{"id":97349,"date":"2020-10-17T14:42:14","date_gmt":"2020-10-17T12:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/minimizacziya-riskov-ispolzovaniya-dns-over-tls-dot-i-dns-over-https-doh"},"modified":"2020-10-17T14:42:14","modified_gmt":"2020-10-17T12:42:14","slug":"minimizacziya-riskov-ispolzovaniya-dns-over-tls-dot-i-dns-over-https-doh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/minimizacziya-riskov-ispolzovaniya-dns-over-tls-dot-i-dns-over-https-doh","title":{"rendered":"Minimizimi i rreziqeve t\u00eb p\u00ebrdorimit t\u00eb DNS-over-TLS (DoT) dhe DNS-over-HTTPS (DoH)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"MinimizimiMinimizimi i rreziqeve t\u00eb p\u00ebrdorimit t\u00eb DoH dhe DoT<\/p>\n

Mbrojtja nga DoH dhe DoT<\/h2>\n

A kontrolloni trafikun tuaj DNS? Organizatat investojn\u00eb shum\u00eb koh\u00eb, para dhe p\u00ebrpjekje n\u00eb sigurimin e rrjeteve t\u00eb tyre. Megjithat\u00eb, nj\u00eb nga fushat q\u00eb shpesh nuk merret me r\u00ebnd\u00ebsi t\u00eb duhur \u00ebsht\u00eb DNS. <\/p>\n

Nj\u00eb p\u00ebrmbledhje e mir\u00eb e rreziqeve q\u00eb sjell DNS \u00ebsht\u00eb prezantimi i Verisign<\/a><\/noindex> n\u00eb konferenc\u00ebn Infosecurity. <\/p>\n

\"Minimizimi31% e klasave t\u00eb anketuara t\u00eb malware-it p\u00ebrdor\u00ebn DNS p\u00ebr shk\u00ebmbimin e \u00e7el\u00ebsave. Konkluzionet e hulumtimit<\/p>\n

31% e klasave t\u00eb anketuara t\u00eb malware-it p\u00ebrdor\u00ebn DNS p\u00ebr shk\u00ebmbimin e \u00e7el\u00ebsave.<\/p>\n

Problemi \u00ebsht\u00eb serioz. Sipas laboratorit hulumtues Palo Alto Networks Unit 42, rreth 85% e malware-it p\u00ebrdorin DNS p\u00ebr t\u00eb vendosur nj\u00eb kanal menaxhimi dhe kontrolli, duke lejuar sulmuesit t\u00eb futur me leht\u00ebsi malware n\u00eb rrjetin tuaj dhe gjithashtu t\u00eb vjedhin t\u00eb dh\u00ebna. Q\u00eb nga krijimi i tij, trafik DNS ka qen\u00eb kryesisht i paenkriptuar dhe leht\u00ebsisht i analizuesh\u00ebm nga mekanizmat mbrojt\u00ebse NGFW. <\/p>\n

Kan\u00eb dal\u00eb protokolle t\u00eb reja p\u00ebr DNS, t\u00eb dizajnuara p\u00ebr t\u00eb p\u00ebrmir\u00ebsuar intimitetin e lidhjeve DNS. Ato mb\u00ebshteten aktive nga ofruesit kryesor\u00eb t\u00eb shfletuesve dhe ofrues t\u00eb tjer\u00eb t\u00eb softuerit. Shpejt n\u00eb rrjetet e korporatave do t\u00eb filloj\u00eb rritja e trafikut DNS t\u00eb enkriptuar. Trafiku i enkriptuar DNS q\u00eb nuk analizohet si\u00e7 duhet dhe i lejuar p\u00ebrb\u00ebn nj\u00eb k\u00ebrc\u00ebnim sigurie p\u00ebr kompanin\u00eb. P\u00ebr shembull, nj\u00eb k\u00ebrc\u00ebnim t\u00eb till\u00eb p\u00ebrb\u00ebjn\u00eb kriptoloker\u00ebt, t\u00eb cil\u00ebt p\u00ebrdorin DNS p\u00ebr exchange t\u00eb \u00e7el\u00ebsave t\u00eb enkriptimit. Sulmuesit tani k\u00ebrkojn\u00eb nj\u00eb shp\u00ebrblim prej disa milion dollar\u00ebsh p\u00ebr rikthimin e aksesit n\u00eb t\u00eb dh\u00ebnat tuaja. N\u00eb kompanin\u00eb Garmin, p\u00ebr shembull, u paguan 10 milion dollar\u00eb.<\/p>\n

Me konfigurimin e duhur, NGFW mund t\u00eb ndalojn\u00eb ose mbrojn\u00eb p\u00ebrdorimin e DNS-over-TLS (DoT) dhe mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb ndaluar p\u00ebrdorimin e DNS-over-HTTPS (DoH), duke lejuar analizimin e gjith\u00eb trafikut DNS n\u00eb rrjetin tuaj.<\/p>\n

\u00c7far\u00eb \u00ebsht\u00eb DNS e enkriptuar?<\/h2>\n

\u00c7far\u00eb \u00ebsht\u00eb DNS<\/p>\n

Sistemi i emrave t\u00eb domeleve (DNS) shnd\u00ebrron emrat e domeleve t\u00eb lexuesh\u00ebm nga njeriu (p\u00ebr shembull, adresa www.paloaltonetworks.com<\/a><\/noindex> ) n\u00eb IP-adresa (p.sh., n\u00eb 34.107.151.202). Kur p\u00ebrdoruesi shkruan nj\u00eb em\u00ebr domeni n\u00eb shfletuesin e uebit, shfletuesi d\u00ebrgon nj\u00eb k\u00ebrkes\u00eb DNS n\u00eb serverin DNS, duke k\u00ebrkuar IP-n\u00eb q\u00eb lidhet me k\u00ebt\u00eb em\u00ebr domeni. N\u00eb p\u00ebrgjigje, serveri DNS kthen IP-n\u00eb q\u00eb do t\u00eb p\u00ebrdor\u00eb ky shfletues.<\/p>\n

K\u00ebrkesat dhe p\u00ebrgjigjet DNS d\u00ebrgohen n\u00eb rrjet si tekst t\u00eb thjesht\u00eb n\u00eb form\u00eb t\u00eb pakriptuar, \u00e7ka e b\u00ebn at\u00eb t\u00eb ndjesh\u00ebm ndaj spiunazhit ose ndryshimeve n\u00eb p\u00ebrgjigje dhe p\u00ebr\u00e7ues nga shfletuesi n\u00eb server\u00eb t\u00eb d\u00ebmsh\u00ebm. Kriptimi DNS e b\u00ebn m\u00eb t\u00eb v\u00ebshtir\u00eb ndjekjen e k\u00ebrkesave DNS ose ndryshimin e tyre gjat\u00eb transmetimit. Kriptimi i k\u00ebrkesave dhe p\u00ebrgjigjeve DNS ju mbron nga sulmet Man-in-the-Middle, duke ruajtur funksionet e nj\u00ebjt\u00eb q\u00eb ka protokolli tradicional DNS (sistemi i emrave t\u00eb domen\u00ebve) n\u00eb tekst t\u00eb hapur. <\/p>\n

Gjat\u00eb disa viteve t\u00eb fundit jan\u00eb implementuar dy protokolle t\u00eb kriptimit DNS:<\/p>\n

    \n
  1. \n

    DNS-over-HTTPS (DoH)<\/p>\n<\/li>\n

  2. \n

    DNS-over-TLS (DoT) <\/p>\n<\/li>\n<\/ol>\n

    K\u00ebta protokoll\u00eb kan\u00eb nj\u00eb ve\u00e7ori t\u00eb p\u00ebrbashk\u00ebt: q\u00ebllimisht fshehin k\u00ebrkesat DNS nga \u00e7do kapje\u2026 duke p\u00ebrfshir\u00eb edhe nga siguria e organizat\u00ebs. Protokoll\u00ebt kryesisht p\u00ebrdorin protokollin TLS (Transport Layer Security) p\u00ebr t\u00eb vendosur nj\u00eb lidhje t\u00eb enkriptuar midis klientit, i cili b\u00ebn k\u00ebrkesa, dhe serverit, i cili zgjidh k\u00ebrkesat DNS, p\u00ebrmes nj\u00eb porte q\u00eb zakonisht nuk p\u00ebrdoret p\u00ebr trafikun DNS.<\/p>\n

    Privat\u00ebsia e k\u00ebrkesave DNS \u00ebsht\u00eb nj\u00eb p\u00ebrfitim i madh i k\u00ebtyre protokolleve. Megjithat\u00eb, ato krijojn\u00eb probleme p\u00ebr siguruesit q\u00eb duhet t\u00eb ndjekin trafikun e rrjetit dhe t\u00eb zbulojn\u00eb dhe bllokojn\u00eb lidhjet e d\u00ebmshme. Duke qen\u00eb se protokollet ndryshojn\u00eb n\u00eb implementim, metodat e analiz\u00ebs do t\u00eb jen\u00eb t\u00eb ndryshme p\u00ebr DoH dhe DoT.<\/p>\n

    DNS over HTTPS (DoH)<\/h2>\n

    \"MinimizimiDNS brenda HTTPS<\/p>\n

    DoH p\u00ebrdor portin e njohur 443 p\u00ebr HTTPS, p\u00ebr t\u00eb cilin n\u00eb RFC \u00ebsht\u00eb specifikuar se q\u00ebllimi \u00ebsht\u00eb \"t\u00eb p\u00ebrzihet trafiku DoH me trafikun tjet\u00ebr HTTPS n\u00eb t\u00eb nj\u00ebjt\u00ebn lidhje\", \"t\u00eb v\u00ebshtir\u00ebsohet analizimi i trafikut DNS\" dhe, n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, t\u00eb anashkalohen masat e kontrollit korporativ ( RFC 8484 DoH, seksioni 8.1<\/a><\/noindex> ). Protokolli DoH p\u00ebrdor kriptimin TLS dhe sintaks\u00ebn e k\u00ebrkesave t\u00eb ofruar nga standardet e zakonshme HTTPS dhe HTTP\/2, duke shtuar k\u00ebrkesat dhe p\u00ebrgjigjet DNS mbi k\u00ebrkesat standarde HTTP.<\/p>\n

    Rreziqet q\u00eb lidhen me DoH<\/h2>\n

    N\u00ebse nuk mund t\u00eb dalloni trafikun e zakonsh\u00ebm HTTPS nga k\u00ebrkesat DoH, aplikacionet brenda organizat\u00ebs suaj mund (dhe do) t\u00eb anashkalojn\u00eb cil\u00ebsimet lokale DNS, duke drejtuar k\u00ebrkesat n\u00eb server\u00eb t\u00eb jasht\u00ebm q\u00eb p\u00ebrgjigjen p\u00ebr k\u00ebrkesat DoH, duke anashkaluar \u00e7do monitorim, p\u00ebrkat\u00ebsisht duke shkat\u00ebrruar mund\u00ebsin\u00eb e kontrollit mbi trafikun DNS. N\u00eb m\u00ebnyr\u00eb ideale, duhet t\u00eb kontrolloni DoH duke p\u00ebrdorur funksionet e dekriptimit t\u00eb HTTPS. <\/p>\n

    DHE Google dhe Mozilla kan\u00eb implementuar mund\u00ebsi DoH<\/a><\/noindex> n\u00eb versionin e fundit t\u00eb shfletuesve t\u00eb tyre, dhe t\u00eb dy kompanit\u00eb po punojn\u00eb p\u00ebr t\u00eb p\u00ebrdorur DoH si parazgjedhje p\u00ebr t\u00eb gjith\u00eb k\u00ebrkesat DNS. Microsoft gjithashtu po zhvillon plane<\/a><\/noindex> p\u00ebr integrimin e DoH n\u00eb sistemet e saj operative. Nj\u00eb penges\u00eb \u00ebsht\u00eb se jo vet\u00ebm kompanit\u00eb e respektuara t\u00eb zhvilluesve t\u00eb softuerit, por edhe keqb\u00ebr\u00ebsit kan\u00eb filluar t\u00eb p\u00ebrdorin DoH si nj\u00eb mjet p\u00ebr t\u00eb anashkaluar masat tradicionale t\u00eb firewall-it n\u00eb korporat\u00eb. ( P\u00ebr shembull, shikoni artikujt e m\u00ebposht\u00ebm: PsiXBot tani p\u00ebrdor Google DoH<\/a><\/noindex> , PsiXBot vazhdon t\u00eb zhvillohet me nj\u00eb infrastruktur\u00eb t\u00eb azhurnuar DNS<\/a><\/noindex> dhe analiza e backdoor-it Godlua<\/a><\/noindex> .) N\u00eb \u00e7do rast, si trafiku i mir\u00eb, ashtu edhe ai i d\u00ebmsh\u00ebm DoH do t\u00eb mbesin t\u00eb pap\u00ebrfillsh\u00ebm, duke l\u00ebn\u00eb organizat\u00ebn t\u00eb verbuar ndaj p\u00ebrdorimit t\u00eb keq t\u00eb DoH si nj\u00eb kanal p\u00ebr menaxhimin e malware-it (C2) dhe vjedhjen e t\u00eb dh\u00ebnave t\u00eb ndjeshme.<\/p>\n

    Sigurimi i dukshm\u00ebris\u00eb dhe kontrollit t\u00eb trafikut DoH<\/h2>\n

    Si zgjidhja m\u00eb e mir\u00eb p\u00ebr kontrollin e DoH ne rekomandojm\u00eb t\u00eb konfiguroni dekriptimin e trafikut HTTPS dhe bllokimin e trafikut DoH n\u00eb NGFW (emri i aplikacionit: dns-over-https). <\/p>\n

    S\u00eb pari, sigurohuni q\u00eb NGFW t\u00eb jet\u00eb i konfiguruar p\u00ebr dekriptimin e HTTPS, sipas udh\u00ebzimeve p\u00ebr metodologjin\u00eb m\u00eb t\u00eb mir\u00eb t\u00eb dekriptimit<\/a><\/noindex>.<\/p>\n

    S\u00eb dyti, krijoni nj\u00eb rregull p\u00ebr trafikun e aplikacionit 'dns-over-https', si\u00e7 \u00ebsht\u00eb treguar m\u00eb posht\u00eb:<\/p>\n

    \"MinimizimiRregulli NGFW i Palo Alto Networks p\u00ebr t\u00eb bllokuar DNS-over-HTTPS<\/p>\n

    Si alternativ\u00eb e p\u00ebrkohshme (n\u00ebse organizata juaj nuk ka implementuar plot\u00ebsisht dekriptimin e HTTPS), NGFW mund t\u00eb konfigurohet p\u00ebr t\u00eb aplikuar veprimin 'ndalo' p\u00ebr identifikimin e aplikacionit 'dns-over-https', por efekti do t\u00eb jet\u00eb i kufizuar n\u00eb bllokimin e server\u00ebve t\u00eb njohur DoH sipas emrit t\u00eb tyre t\u00eb domain-it, pasi pa dekriptimin e HTTPS, trafiku DoH nuk mund t\u00eb verifikohet n\u00eb t\u00ebr\u00ebsi (shih.  Applipedia nga Palo Alto Networks<\/a><\/noindex>   dhe k\u00ebrkoni p\u00ebr fraz\u00ebn 'dns-over-https').<\/p>\n

    DNS mbi TLS (DoT)<\/h2>\n

    \"MinimizimiDNS brenda TLS<\/p>\n

    Nd\u00ebrsa protokolli DoH p\u00ebrpiqet t\u00eb p\u00ebrzihet me trafik tjet\u00ebr n\u00eb t\u00eb nj\u00ebjtin port, DoT p\u00ebrdor n\u00eb vend t\u00eb saj p\u00ebr her\u00eb t\u00eb par\u00eb nj\u00eb port t\u00eb ve\u00e7ant\u00eb, t\u00eb rezervuar p\u00ebr k\u00ebt\u00eb q\u00ebllim t\u00eb vet\u00ebm, duke ndaluar madje p\u00ebrdorimin e t\u00eb nj\u00ebjtit port p\u00ebr trafikun tradicional t\u00eb pap\u00ebrcjell\u00eb DNS ( RFC 7858, Seksioni 3.1<\/a><\/noindex> ).<\/p>\n

    Protokolli DoT p\u00ebrdor protokollin TLS p\u00ebr t\u00eb siguruar enkriptimin, i cili inkapsulon k\u00ebrkesat standarde t\u00eb protokollit DNS, me trafik q\u00eb p\u00ebrdor portin e njohur 853 ( RFC 7858, seksioni 6<\/a><\/noindex> ). Protokolli DoT u zhvillua p\u00ebr t\u00eb leht\u00ebsuar organizatat t\u00eb bllokojn\u00eb trafikun p\u00ebrmes portit, ose t\u00eb pranojn\u00eb p\u00ebrdorimin e tij, por t\u00eb aktivizojn\u00eb dekodimin n\u00eb k\u00ebt\u00eb port.<\/p>\n

    Rreziqet q\u00eb lidhen me DoT<\/h2>\n

    Google implementoi DoT n\u00eb klientin e tij Android 9 Pie dhe versionet e m\u00ebvonshme<\/a><\/noindex> , me k\u00ebt\u00eb parametrin p\u00ebr nj\u00eb p\u00ebrdorim automatik t\u00eb DoT aktivizuar si parazgjedhje, n\u00ebse \u00ebsht\u00eb i disponuesh\u00ebm. N\u00ebse keni vler\u00ebsuar rreziqet dhe jeni t\u00eb gatsh\u00ebm t\u00eb p\u00ebrdorni DoT n\u00eb nivel organizate, at\u00ebher\u00eb administrator\u00ebt e rrjetit duhet t\u00eb lejojn\u00eb qart\u00eb trafikun e dalsh\u00ebm n\u00eb portin 853 p\u00ebrmes p\u00ebrimetrin e tyre p\u00ebr k\u00ebt\u00eb protokoll t\u00eb ri.<\/p>\n

    Sigurimi i shikueshm\u00ebris\u00eb dhe kontrollit t\u00eb trafikut DoT<\/h2>\n

    Si nj\u00eb praktik\u00eb m\u00eb e mir\u00eb p\u00ebr kontrollin e DoT ne rekomandojm\u00eb ndonj\u00eb nga t\u00eb m\u00ebposhtmet, n\u00eb var\u00ebsi t\u00eb k\u00ebrkesave t\u00eb organizat\u00ebs tuaj:<\/p>\n