{"id":8608,"date":"2018-03-01T14:05:50","date_gmt":"2018-03-01T07:05:50","guid":{"rendered":"http:\/\/ttud.com.vn\/?p=8608"},"modified":"2018-03-15T08:19:41","modified_gmt":"2018-03-15T01:19:41","slug":"hacker-tim-ra-cach-khuech-dai-suc-manh-cac-cuoc-tan-cong-ddos-len-hon-51-000-lan-manh-nhat-lich-su-nho-phuong-thuc-moi","status":"publish","type":"post","link":"https:\/\/casta.ttud.com.vn\/index.php\/hacker-tim-ra-cach-khuech-dai-suc-manh-cac-cuoc-tan-cong-ddos-len-hon-51-000-lan-manh-nhat-lich-su-nho-phuong-thuc-moi\/","title":{"rendered":"Hacker t\u00ecm ra c\u00e1ch khu\u1ebfch \u0111\u1ea1i s\u1ee9c m\u1ea1nh c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng DDos l\u00ean h\u01a1n 51.000 l\u1ea7n, m\u1ea1nh nh\u1ea5t l\u1ecbch s\u1eed nh\u1edd ph\u01b0\u01a1ng th\u1ee9c m\u1edbi"},"content":{"rendered":"
\n
Nh\u00f3m tin t\u1eb7c \u0111\u00e3 l\u1ee3i d\u1ee5ng \u201cmemcached\u201d \u0111\u00e3 th\u1ef1c hi\u1ec7n cu\u1ed9c t\u1ea5n c\u00f4ng khu\u1ebfch \u0111\u1ea1i v\u1edbi c\u01b0\u1eddng \u0111\u1ed9 l\u1edbn l\u00ean t\u1edbi 51000 l\u1ea7n.<\/div>\n
<\/div>\n
\"\"<\/div>\n<\/div>\n

M\u1edbi \u0111\u00e2y, nh\u00f3m tin t\u1eb7c \u0111\u00e3 t\u00ecm ra c\u00e1ch th\u1ee9c khu\u1ebfch \u0111\u1ea1i s\u1ee9c m\u1ea1nh m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 (DDoS) l\u00ean 51.000 l\u1ea7n so v\u1edbi s\u1ee9c m\u1ea1nh ban \u0111\u1ea7u v\u00e0 nhi\u1ec1u chuy\u00ean gia tin r\u1eb1ng nh\u00f3m tin t\u1eb7c s\u1ebd s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt t\u1ea5n c\u00f4ng n\u00e0y \u0111\u1ec3 t\u1ea5n c\u00f4ng l\u00ean c\u00e1c trang web v\u00e0 c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng internet trong th\u1eddi gian t\u1edbi.<\/p>\n

Nh\u00f3m tin t\u1eb7c \u0111\u00e3 t\u0103ng c\u01b0\u1eddng t\u1ea5n c\u00f4ng c\u1ee7a h\u1ecd b\u1eb1ng c\u00e1ch g\u1eedi m\u1ed9t s\u1ed1 l\u01b0\u1ee3ng nh\u1ecf d\u1eef li\u1ec7u \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1eb7c bi\u1ec7t t\u1edbi c\u00e1c d\u1ecbch v\u1ee5 c\u00f4ng c\u1ed9ng. Nh\u1eefng d\u1ecbch v\u1ee5 n\u00e0y ngay l\u1eadp t\u1ee9c g\u1eedi tr\u1ea3 l\u1ea1i m\u1ed9t l\u01b0\u1ee3ng l\u1edbn d\u1eef li\u1ec7u kh\u00f4ng mong mu\u1ed1n \u0111\u1ebfn m\u1ee5c ti\u00eau. Ki\u1ec3u t\u1ea5n c\u00f4ng t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 khu\u1ebfch \u0111\u1ea1i n\u00e0y \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi c\u00e1c ph\u01b0\u01a1ng th\u1ee9c t\u1ea5n c\u00f4ng nh\u01b0 g\u1eedi d\u1eef li\u1ec7u t\u1edbi m\u00e1y ch\u1ee7 c\u1ea5u h\u00ecnh y\u1ebfu nh\u01b0 DNS ( khu\u1ebfch \u0111\u1ea1i 50 l\u1ea7n), NTP (khu\u1ebfch \u0111\u1ea1i 58 l\u1ea7n).<\/p>\n

\n
\"<\/div>\n
\n

C\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a t\u1ea5n c\u00f4ng DDoS d\u1ea1ng khu\u1ebfch t\u00e1n<\/p>\n<\/div>\n<\/div>\n

V\u00e0o h\u00f4m th\u1ee9 ba, chuy\u00ean gia \u0111\u00e3 ph\u00e1t hi\u1ec7n ra nh\u00f3m tin t\u1eb7c th\u1ef1c hi\u1ec7n m\u1ed9t ph\u01b0\u01a1ng th\u1ee9c t\u1ea5n c\u00f4ng m\u1edbi c\u00f3 kh\u1ea3 n\u0103ng khu\u1ebfch \u0111\u1ea1i t\u1ea5n c\u00f4ng l\u00ean t\u1edbi 51,000 l\u1ea7n so v\u1edbi k\u00edch th\u01b0\u1edbc ban \u0111\u1ea7u v\u00e0 \u0111\u00e2y l\u00e0 ph\u01b0\u01a1ng th\u1ee9c t\u1ea5n c\u00f4ng khu\u1ebfch \u0111\u1ea1i \u0111\u1ea1t \u0111\u01b0\u1ee3c hi\u1ec7u qu\u1ea3 l\u1edbn nh\u1ea5t trong l\u1ecbch s\u1eed. Ph\u01b0\u01a1ng th\u1ee9c t\u1ea5n c\u00f4ng l\u1ea7n n\u00e0y l\u1ee3i d\u1ee5ng memcached, m\u1ed9t h\u1ec7 th\u1ed1ng c\u01a1 s\u1edf d\u1eef li\u1ec7u l\u01b0u tr\u1eef t\u1ea1m d\u00f9ng \u0111\u1ec3 t\u0103ng t\u1ed1c \u0111\u1ed9 truy xu\u1ea5t d\u1eef li\u1ec7u. Trong tu\u1ea7n v\u1eeba qua, nh\u00f3m tin t\u1eb7c \u0111\u00e3 b\u1eaft \u0111\u1ea7u s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt n\u00e0y \u0111\u1ec3 tri\u1ec3n khai m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng v\u1edbi kh\u1ed1i l\u01b0\u1ee3ng 500 gigabit\/s v\u00e0 d\u1ecbch v\u1ee5 Arbor Networks \u0111\u00e3 ghi nh\u1eadn l\u1ea1i \u0111\u01b0\u1ee3c\u00a0cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y<\/a>.<\/p>\n

C\u00e1c chuy\u00ean gia t\u1ea1i Cloudflare CDN cho bi\u1ebft cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y xu\u1ea5t ph\u00e1t t\u1eeb g\u1ea7n 6000 m\u00e1y ch\u1ee7 memcached \u0111\u01b0\u1ee3c t\u00ecm th\u1ea5y tr\u00ean internet. Tuy nhi\u00ean, chuy\u00ean gia Cloudflare cho bi\u1ebft tr\u00ean th\u1ebf gi\u1edbi c\u00f3 h\u01a1n 88,000 m\u00e1y ch\u1ee7 t\u01b0\u01a1ng t\u1ef1 v\u00e0 ti\u1ec1m l\u1ef1c t\u1ea5n c\u00f4ng c\u1ee7a ph\u01b0\u01a1ng th\u1ee9c n\u00e0y c\u00f2n l\u1edbn h\u01a1n r\u1ea5t nhi\u1ec1u so v\u1edbi cu\u1ed9c t\u1ea5n c\u00f4ng v\u1eeba ghi nh\u1eadn \u0111\u01b0\u1ee3c.<\/p>\n

Johnathan Azaria, chuy\u00ean gia nghi\u00ean c\u1ee9u b\u1ea3o m\u1eadt d\u1ecbch v\u1ee5 ph\u00f2ng ch\u1ed1ng t\u1ea5n c\u00f4ng DDoS c\u1ee7a Imperva \u01b0\u1edbc t\u00ednh \u0111\u1ed9 ph\u00f3ng \u0111\u1ea1i l\u00e0 9000 l\u1ea7n cho memcached v\u00e0 557 l\u1ea7n cho NTP. Ngo\u00e0i ra, \u01b0\u1edbc t\u00ednh s\u1ed1 l\u01b0\u1ee3ng c\u00e1c m\u00e1y ch\u1ee7 memcached c\u00f3 s\u1eb5n tr\u00ean internet ch\u1ea1y c\u1ed5ng 11211 l\u00e0 93,000 m\u00e1y ch\u1ee7. M\u1eb7c d\u00f9 \u0111\u00e3 s\u1eed d\u1ee5ng c\u00e1c s\u1ed1 li\u1ec7u kh\u00e1c nhau, nh\u01b0ng con s\u1ed1 v\u1ec1 m\u00e1y ch\u1ee7 memcached v\u00e0 ti\u1ec1m l\u1ef1c c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng v\u1eabn l\u1edbn ch\u01b0a t\u1eebng th\u1ea5y.<\/p>\n

H\u1eb3n nhi\u1ec1u ng\u01b0\u1eddi v\u1eabn ch\u01b0a qu\u00ean v\u1ee5 t\u1ea5n c\u00f4ng t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 l\u1edbn nh\u1ea5t x\u1ea3y ra v\u00e0o n\u0103m 2016 v\u1edbi kh\u1ed1i l\u01b0\u1ee3ng l\u00ean t\u1edbi 620 Gpbs t\u1ea5n c\u00f4ng v\u00e0o KrebsOnSecurity v\u00e0 901 Gbps \u0111\u1ebfn 1.1 Tbps v\u00e0o nh\u00e0 m\u1ea1ng OVH c\u1ee7a Ph\u00e1p. Nh\u1eefng cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n b\u1edfi m\u1ed9t h\u1ec7 th\u1ed1ng botnet t\u01b0\u01a1ng \u0111\u1ed1i m\u1edbi v\u1edbi c\u00e1c con bot \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t tr\u00ean h\u00e0ng tr\u0103m ng\u00e0n b\u1ed9 \u0111\u1ecbnh tuy\u1ebfn gia \u0111\u00ecnh v\u00e0 c\u00e1c thi\u1ebft b\u1ecb internet kh\u00e1c.<\/p>\n

B\u00c0I H\u1eccC C\u0168 T\u1eea T\u1ea4N C\u00d4NG T\u1eea CH\u1ed0I D\u1ecaCH V\u1ee4<\/strong><\/p>\n

Ph\u01b0\u01a1ng ph\u00e1p t\u1ea5n c\u00f4ng khu\u1ebfch \u0111\u1ea1i t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 s\u1eed d\u1ee5ng m\u00e1y ch\u1ee7 memcached \u0111\u00e3 \u0111\u1ea1t \u0111\u01b0\u1ee3c hi\u1ec7u n\u0103ng kh\u1ed5ng l\u1ed3 khi kh\u00f4ng c\u1ea7n ph\u1ea3i s\u1eed d\u1ee5ng s\u1ed1 l\u01b0\u1ee3ng botnet qu\u00e1 nhi\u1ec1u. B\u00ean c\u1ea1nh \u0111\u00f3, c\u00e1c m\u00e1y ch\u1ee7 memcached th\u01b0\u1eddng c\u00f3 r\u1ea5t nhi\u1ec1u b\u0103ng th\u00f4ng n\u00ean c\u00e0ng l\u00e0m t\u0103ng th\u00eam hi\u1ec7u qu\u1ea3 cho cu\u1ed9c t\u1ea5n c\u00f4ng.<\/p>\n

Nguy\u00ean nh\u00e2n x\u1ea3y ra cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y l\u00e0 do c\u00e1c m\u00e1y ch\u1ee7 memcached k\u1ebft n\u1ed1i v\u1edbi internet theo c\u1ea5u h\u00ecnh m\u1eb7c \u0111\u1ecbnh. Th\u00f4ng t\u01b0\u1eddng, nh\u1eefng m\u00e1y ch\u1ee7 memcached n\u00e0y ch\u1ec9 n\u00ean s\u1eed d\u1ee5ng trong h\u1ec7 th\u1ed1ng m\u1ea1ng c\u1ee5c b\u1ed9 v\u00e0 c\u1ea7n ph\u1ea3i b\u1ea3o v\u1ec7 ch\u00fang b\u1eb1ng t\u01b0\u1eddng l\u1eeda. Cho \u0111\u1ebfn nay, c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng \u0111\u01b0\u1ee3c ghi nh\u1eadn t\u1eeb h\u01a1n 5.700 \u0111\u1ecba ch\u1ec9 IP v\u00e0 ch\u1ee7 y\u1ebfu \u0111\u1ebfn t\u1eeb B\u1eafc M\u1ef9 v\u00e0 Ch\u00e2u \u00c2u.<\/p>\n

\n
\"<\/div>\n
\n

B\u1ea3n \u0111\u1ed3 ph\u00e2n b\u1ed1 IP ngu\u1ed3n s\u1eed d\u1ee5ng \u0111\u1ec3 t\u1ea5n c\u00f4ng trong cu\u1ed9c DDoS \u0111\u01b0\u1ee3c ghi nh\u1eadn<\/p>\n<\/div>\n<\/div>\n

B\u1eb1ng c\u00f4ng c\u1ee5 Shodan ch\u00fang ta c\u00f3 th\u1ec3 th\u1ea5y \u0111\u01b0\u1ee3c s\u1ed1 l\u01b0\u1ee3ng m\u00e1y ch\u1ee7 c\u00f3 tr\u00ean internet l\u00ean t\u1edbi h\u01a1n 88.000 m\u00e1y ch\u1ee7 v\u00e0 h\u1ea7u h\u1ebft nh\u1eefng m\u00e1y ch\u1ee7 n\u00e0y \u0111\u1ec1u c\u00f3 c\u01a1 ch\u1ebf b\u1ea3o m\u1eadt k\u00e9m.<\/p>\n

\n
\n
<\/div>\n<\/div>\n<\/div>\n
\n
\"<\/div>\n
\n

Top c\u00e1c m\u00e1y ch\u1ee7 memcached \u0111\u01b0\u1ee3c t\u00ecm th\u1ea5y tr\u00ean internet<\/p>\n<\/div>\n<\/div>\n

\u0110\u1ec3 khai th\u00e1c ti\u1ec1m n\u0103ng t\u1ea5n c\u00f4ng t\u1eeb m\u00e1y ch\u1ee7, nh\u00f3m tin t\u1eb7c g\u1eedi m\u1ed9t s\u1ed1 l\u01b0\u1ee3ng nh\u1ecf g\u00f3i tin UDP \u0111\u01b0\u1ee3c gi\u1ea3 m\u1ea1o \u0111\u1ecba ch\u1ec9 g\u1eedi l\u00e0 \u0111\u1ecba ch\u1ec9 IP m\u1ee5c ti\u00eau. C\u00e1c m\u00e1y ch\u1ee7 memcached tr\u1ea3 l\u1eddi b\u1eb1ng c\u00e1ch g\u1eedi s\u1ed1 l\u01b0\u1ee3ng l\u1edbn g\u00f3i tin tr\u1ea3 v\u1ec1 \u0111\u1ecba ch\u1ec9 IP m\u1ee5c ti\u00eau.<\/p>\n

Hi\u1ec7n t\u1ea1i, Cloudflare \u0111ang t\u01b0 v\u1ea5n cho c\u00e1c nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 m\u1ea1ng tri\u1ec3n khai m\u00e1y ch\u1ee7 memcached \u0111\u1ec3 v\u00f4 hi\u1ec7u h\u00f3a t\u00ednh n\u0103ng h\u1ed7 tr\u1ee3 UDP. Trong nhi\u1ec1u tr\u01b0\u1eddng h\u1ee3p, ng\u01b0\u1eddi d\u00f9ng ch\u1ec9 c\u1ea7n s\u1eed d\u1ee5ng giao th\u1ee9c TCP l\u00e0 \u0111\u1ee7. Trong khi \u0111\u00f3, Arbor Network khuy\u1ebfn c\u00e1o c\u00e1c ISP ph\u1ea3i th\u1ef1c hi\u1ec7n c\u00e1c ch\u00ednh s\u00e1ch truy c\u1eadp ph\u00f9 h\u1ee3p khi c\u1ea5m g\u1eedi d\u1eef li\u1ec7u b\u1eb1ng g\u00f3i tin UDP ho\u1eb7c TCP qua c\u1ed5ng 11211 tr\u00ean m\u00e1y ch\u1ee7 t\u1eeb internet. \u0110\u1eb7c bi\u1ec7t, c\u00e1c m\u00e1y ch\u1ee7 memcached c\u1ea7n ph\u1ea3i \u0111\u01b0\u1ee3c tri\u1ec3n khai t\u01b0\u1eddng l\u1eeda b\u1ea3o v\u1ec7 t\u1eeb internet.<\/p>\n

Theo ArsTechnica<\/i><\/p>\n

Ngu\u1ed3n GenK<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Nh\u00f3m tin t\u1eb7c \u0111\u00e3 l\u1ee3i d\u1ee5ng \u201cmemcached\u201d \u0111\u00e3 th\u1ef1c hi\u1ec7n cu\u1ed9c t\u1ea5n c\u00f4ng khu\u1ebfch \u0111\u1ea1i v\u1edbi c\u01b0\u1eddng \u0111\u1ed9 l\u1edbn l\u00ean t\u1edbi 51000 l\u1ea7n. M\u1edbi \u0111\u00e2y, nh\u00f3m tin t\u1eb7c \u0111\u00e3 t\u00ecm ra c\u00e1ch th\u1ee9c khu\u1ebfch \u0111\u1ea1i s\u1ee9c m\u1ea1nh m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 (DDoS) l\u00ean 51.000 l\u1ea7n so v\u1edbi s\u1ee9c m\u1ea1nh ban \u0111\u1ea7u […]<\/p>\n","protected":false},"author":18,"featured_media":8609,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[47],"tags":[],"class_list":["post-8608","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc"],"_links":{"self":[{"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/posts\/8608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/comments?post=8608"}],"version-history":[{"count":2,"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/posts\/8608\/revisions"}],"predecessor-version":[{"id":8876,"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/posts\/8608\/revisions\/8876"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/media\/8609"}],"wp:attachment":[{"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/media?parent=8608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/categories?post=8608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/casta.ttud.com.vn\/index.php\/wp-json\/wp\/v2\/tags?post=8608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}