepet nj\u00eb p\u00ebrgjigje q\u00eb delegon p\u00ebrcaktimin e adres\u00ebs sd1.attacker.com te serveri DNS i viktim\u00ebs duke treguar n\u00eb p\u00ebrgjigje rekordet NS pa detaje p\u00ebr IP-t\u00eb e server\u00ebve NS. Pasi serveri NS i p\u00ebrmendur nuk \u00ebsht\u00eb hasur m\u00eb par\u00eb dhe adresa e tij IP nuk \u00ebsht\u00eb e specifikuar, zgjidh\u00ebsi p\u00ebrpiqet t\u00eb p\u00ebrcaktoj\u00eb adres\u00ebn IP t\u00eb serverit NS, duke d\u00ebrguar nj\u00eb k\u00ebrkes\u00eb te serveri DNS i viktim\u00ebs, q\u00eb sh\u00ebrben domenin e synuar (victim.com).<\/p>\n

\"Sulmi<\/a><\/noindex><\/center><\/p>\n

Problemi \u00ebsht\u00eb se sulmuesi mund t\u00eb jap\u00eb n\u00eb p\u00ebrgjigje nj\u00eb list\u00eb t\u00eb madhe server\u00ebsh NS unik\u00eb me emra n\u00ebn-domenesh t\u00eb rrem\u00eb q\u00eb nuk ekzistojn\u00eb (fake-1.victim.com, fake-2.victim.com,\u2026 fake-1000.victim.com). Resolver-i do t\u00eb p\u00ebrpiqet t\u00eb d\u00ebrgoj\u00eb nj\u00eb k\u00ebrkes\u00eb DNS-serverit t\u00eb viktim\u00ebs, por do t\u00eb marr\u00eb nj\u00eb p\u00ebrgjigje se domeni nuk \u00ebsht\u00eb gjetur, pastaj do t\u00eb p\u00ebrpiqet t\u00eb p\u00ebrcaktoj\u00eb serverin tjet\u00ebr NS n\u00eb list\u00eb dhe k\u00ebshtu deri sa t\u00eb kaloj\u00eb t\u00eb gjith\u00eb regjistrat NS t\u00eb listuar nga sulmuesi. Si rezultat, p\u00ebr nj\u00eb k\u00ebrkes\u00eb nga sulmuesi, resolver-i do t\u00eb d\u00ebrgoj\u00eb nj\u00eb num\u00ebr t\u00eb madh k\u00ebrkesash p\u00ebr t\u00eb p\u00ebrcaktuar hostet NS. N\u00eb saj\u00eb t\u00eb emrave t\u00eb server\u00ebve NS q\u00eb krijohen rast\u00ebsisht dhe referohen n\u00eb n\u00ebn-domen\u00eb q\u00eb nuk ekzistojn\u00eb, ato nuk nxirren nga cache dhe \u00e7do k\u00ebrkes\u00eb nga sulmuesi shkakton nj\u00eb s\u00ebr\u00eb k\u00ebrkesash n\u00eb DNS-serverin q\u00eb sh\u00ebrben domainin e viktim\u00ebs.<\/p>\n

\"Sulmi<\/a><\/noindex><\/center><\/p>\n

K\u00ebrkuesit studiuan shkall\u00ebn e ekspozimit t\u00eb problemeve p\u00ebr dns-resolver\u00ebt publik\u00eb dhe p\u00ebrcaktuan se duke d\u00ebrguar k\u00ebrkesa n\u00eb resolver-in e CloudFlare (1.1.1.1), mund t\u00eb arrihet nj\u00eb shum\u00ebzim i numrit t\u00eb paketave (PAF, Packet Amplification Factor) deri n\u00eb 48 her\u00eb, Google (8.8.8.8) \u2014 30 her\u00eb, FreeDNS (37.235.1.174) \u2014 50 her\u00eb, OpenDNS (208.67.222.222) \u2014 32 her\u00eb. T\u00eb dh\u00ebna m\u00eb t\u00eb dukshme v\u00ebrehen p\u00ebr
\nLevel3 (209.244.0.3) \u2014 273 her\u00eb, Quad9 (9.9.9.9) \u2014 415 her\u00eb
\nSafeDNS (195.46.39.39) \u2014 274 her\u00eb, Verisign (64.6.64.6) \u2014 202 her\u00eb,
\nUltra (156.154.71.1) \u2014 405 her\u00eb, Comodo Secure (8.26.56.26) \u2014 435 her\u00eb, DNS.Watch (84.200.69.80) \u2014 486 her\u00eb, dhe Norton ConnectSafe (199.85.126.10) \u2014 569 her\u00eb. P\u00ebr server\u00ebt e bazuar n\u00eb BIND 9.12.3, p\u00ebrmes paralelizimit t\u00eb k\u00ebrkesave, niveli i p\u00ebrforcimit mund t\u00eb arrij\u00eb deri n\u00eb 1000. N\u00eb Knot Resolver 5.1.0, niveli i p\u00ebrforcimit \u00ebsht\u00eb af\u00ebrsisht disa dhjetra her\u00eb (24-48), pasi p\u00ebrcaktimi i emrave NS kryhet n\u00eb m\u00ebnyr\u00eb t\u00eb nj\u00ebpasnj\u00ebshme dhe has n\u00eb kufizimin e brendsh\u00ebm p\u00ebr numrin e hapave t\u00eb zgjidhjes s\u00eb emrave, t\u00eb lejuar p\u00ebr nj\u00eb k\u00ebrkes\u00eb t\u00eb vetme.<\/p>\n

Identifikohen dy strategji kryesore mbrojtjeje. P\u00ebr sistemet me DNSSEC propozohet<\/a><\/noindex> t\u00eb p\u00ebrdor\u00eb RFC-8198<\/a><\/noindex> p\u00ebr t\u00eb parandaluar shmangien e keq-ruajtjes s\u00eb DNS, pasi k\u00ebrkesat d\u00ebrgohen me emra rast\u00ebsor\u00eb. Thelbi i metod\u00ebs \u00ebsht\u00eb n\u00eb gjenerimin e p\u00ebrgjigjeve negative pa u drejtuar n\u00eb DNS-server\u00ebt autoritativ, duke p\u00ebrdorur verifikimin p\u00ebrmes intervaleve p\u00ebrmes DNSSEC. Nj\u00eb m\u00ebnyr\u00eb m\u00eb e thjesht\u00eb \u00ebsht\u00eb kufizimi i numrit t\u00eb emrave q\u00eb mund t\u00eb p\u00ebrcaktohen gjat\u00eb trajtimit t\u00eb nj\u00eb k\u00ebrkese t\u00eb deleguar, por ky metod\u00eb mund t\u00eb sjell\u00eb probleme me disa konfigurime ekzistuese, pasi kufijt\u00eb nuk jan\u00eb t\u00eb p\u00ebrcaktuar n\u00eb protokoll.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c) \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 NXNSAttack (PDF), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043b\u044e\u0431\u044b\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u0435\u0439 \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0441\u0442\u0435\u043f\u0435\u043d\u044c \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0434\u043e 1621 \u0440\u0430\u0437 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (\u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043a \u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u0443 \u0437\u0430\u043f\u0440\u043e\u0441, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0436\u0435\u0440\u0442\u0432\u044b 1621 \u0437\u0430\u043f\u0440\u043e\u0441) \u0438 \u0434\u043e 163 \u0440\u0430\u0437 \u043f\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":82461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82460","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sulmi NXNSAttack q\u00eb ndikon n\u00eb t\u00eb gjitha DNS-resolverat | ProHoster","description":"Nj\u00eb grup k\u00ebrkuesish nga Universiteti i Tel Avivit dhe Qendra Nd\u00ebrdisiplinore n\u00eb Herzliya (Izrael)","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 NXNSAttack, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0422\u0435\u043b\u044c-\u0410\u0432\u0438\u0432\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u041c\u0435\u0436\u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0432 \u0413\u0435\u0440\u0446\u043b\u0438\u0438 (\u0418\u0437\u0440\u0430\u0438\u043b\u044c)","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-nxnsattack-zatragivayushhaya-vse-dns-rezolvery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-21T17:42:00+00:00","article:modified_time":"2020-05-21T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82460","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:37:29","updated":"2022-09-29 14:28:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/82460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=82460"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/82460\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/82461"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=82460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=82460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=82460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}