CPDoS ื‘ืึทืคืึทืœืŸ ืฆื• ืžืึทื›ืŸ ื‘ืœืขื˜ืขืจ ืกืขืจื•ื•ื™ืจื˜ ื“ื•ืจืš CDN ืึทื ืึทื•ื•ื™ื™ืœืึทื‘ืึทืœ

ืจืขืกืขืึทืจื˜ืฉืขืจืก ืคื•ืŸ ื“ื™ ืื•ื ื™ื•ื•ืขืจืกื™ื˜ืขื˜ืŸ ืคื•ืŸ ื”ืึทืžื‘ื•ืจื’ ืื•ืŸ ืงืขืœืŸ
ื“ืขื•ื•ืขืœืึธืคึผืขื“ ืึท ื ื™ื™ึทืข ื‘ืึทืคืึทืœืŸ ื˜ืขื›ื ื™ืง ืื•ื™ืฃ ืื™ื ื”ืึทืœื˜ ืขืงืกืคึผืจืขืก ื ืขื˜ื•ื•ืึธืจืงืก ืื•ืŸ ืงืึทื˜ืฉื™ื ื’ ืคึผืจืึทืงืกื™ื– - CPDoS (Cache-Poisoned Denial-of-Service). ื“ื™ ืึทื˜ืึทืง ืึทืœืึทื•ื– ืึทืงืกืขืก ืฆื• ืึท ื‘ืœืึทื˜ ืฆื• ื–ื™ื™ืŸ ื’ืขืœื™ื™ืงื ื˜ ื“ื•ืจืš ืงืึทืฉ ืคืึทืจืกืึทืžื•ื ื’.

ื“ืขืจ ืคึผืจืึธื‘ืœืขื ืื™ื– ืจืขื›ื˜ ืฆื• ื“ืขื ืคืึทืงื˜ ืึทื– CDNs ืงืึทืฉ ื ื™ื˜ ื‘ืœื•ื™ื– ื”ืฆืœื—ื” ื’ืขืขื ื“ื™ืงื˜ ืจื™ืงื•ื•ืขืก, ืึธื‘ืขืจ ืื•ื™ืš ืกื™ื˜ื•ืึทื˜ื™ืึธื ืก ื•ื•ืขืŸ ื“ืขืจ ื”ื˜ื˜ืคึผ ืกืขืจื•ื•ืขืจ ืงืขืจื˜ ืึท ื˜ืขื•ืช. ื•ื•ื™ ืึท ื”ืขืจืฉืŸ, ืื•ื™ื‘ ืขืก ื–ืขื ืขืŸ ืคึผืจืึธื‘ืœืขืžืก ืžื™ื˜ ืคืึธืจืžื™ื ื’ ืจื™ืงื•ื•ืขืก, ื“ืขืจ ืกืขืจื•ื•ืขืจ ืึทืจื•ื™ืกื’ืขื‘ืŸ ืึท 400 (ืฉืœืขื›ื˜ ื‘ืขื˜ืŸ) ื˜ืขื•ืช; ื“ืขืจ ื‘ืœื•ื™ื– ื•ื™ืกื ืขื ืื™ื– IIS, ื•ื•ืึธืก ืึทืจื•ื™ืกื’ืขื‘ืŸ ืึท 404 (ื ื™ื˜ ื’ืขืคึฟื•ื ืขืŸ) ื˜ืขื•ืช ืคึฟืึทืจ ืฆื• ื’ืจื•ื™ืก ื›ืขื“ืขืจื–. ื“ืขืจ ืกื˜ืึทื ื“ืึทืจื˜ ื‘ืœื•ื™ื– ืึทืœืึทื•ื– ืขืจืจืึธืจืก ืžื™ื˜ ืงืึธื•ื“ื– 404 (ื ื™ื˜ ื’ืขืคึฟื•ื ืขืŸ), 405 (ืžื™ื˜ืœ ื ื™ื˜ ื“ืขืจืœื•ื™ื‘ื˜), 410 (ื ื™ื˜ืึธ) ืื•ืŸ 501 (ื ื™ื˜ ื™ืžืคึผืœืขืžืขื ื˜ืขื“) ืฆื• ื–ื™ื™ืŸ ืงืึทืฉื˜, ืึธื‘ืขืจ ืขื˜ืœืขื›ืข CDNs ืื•ื™ืš ืงืึทืฉ ืจืขืกืคึผืึธื ืกืขืก ืžื™ื˜ ืงืึธื“ 400 (ืฉืœืขื›ื˜ ื‘ืขื˜ืŸ), ื•ื•ืึธืก ื“ืขืคึผืขื ื“ืก. ืื•ื™ืฃ ื“ืขืจ ื’ืขืฉื™ืงื˜ ื‘ืงืฉื”.

ืึทื˜ืึทืงืขืจื– ืงืขื ืขืŸ ืึธื ืžืึทื›ืŸ ื“ื™ ืึธืจื™ื’ื™ื ืขืœ ืžื™ื˜ืœ ืฆื• ืฆื•ืจื™ืงืงื•ืžืขืŸ ืึท "400 ืฉืœืขื›ื˜ ื‘ืขื˜ืŸ" ื˜ืขื•ืช ื“ื•ืจืš ืฉื™ืงืŸ ืึท ื‘ืงืฉื” ืžื™ื˜ ื”ื˜ื˜ืคึผ ื›ืขื“ืขืจื– ืคืึธืจืžืึทื˜ื˜ืขื“ ืื™ืŸ ืึท ื–ื™ื›ืขืจ ื•ื•ืขื’. ื“ื™ ื›ืขื“ืขืจื– ื–ืขื ืขืŸ ื ื™ืฉื˜ ื’ืขื ื•ืžืขืŸ ืื™ืŸ ื—ืฉื‘ื•ืŸ ื“ื•ืจืš ื“ื™ CDN, ืึทื–ื•ื™ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ื™ื ืึทื‘ื™ืœื™ื˜ื™ ืฆื• ืึทืงืกืขืก ื“ื™ ื‘ืœืึทื˜ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืงืึทืฉื˜, ืื•ืŸ ืึทืœืข ืื ื“ืขืจืข ื’ื™ืœื˜ื™ืง ื‘ืึทื ื™ืฆืขืจ ืจื™ืงื•ื•ืขืก ืื™ื™ื“ืขืจ ื“ื™ ื˜ื™ื™ืžืึทื•ื˜ ื™ืงืกืคึผื™ื™ืขืจื– ืงืขืŸ ืจืขื–ื•ืœื˜ืึทื˜ ืื™ืŸ ืึท ื˜ืขื•ืช, ื˜ืจืึธืฅ ื“ืขืจ ืคืึทืงื˜ ืึทื– ื“ืขืจ ืึธืจื™ื’ื™ื ืขืœ ืคึผืœืึทืฅ ืกืขืจื•ื•ืขืก ื“ื™ ืื™ื ื”ืึทืœื˜ ืึธืŸ ืงื™ื™ืŸ ืคืจืื‘ืœืขืžืขืŸ.

ื“ืจื™ื™ ื‘ืึทืคืึทืœืŸ ืึธืคึผืฆื™ืขืก ื–ืขื ืขืŸ ืคืืจื’ืขืœื™ื™ื’ื˜ ืฆื• ืฆื•ื•ื™ื ื’ืขืŸ ื“ื™ ื”ื˜ื˜ืคึผ ืกืขืจื•ื•ืขืจ ืฆื• ืฆื•ืจื™ืงืงื•ืžืขืŸ ืึท ื˜ืขื•ืช:

  • HMO (HTTP ืžืขื˜ืึทื“ ืึธื•ื•ื•ืขืจืจื™ื™ื“) - ืึท ืึทื˜ืึทืงืขืจ ืงืขื ืขืŸ ืึธื•ื•ื•ืขืจืจื™ื™ื“ ื“ื™ ืึธืจื™ื’ื™ื ืขืœ ื‘ืขื˜ืŸ ืžืขื˜ืึทื“ ื“ื•ืจืš ื“ื™ "X-HTTP-Method-Override", "X-HTTP-Method" ืึธื“ืขืจ "X-Method-Override" ื›ืขื“ืขืจื–, ื’ืขืฉื˜ื™ืฆื˜ ื“ื•ืจืš ืขื˜ืœืขื›ืข ืกืขืจื•ื•ืขืจืก, ืึธื‘ืขืจ ื ื™ื˜ ื’ืขื ื•ืžืขืŸ ืื™ืŸ ื—ืฉื‘ื•ืŸ ืื™ืŸ ื“ื™ CDN. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืื™ืจ ืงืขื ืขืŸ ื˜ื•ื™ืฉืŸ ื“ื™ ืึธืจื™ื’ื™ื ืขืœ "GET" ืื•ืคึฟืŸ ืฆื• ื“ื™ "DELETE" ืื•ืคึฟืŸ, ื•ื•ืึธืก ืื™ื– ืคึผืจืึธื•ื›ื™ื‘ืึทื˜ืึทื“ ืื•ื™ืฃ ื“ื™ ืกืขืจื•ื•ืขืจ, ืึธื“ืขืจ ื“ื™ "POST" ืื•ืคึฟืŸ, ื•ื•ืึธืก ืื™ื– ื ื™ืฉื˜ ืึธื ื•ื•ืขื ื“ืœืขืš ืคึฟืึทืจ ืกื˜ืึทื˜ื™ืง;

    CPDoS ื‘ืึทืคืึทืœืŸ ืฆื• ืžืึทื›ืŸ ื‘ืœืขื˜ืขืจ ืกืขืจื•ื•ื™ืจื˜ ื“ื•ืจืš CDN ืึทื ืึทื•ื•ื™ื™ืœืึทื‘ืึทืœ

  • HHO (HTTP Header Oversize) - ืึท ืึทื˜ืึทืงืขืจ ืงืขื ืขืŸ ืื•ื™ืกืงืœื™ื™ึทื‘ืŸ ื“ื™ ื›ืขื“ืขืจ ื’ืจื™ื™ืก ืึทื–ื•ื™ ืึทื– ืขืก ื™ืงืกื™ื“ื– ื“ื™ ืฉื™ืขื•ืจ ืคื•ืŸ ื“ื™ ืžืงื•ืจ ืกืขืจื•ื•ืขืจ, ืึธื‘ืขืจ ืงืขืŸ ื ื™ืฉื˜ ืคืึทืœืŸ ืื™ืŸ ื“ื™ CDN ืจื™ืกื˜ืจื™ืงืฉืึทื ื–. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, Apache httpd ืœื™ืžืึทืฅ ื“ื™ ื›ืขื“ืขืจ ื’ืจื™ื™ืก ืฆื• 8 ืงื‘, ืื•ืŸ Amazon Cloudfront CDN ืึทืœืึทื•ื– ื›ืขื“ืขืจื– ืึทืจื•ื™ืฃ ืฆื• 20 ืงื‘;
    CPDoS ื‘ืึทืคืึทืœืŸ ืฆื• ืžืึทื›ืŸ ื‘ืœืขื˜ืขืจ ืกืขืจื•ื•ื™ืจื˜ ื“ื•ืจืš CDN ืึทื ืึทื•ื•ื™ื™ืœืึทื‘ืึทืœ

  • HMC (HTTP Meta Character) - ืึท ืึทื˜ืึทืงืขืจ ืงืขื ืขืŸ ืึทืจื™ื™ึทื ืœื™ื™ื’ืŸ ืกืคึผืขืฆื™ืขืœืข ืื•ืชื™ื•ืช ืื™ืŸ ื“ื™ ื‘ืขื˜ืŸ (\n, \r, \a), ื•ื•ืึธืก ื–ืขื ืขืŸ ื’ืขื”ืืœื˜ืŸ ืคืึทืจืงืจื™ืคึผืœื˜ ืื•ื™ืฃ ื“ื™ ืžืงื•ืจ ืกืขืจื•ื•ืขืจ, ืึธื‘ืขืจ ื–ืขื ืขืŸ ืื™ื’ื ืึธืจื™ืจื˜ ืื™ืŸ ื“ื™ CDN.

    CPDoS ื‘ืึทืคืึทืœืŸ ืฆื• ืžืึทื›ืŸ ื‘ืœืขื˜ืขืจ ืกืขืจื•ื•ื™ืจื˜ ื“ื•ืจืš CDN ืึทื ืึทื•ื•ื™ื™ืœืึทื‘ืึทืœ

ื“ื™ ืžืขืจืกื˜ ืกืึทืกืขืคึผื˜ืึทื‘ืึทืœ ืฆื• ื‘ืึทืคืึทืœืŸ ืื™ื– ื’ืขื•ื•ืขืŸ ื“ื™ CloudFront CDN ื’ืขื ื™ืฆื˜ ื“ื•ืจืš Amazon Web Services (AWS). ืึทืžืึทื–ืึธืŸ ื”ืื˜ ืื™ืฆื˜ ืคืึทืจืคืขืกื˜ื™ืงื˜ ื“ืขื ืคึผืจืึธื‘ืœืขื ื“ื•ืจืš ื“ื™ืกื™ื™ื‘ืึทืœื™ื ื’ ื˜ืขื•ืช ืงืึทื˜ืฉื™ื ื’, ืึธื‘ืขืจ ืขืก ื’ืขื ื•ืžืขืŸ ืจื™ืกืขืจื˜ืฉืขืจื– ืžืขืจ ื•ื•ื™ ื“ืจื™ื™ ื—ื“ืฉื™ื ืฆื• ืœื™ื™ื’ืŸ ืฉื•ืฅ. ื“ื™ ืึทืจื•ื™ืกื’ืขื‘ืŸ ืื•ื™ืš ืึทืคืขืงื˜ืึทื“ Cloudflare, Varnish, Akamai, CDN77 ืื•ืŸ
ื’ืขืฉื•ื•ื™ื ื“, ืึธื‘ืขืจ ื“ื™ ื‘ืึทืคืึทืœืŸ ื“ื•ืจืš ื–ื™ื™ ืื™ื– ืœื™ืžื™ื˜ืขื“ ืฆื• ืฆื™ืœ ืกืขืจื•ื•ืขืจืก ื•ื•ืึธืก ื ื•ืฆืŸ IIS, ASP.NET, ืงืึธืœื‘ืข ะธ ืฉืคึผื™ืœ 1. ืขืก ืื™ื– ื‘ืืžืขืจืงื˜, ืึทื– 11% ืคื•ืŸ ื™ื•. ืขืก. ื“ืขืคึผืึทืจื˜ืžืขื ื˜ ืคื•ืŸ ื“ื™ืคืขื ืก ื“ืึธื•ืžื™ื™ื ื–, 16% ืคื•ืŸ URL ืก ืคื•ืŸ ื“ื™ ื”ื˜ื˜ืคึผ ืึทืจื˜ืฉื™ื•ื•ืข ื“ืึทื˜ืึทื‘ื™ื™ืก ืื•ืŸ ื•ื•ืขื’ืŸ 30% ืคื•ืŸ ื“ื™ ืฉืคึผื™ืฅ 500 ื•ื•ืขื‘ืกื™ื˜ืขืก ืจืึทื ื’ืงื˜ ื“ื•ืจืš Alexa ืงืขืŸ ืคึผืึทื˜ืขื ื˜ืฉืึทืœื™ ื–ื™ื™ืŸ ืื•ื ื˜ืขืจื˜ืขื ื™ืง ืฆื• ื‘ืึทืคืึทืœืŸ.

ื•ื•ื™ ืึท ื•ื•ืึธืจืงืึทืจืึธื•ื ื“ ืฆื• ืคืึทืจืฉืคึผืึทืจืŸ ืึท ื‘ืึทืคืึทืœืŸ ืื•ื™ืฃ ื“ื™ ืคึผืœืึทืฅ ื–ื™ื™ึทื˜, ืื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ื“ื™ "Cache-Control: No-store" ื›ืขื“ืขืจ, ื•ื•ืึธืก ืคึผืจืึธื•ื›ื™ื‘ืึทืฅ ืขื ื˜ืคืขืจ ืงืึทื˜ืฉื™ื ื’. ืื™ืŸ ืขื˜ืœืขื›ืข CDNs, ืœืžืฉืœ.
CloudFront ืื•ืŸ Akamai, ืื™ืจ ืงืขื ืขืŸ ื“ื™ืกื™ื™ื‘ืึทืœ ื˜ืขื•ืช ืงืึทื˜ืฉื™ื ื’ ืื•ื™ืฃ ื“ื™ ืคึผืจืึธืคื™ืœ ืกืขื˜ื˜ื™ื ื’ืก ืžื“ืจื’ื”. ืคึฟืึทืจ ืฉื•ืฅ, ืื™ืจ ืงืขื ืขืŸ ืื•ื™ืš ื ื•ืฆืŸ ื•ื•ืขื‘ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืคื™ืจืขื•ื•ืึทืœืœืก (WAF, ื•ื•ืขื‘ ืึทืคึผืคึผืœื™ืงืึทื˜ื™ืึธืŸ ืคื™ืจืขื•ื•ืึทืœืœ), ืึธื‘ืขืจ ื–ื™ื™ ืžื•ื–ืŸ ื–ื™ื™ืŸ ื™ืžืคึผืœืึทืžืขื ืึทื“ ืื•ื™ืฃ ื“ื™ CDN ื–ื™ื™ึทื˜ ืื™ืŸ ืคืจืึธื ื˜ ืคื•ืŸ ื“ื™ ืงืึทื˜ืฉื™ื ื’ ืžื—ื ื•ืช.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’