{"id":120072,"date":"2024-10-07T13:09:25","date_gmt":"2024-10-07T11:09:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah"},"modified":"2024-10-07T13:09:25","modified_gmt":"2024-10-07T11:09:25","slug":"uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","title":{"rendered":"En s\u00e5rbarhet i CUPS har visat sig vara anv\u00e4ndbar f\u00f6r att \u00f6ka trafik vid DDoS-attacker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Gruppen som ansvarar f\u00f6r s\u00e4kerheten f\u00f6r Akamais Content Delivery Network har identifierat en ytterligare attackvektor mot cups-browsed-processen, f\u00f6rutom att den anv\u00e4nds som en del av en exploatering som leder till kodexekvering i systemet. Genom att skicka f\u00f6rfr\u00e5gningar till cups-browsed-processen, som accepterar anslutningar utan begr\u00e4nsningar p\u00e5 port 631, kan data skickas till en annan v\u00e4rd, vars storlek kan \u00f6verstiga den ursprungliga f\u00f6rfr\u00e5gan med upp till 600 g\u00e5nger. F\u00f6r j\u00e4mf\u00f6relse kan f\u00f6rst\u00e4rkningsfaktorn f\u00f6r memcached n\u00e5 10-50 tusen g\u00e5nger, NTP \u2014 556 g\u00e5nger, DNS \u2014 28-54, RIPv2 \u2014 21, SNMPv2 \u2014 6. <\/p>\n

En s\u00e5dan funktion g\u00f6r att system med cups-browsed kan anv\u00e4ndas som trafikf\u00f6rst\u00e4rkare vid genomf\u00f6rande av DDoS-attacker. Angreppsmetoden med trafikf\u00f6rst\u00e4rkare bygger p\u00e5 att f\u00f6rfr\u00e5gningar fr\u00e5n datorer som deltar i DDoS-attacker inte riktas direkt mot m\u00e5lsystemet, utan via en mellanliggande trafikf\u00f6rst\u00e4rkare. Vid genomscanning av n\u00e4tverket har \u00f6ver 198 000 s\u00e5rbara system med CUPS identifierats, varav 34 % (58 000 system) visade sig vara l\u00e4mpliga f\u00f6r trafikf\u00f6rst\u00e4rkning i DDoS-attacker. <\/p>\n

Till skillnad fr\u00e5n metoder f\u00f6r trafikf\u00f6rst\u00e4rkning som kr\u00e4ver att UDP-paket skickas med en f\u00f6rfalskad returadress fr\u00e5n offret, g\u00f6r anv\u00e4ndningen av cups-browsed det m\u00f6jligt att avst\u00e5 fr\u00e5n spoofing. Cerves cups-browsed har en inbyggd m\u00f6jliget att ladda PPD-filer fr\u00e5n en godtycklig servern<\/a> som svar p\u00e5 en oauktoriserad extern f\u00f6rfr\u00e5gan, d\u00e4r klienten \u00f6verf\u00f6r en URL och cups-browsed f\u00f6rs\u00f6ker ladda PPD-filen fr\u00e5n den angivna servern. <\/p>\n

Genom att skicka en f\u00f6rfr\u00e5gan om att ladda ner en PPD-fil i cups-browsed kan man uppn\u00e5 en bifogning till v\u00e4rdet \u00abIPP URI\u00bb med ett extra fyllnadsv\u00e4rde som kan n\u00e5 upp till 989 byte. Vidare dupliceras v\u00e4rdet \u00abIPP URI\u00bb i den initierade cups-browsed-f\u00f6rfr\u00e5gan \u2014 en g\u00e5ng i HTTP-huvudet och en g\u00e5ng i kroppen av POST-f\u00f6rfr\u00e5gan, och f\u00f6rfr\u00e5gningarna upprepas cykliskt efter misslyckade f\u00f6rs\u00f6k att ladda ner och \u00e5terv\u00e4nda. servern<\/a> 404 kod f\u00f6r fel. <\/p>\n

I 62 % (35900) av de granskade systemen skickade cups-browsed minst 10 TCP\/IPP\/HTTP-f\u00f6rfr\u00e5gningar till det attackerade systemet som svar p\u00e5 en enda ursprunglig UDP-f\u00f6rfr\u00e5gan. I genomsnitt f\u00f6r 58000 s\u00e5rbara system var antalet upprepade f\u00f6rfr\u00e5gningar 45. I ett optimalt scenario kommer avs\u00e4ndningen av en enstaka 30-byte ursprunglig f\u00f6rfr\u00e5gan vid 45 \u00e5terkommande f\u00f6rs\u00f6k att resultera i att 18000 byte data skickas till m\u00e5lsystemet, vilket inneb\u00e4r en trafikf\u00f6rst\u00e4rkning p\u00e5 600 g\u00e5nger. I det s\u00e4msta scenariot \u00e4r f\u00f6rst\u00e4rkningen 108 g\u00e5nger. <\/p>\n

Det kan ocks\u00e5 noteras att f\u00f6retaget Cloudflare reflekterade en rekordstor DDoS-attack, d\u00e4r en str\u00f6m p\u00e5 3,8 terabitar per sekund (2,14 miljarder paket per sekund) riktades mot offrets system. Det rapporteras att attacken organiserades med hj\u00e4lp av ett stort antal komprometterade hemroutrar fr\u00e5n Asus och Mikrotik, samt DVR-enheter och webbservrar som hackades bland annat med hj\u00e4lp av relativt f\u00e4rska s\u00e5rbarheter.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0430\u044f \u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Akamai, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 cups-browsed, \u043f\u043e\u043c\u0438\u043c\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0432\u0435\u043d\u044c\u0435\u0432 \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u043c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0427\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 cups-browsed, \u0431\u0435\u0437 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u044e\u0449\u0435\u043c\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043d\u0430 631 \u043f\u043e\u0440\u0442\u0443, \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u0445\u043e\u0441\u0442, \u0440\u0430\u0437\u043c\u0435\u0440 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0435\u0432\u044b\u0448\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120072","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarheten i CUPS visade sig vara anv\u00e4ndbar f\u00f6r trafikf\u00f6rst\u00e4rkning vid DDoS-attacker | ProHoster","description":"Gruppen som ansvarar f\u00f6r s\u00e4kerheten f\u00f6r Akamai's content delivery network har identifierat en ytterligare attackvektor mot cups-browsed-processen, f\u00f6rutom dess anv\u00e4ndning som en av l\u00e4nkarna i ett exploit som leder till.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 CUPS \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u0430 \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u0440\u0438 DDoS-\u0430\u0442\u0430\u043a\u0430\u0445 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0430\u044f \u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Akamai, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 cups-browsed, \u043f\u043e\u043c\u0438\u043c\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0432\u0435\u043d\u044c\u0435\u0432 \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0435, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u043c \u043a.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-cups-okazalas-prigodna-dlya-usileniya-trafika-pri-ddos-atakah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-10-07T11:09:25+00:00","article:modified_time":"2024-10-07T11:09:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120072","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:46:25","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 07:07:19","updated":"2026-02-22 15:46:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/120072","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=120072"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/120072\/revisions"}],"predecessor-version":[{"id":162469,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/120072\/revisions\/162469"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=120072"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=120072"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=120072"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}