針對互聯(lián)網緩存和CDN的攻擊

1、針對互聯(lián)網緩存和CDN的攻擊目錄HTTP/HTTPS協(xié)議及中間節(jié)點透明緩存的污染攻擊繞過加密協(xié)議HTTPS的攻擊針對CDN的拒絕服務攻擊結論1HTTP最初的設計與應用場景HTTP設計之初是端到端的協(xié)議網絡只是傳輸轉發(fā)的透明管道沒有身份認證、保密性、完整性保護網絡攻擊者：假冒、竊聽、注入、重放GET /path/urlHTTP/假冒、竊聽、 重放、注入攻擊者HTTPS： 認證、加密、完整性HTTPS: HTTP/SSL 或HTTP/TLSWeb 服務器的標識與認證內容的保密性（Confidentiality）內容的完整性（Integrity）攻擊者2中間盒子的興起與HTTPS同步發(fā)展起來的還有各

2、種中間盒子HTTP 客戶端代理、防病毒軟件、廣告軟件等服務器端代理、負載均衡設備透明緩存和CDN服務協(xié)議轉換設備，v4-v6CDNIDS/IPSNAT可以通過攻破中間網絡竊聽 通信、注入惡意代碼通過攻擊中間節(jié)點阻止通信目錄HTTP/HTTPS協(xié)議及中間節(jié)點透明緩存的污染攻擊繞過加密協(xié)議HTTPS的攻擊針對CDN的拒絕服務攻擊結論3標準的歧義Cache or ProxiesCDNGET nonhttp:/ Host: Host: 多個 Host headers8ClientGET / HTTP/1.1Host: Host: GET / HTTP/1.1Host: Host: Downstream

3、 Host: Upstream Host: HTTP standard(HTTP/1.1)RFC 2616(superseded standard), implicitly requires rejection.RFC 7230(latest standard), explicitly requires rejection.4各種主流的HTTP實現(xiàn)9實現(xiàn)處理方式實現(xiàn)處理方式實現(xiàn)處理方式ServerApacheConcatenateCDNAkamaiFirstFirewallBitdefenderFirstIISRejectAlibabaFirstESETLastNginxFirstAzureR

4、ejectHuaweiFirstTomcatFirstCloudFlareFirstKasperskyFirstTransparent cacheATSFirstCloudFrontFirstOS XConcatenateSquidFirstFastlyRejectPANFirstReverse ProxyNginxFirstLevel 3FirstWindowsFirstVarnishRejectTencentLast主流的HTTP實現(xiàn)各不相同幾乎所有的實現(xiàn)都不遵守 RFC723010優(yōu)先選擇不認識的協(xié)議RFC 2616Absolute-URINot specifiedRFC 7230Abs

5、olute-URINot specified標準規(guī)定絕對路徑優(yōu)先，然而現(xiàn)實中HTTP 標準規(guī)定：主流的CDN實現(xiàn)中，大多數實現(xiàn)遵守了RFC最大的CDN廠商Akamai不遵守，但世界35%流量5NSA.GOV緩存污染攻擊(CCS 2016)Cache/ProxyCDNHTTP Request:GET http:/NSA.GOV/path HTTP/1.1 Host: ATTACKER.comMiddle box Confused: NSA or ATTACKER ?如何攻破 NSA.GOV126可能被攻擊的場景（上下游組合）13202 different combinations that co

6、uld be exploited.影響到的產品/系統(tǒng)14798% 緩存服務器可能受到攻擊通過購買廣告， 把Flash 代碼 展示在世界各 地的瀏覽器上15目錄HTTP/HTTPS協(xié)議及中間節(jié)點透明緩存的污染攻擊繞過加密協(xié)議HTTPS的攻擊針對CDN的拒絕服務攻擊結論8CDN已成為互聯(lián)網重要的基礎設施全球 ，根據最大的CDN廠商Akamai統(tǒng)計：全球Web流量的15-30%每秒30T每天2萬億次交互200,000服務器、100國家中國，根據工信部CDN白皮書2014統(tǒng)計Alexa排名前100：91%，Alexa排名前546：72.5%工作原理：基于域名的重定向CDNDelegationUser

7、BrowserWebsite9銀行也在用CDNWhen HTTPS Meets CDN從兩方通信變成了三方通信我們可以看到前端使用了HTTPS，但是后端呢？UserWebsiteCDNFrontendBackend10HTTPS in CDN的安全問題(Security&Privacy14)UserCDNWebsite后端HTTP或不安全的HTTPS前端HTTPSCDNProvider后端協(xié)議CDN77HTTPCDN.NETHTTPCloudFlareHTTPS, not validate certificateIncapsulaHTTPS, not validate certificateC

8、loudFrontHTTPS, not validate CNApple & Akamai 受攻擊事件,2014/4/1511來自工業(yè)界的反饋Akamai/ CloudFlare/Amazon等積極反饋CloudFlare 在1個月內推出Strict SSL 服務/introducing-strict-ssl-protecting-against-a-man-in-the- middle-attack-on-origin-traffic12TLS還有很多中間人BrowserwebsiteCA1TLS劫持 代理CDNTLS 會話1TLS 會話2TLS 會話3CA2CA313目錄HTTP/HTTP

9、S協(xié)議及中間節(jié)點透明緩存的污染攻擊繞過加密協(xié)議HTTPS的攻擊針對CDN的拒絕服務攻擊結論28CDN的功能分擔負載、降低延遲安全過濾(WAF), 提高可用性(anti-DDoS)ClientWebsiteCDN1429CDN的功能分擔負載、降低延遲安全過濾(WAF), 提高可用性(anti-DDoS)ClientAttackerWebsiteCDN30CDN的功能分擔負載、降低延遲安全過濾(WAF), 提高可用性(anti-DDoS)CDN 本身也是可以被 攻擊的ClientAttackerWebsiteCDN15正常的CDN轉發(fā)流程31POST /Host: POST /Host: CDN

10、AClientWebsite D正常用戶 - D用戶控制著CDN轉發(fā)規(guī)則轉發(fā)循環(huán)攻擊的概念32CDN ACDN BCDN CPOSTPOSTPOST - BPOST /Host: - C - AAttacker惡意用戶Malicious customers can manipulate forwarding rules to create loopAmplification - consume resource - potentially DoS16受到影響的CDN廠商BaiduCDN內部采用的循環(huán)檢測機制Current DefensesUse headers to tag processed

11、 requestsAttackerExtends forwarding loops across multiplecountermeasureCDNsCDN A2CDN A3POST /Host:Header: Loop-Detection-Tag - AttackerPOST /Host:IP of A2Authority DNS CDN A117CDN內部采用的循環(huán)檢測機制Current DefensesUse headers to tag processed requestsAttackerExtends forwarding loops across multiplecounterme

12、asureCDNsCDN A2CDN A3POST /Host: Header: Loop-Detection- Tag - AttackerPOST /Host:IP of A2Authority DNS CDN A1不同廠商用于循環(huán)檢測的Header是不一樣的RFC 7230 recommends to use Via header for loopdetectionCDN ProviderLoop Detection HeaderCDNProviderLoop Detection HeaderAkamaiAkamai-Origin- HopCloudFlareX-Forwarded-Fo

13、r CF-Connecting-IPAlibabaViaCloudFrontViaAzure(China)FastlyFastly-FFBaiduX-Forwarded-For CF-Connecting- IPIncapsulaIncap-Proxy-IDCDN77KeyCDNCDNlionLevel3ViaCDN.netMaxCDNCDNsunTencentX-Daa-Tunnel1837如何繞過CDN的循環(huán)檢測Chain loop-aware CDNs to other CDNs that can be abused to disrupt loop-detection headersAb

14、usive features provided by CDNs:CDN ProviderResetFilterCDN77ViaCDNlionViaCDN.netViaCDNsunViaFastlyNo-self-definedMaxCDNAny跨多個CDN廠商的循環(huán)38POST /Host:CloudFrontPOST /Host: Via: 1.1 abcd (CloudFront)POST /Host: Via: 1.1 abcd (CloudFront)Akamai-Origin-Hop:1AkamaiPOST /Host: Via: 1.1 abcd(CloudFront) Akama

15、i-Origin-Hop:1Filter rules: 1.Remove Via2.Remove Akamai-Origin-HopMaxCDNAttacker19大壩攻擊(Dam Flooding): streaming 中增加響應39Attackers website DCDN ACDN BCDN C - A - CPOST - POSTAttackerIIPP ooff DBAuthority DNS 增加gzip炸彈增強Streaming的效果CDN BCDN CAuthority DNS - A - C - POST /Host:Accept-Encoding:identityGzip bombAttackers websiteCDN AUnzip3 CDNs can be used to uncompress gzip bombsTotal Amplification Factor = Loop Amplification * Gzip Bomb Amplification(