TÌM HIỂU TẤN CÔNG HEARTBLEED






Giáo viên hướng dẫn: KS. Nguyễn Văn Nghị
Nhóm thực hiện :
Lớp :
Hà Nội, tháng 3 năm 2015
Nhóm 6 – Tìm hiểu tấn công HeartBleed
 !"#
2
Nhóm 6 – Tìm hiểu tấn công HeartBleed
$$
3
Nhóm 6 – Tìm hiểu tấn công HeartBleed
$%
4
Nhóm 6 – Tìm hiểu tấn công HeartBleed
&'(

 !"#$%&% '()*
)&!+,$-"#%& &/&-0
1 $/23 +4-$56%$7
 &'$)*)&5#0 )8-90$5(
): 3 /;:8-(+4%</ 
-=&72(>2%:$/23 - /1
$+
?9>2%:$9:<@%&$
A-2>2$): (-5#0 8
-0$5(): B(+C-2("D)8>'

EFF,-9<(5 /1&&2(-
"D)8'@%&: 3 2+G-): 5"H-@%&
(;-9-2>2";&+I 0(JK)-@-1&
“Tìm hiểu tấn công heartbleed” )thầy Nguyễn Văn Nghị )L+M') 
N-O(OP!Q
)*+,-.-)/0,1234)*+,-4)5467,18,-)9:;6<=99>?@A<B-/:A6)21
CCDC.R!&/: !(0$>)%&>'E
FF,SC,F
)*+,-.@/EF6?@6)G1)/H,67,18,-9:;6=99>.R!&/7
>&/%0-1!>2%1&-=%&;:0$TU)+
5
6
IJ.#KLIJL"L
M
KCCDC
NONO7,18,-9:;6=99>
1.1.1. Tấn công OpenSSL dựa trên lỗ hỗng Heartbleed
T>))V&W(X( Y&'Z%1>2<
%:<@)@ O[\FF,%:&/-"D)8'
@-9(9E>2< /12]C,F^+,Z
.&/&53 2N%: &595DK
_['>C,F+C_>& O6
NZ.>)+,Z.&/`-6!0/
-$><Q5N(/N5"%&<
5a N"D)8+M1 !3 >2< /
-@-2>(%&%0>2<-6%3 2V:
6%1Z&/+
1.1.2. Quá trình phát hiện
C_['T>(EC,F%&4C,F&'
>'  a-$289bcRdePf$>6%&(P_

PfgP+M`)*)&59%&(W"6Y]%^(
5$>2<&5$2&h <Z
56+
M_Pfggb>F?4 "> ij""-@
(9  _ [  '  T>    >'   %: @   O [
\FF,+F 5F/  -_&/N7%&
\FF,/ N$-@-FM+T"'>6&
(9N\FF,&`-((+T"-@5$
(:Z3 (7(9NF%&-@--@
 O5$&:&/%&%:@ O[N\FF,%&
&/kg(gP_Pfgg+?@EZ.>2<&/-"D
)8'@>2\FF,g+f+g&/gl(k_PfgP+
C_>-5%&& /mm/(
>2\FF,EZ.>2<T>)+
M&%>2<N$/n-@$>6Z
.T>)%&&/g(l_Pfgl+,Z.&/5`Z
7
5DK>');:_['T>m/
+?6!9_o$-dlGUJ>'NE
)8%Z;:&>+
,Z.)'5p"$/R)'$/
Nq,-=-Oo%(X( +T-@0/
1&T>)+A2Z&/$+
1.1.3. Phương pháp tấn công và khai thác lỗ hổng
L)*+,-6)21)AP6EB,-1Q:6R,),S,-9:;6<9:66;0,C
T>&!-5-956C,FS4C,F]'
 a$:& '5-@
%&"%^&5$'5%7(N85
3 FF,SC,FE%&01 +C$-:T>b3 "
-DJ"%>O): r/%&-')&N)

: +F%<-$-:&/"H2D()
: /  ]7g+g^Q
Hình 1.1. Heartbeat request (dạng bình thường)
8
C$-:T>3 "0 " Q
struct {
HeartbeatMessageType type;
uint16 payload_length;
opaque payload[HeartbeatMessage.payload_length];
opaque padding[padding_length];
} HeartbeatMessage;
C0 &/7-')&): payload_length 6-&gdi>
")E&T>3 "9/  "%2):
  9      dlGU+  R  -1  &/  &   /  m  m/    Z  .
T>)+
+1)T4)56U/,)=V)W,-9:;6<=99>
,Z.&/->o OJ&tls1_process_heartbeat/dtls1
_process_heartbeat Es ssl/t1_lib.c %& ssl/dl_both.c N
%:\FF,+
M') N&Q
“dtls1_process_heartbeat/dtls1_process_heartbeat”:
int dtls1_process_heartbeat(SSL *s){
unsigned char *p = &s->s3->rrec.data[0], *pl;
unsigned short hbtype;
unsigned int payload;
unsigned int padding = 16; /* Use minimum padding */

/* Read type and payload length first */
hbtype = *p++;
n2s(p, payload);

pl = p;



if (hbtype == TLS1_HB_REQUEST)
9
{
unsigned char *buffer, *bp;
int r;
/* Allocate memory for the response, size is 1 byte
* message type, plus 2 bytes payload length, plus
* payload, plus padding
*/
buffer = OPENSSL_malloc(1 + 2 + payload + padding);
bp = buffer;
/* Enter response type, length and copy payload */
*bp++ = TLS1_HB_RESPONSE;
s2n(payload, bp);
memcpy(bp, pl, payload);
bp += payload;
/* Random padding */
RAND_pseudo_bytes(bp, padding);
r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
if (r >= 0 && s->msg_callback)
s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
buffer, 3 + payload + padding,
s, s->msg_callback_arg);
OPENSSL_free(buffer);
if (r < 0)
return r;

}
736;X1<Y,-)/1Q:CCDC.
typedef struct ssl3_record_st {
int type; /* type of record */
unsigned int length; /* How many bytes available */
unsigned int off; /* read/write offset into 'buf' */
unsigned char *data; /* pointer to the record data */
unsigned char *input; /* where the decode bytes are */
unsigned char *comp; /* only used with decompression - malloc()ed */
unsigned long epoch; /* epoch number, needed by DTLS1 */
unsigned char seq_num[8]; /* sequence number, needed by DTLS1 */
} SSL3_RECORD;
U2FF,%k&/>Ok&Qtypelength%&data+
GD"%$-:T>3 "Q&data
10
>2FF,%k&"%<-&): &T>3 "+
Rhp-)r>["%-9DK>2&/0 7=-V
"Hh>/- >2&/0 -$2" Q
F%  "H    &  D  K  /    %  -  )    &
dtls1_process_heartbeatQ
/* Read type and payload length first */
hbtype = *p++;
n2s(p, payload);
pl = p;
U)t:"H(>/- N>2FF,%k&T>/+
T&P""H0/P>/Jh%&-=%&/)+?m/&-')&
-5>(T>3 "]KA-')&&/>2
FF,%k5$-59r%-')&;NT>
)T>3 "/5$^+G3 2)t:Ek&h
"Hh%&&T>)-$2" Q

I`-)Q
unsigned char *buffer, *bp;
int r;
/* Allocate memory for the response, size is 1 byte
* message type, plus 2 bytes payload length, plus
* payload, plus padding
*/
buffer = OPENSSL_malloc(1 + 2 + payload + padding);
bp = buffer;
/* Enter response type, length and copy payload */
*bp++ = TLS1_HB_RESPONSE;
s2n(payload, bp);
memcpy(bp, pl, payload);
11
?)&/'2-'> ss/&0 N
T>""%&50&
g P deeke gd+ + +
+G-
h>-h%&> ss%&)r-9$%&> ss+U/
- -%&> ss"H&T>/QC,FguTUubjFq\MFj+
T&"P7%&P""H0/gd>(V/)-=%&
P>/"N> ssT&/]>/)^"H;:"
`(>//)J%&>]E&"`&>'T>)N
T>3 "^+
?1 7"H2/ -')&;NT>)5$>A
%-')&/)u-5>(T>3 "v
M /)u!7&/"H"`2)
: /" T>)>'--'N
7+
M%</59)rT>3 "%%:5-')&

payload _6-&dlGU"%790/-$
><>'-'N"%+?m/&Z.T>)
]7g+P^Q
12
Hình 1.2. Tấn công Heartbleed
)Z,-6)8,-6/,;[;\]3:=V)W,-
U'& payload T>3 "hB&>'
&\FF,)r-9 $><5(Q
• GN"%-"D)8')&+
• GC,F+
• 4: ><Q<5a +
• F""4])@/(V^+
M%</%0$$3 Z.T>)759
-$><&/+
13
1.6.4. Giải pháp khắc phục và ngăn chặn tấn công
/^_6;:EB>@/6)G16T1Q:9:;6<9:6>:6:]"D" )^
if (1 + 2 + 16 > s->s3->rrec.length)
return 0; /* silently discard */

if (1 + 2 + payload + 16 > s->s3->rrec.length)
return 0; /* silently discard per RFC 6520 sec. 4 */
`,-174=0,4)/0,<Y,_a/NObON-EcE*d1?5=V)W,-9:;6<=99>O
C_T>->." %&%:\FF,JfkSPfgP+
w7%</(>2\FF,JfkSPfgP-flSPfgl"H>V
2[J>2\FF,g+f+g-@-%(Z.Q
• \FF,g+f+gg+f+gs>V2[+
• \FF,g+f+g-@%(Z.5$>V2[+
• \FF,g+f+f%&(>2B!5$>V2[+
T>)5$2&Z.EFF,SC,F&&Z

<7%:@ O[\FF,+w7%</95x-V
AEFF,SC,F&5$>V(%y%&%L-&  a
%&%:@$-9 /1-((
N@>2<F/+C /!ddz{>"& "D
)8%:\FF,%&01 {>"-"D)8>2B
\FF,]J>2g+f+gg+f+gs^ /!>V0$5(
Z.T>)+R/  -=&($/<</
<E>20N\FF,&>2g+f+g-@-%(Z
.T>)="D)8>25$>V2[>[Z
.&/+
14
IJ.ef

,Z.T>)9-5(5V>25(
 Q0$)V%8{>&0$)V%8-:D&
=0$$7295>[1\wqM+
M') !&/7>&/%:&-=%&;:0$T>)
-90$)V%8{>&>O(') " Q
• $7&-=%&;:0$+
• R&-=(/N{>+
• R&-=(/+
• C;:0$5(Z.T>)+
gONO8)h,)1@/EF6?@6)G1)/H,67,18,-
T7P+g+$7&-=%&;:0$T>)
C7P+g(/N/:-1 &R\Fd+e-&-=>'
@ O[\FF,5$5Ief| 0)V%8{>
&]"^ %&4MF"%+(//:-1 &}){Iq
-&-=7) /:cs-9"D)8)V%8{>J(/N+(/&
15
-=  0  $  /  :  -1  &  }~  -  &  -=  $  8

OpenSSLHeartbleedExploit.exe-90$%&5($>
<>'b•N(/N+
gOgO@/EF6_5i1)Q
2.2.1. Thi@t lAp cấu hình mBng
C<0 7q€(/N}><ssi
f
#vi/etc/sysconfig/network-scripts/ifcfg-eth0
R!7;:" Q
DEVICE=eth0
HWADDR=00:0C:29:D3:EB:B0
TYPE=Ethernet
UUID=456dd9e1-1772-4cbf-ba0f-81c0710394e0
ONBOOT=yes
NM_CONTROLLED=yes
BOOTPROTO=none
IPADDR=192.168.2.10
NETMASK=255.255.255.0
DNS1=8.8.8.8
IPV6INIT=no
USERCTL=no
2.2.2. Thi@t lAp cấu hình dịch vụ DNS
C<0 7<)+s>A("D)8m :Q
#vi /etc/named.conf
R!7;:" Q
16
options {
listen-on port 53 { 192.168.2.10;127.0.0.1;};
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
C<0 7(<• <%&•V1
{{{+"+Q
• ‚ <test.db-5>(< /var/named/test.db" Q
17
$TTL 1D
@ IN SOA test.com. (
2014111301 ; serial

1D ; refresh
1H ; retry
1W ; expire
3H ); minimum
IN NS test.com.
IN A 192.168.2.10
www IN A 192.168.2.10
• ‚Vtest.nghich-5>(</var/named/test.nghich
" Q
$TTL 1D
@ IN SOA test.com. (
2014111301 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS test.com.
10 IN PTR test.com.
10 IN PTR www.test.com.
R0  7  &  -= name server   (/  N  }>    <  
/etc/resolv.confQ
nameserver 192.168.2.10
G[/)V%84MF>Am :service named start .
G9-'N)V%84MF-@&-=$3 m :Q
# nslookup test.com
Hình 2.2. Kiểm tra dịch vụ DNS
18
M%</)V%84MF-@-&-=&$+
2.2.3. Thi@t lAp Web site chFa lỗ hổng bảo mAt heartbleed
C8E{>"Q

#mkdir /var/www/html/web
C$  3   $  8 vi   (    {>   index.php,
authenticate.php, backend.php, database.php, process.php, logout.php 
8/var/www/html/web+M') ({>&/88g+
G9("")u""-@-&-=(/N{>
>A(m :" Q
#rpm –qa | grep ‘openssl’
#rpm –qa | grep ‘mod_ssl’
Hình 2.3. Kiểm tra các gói cài đặt openssl và mod_ssl
M%</(/N{>-@-&"ƒ(""%&)u""+
n""-&-=[-m/&>2g+f+g)Z.>2<
T>)+
C5$5bF•Pfl„>(/N{>>Am :Q
#openssl genrsa –des3 –out ca.key 2048
Hình 2.4. Tạo khóa công khai cho máy chủ web
19
C'RsFb3 "]RFb^5%"%5/%J
>Am :Q
#openssl req –new –key ca.key –out ca.csr
Hình 2.5. Tạo chứng chỉ số tự ký
C'EX"6RsQnD<+"-R•-5K
…")" 5-5K%&2%1<"H['++?=
EX-@@%&!&r%!E5+
#openssl x509 –in ca.csr –out ca.cert –req –signkey ca.key –days 365
Hình 2.6. Tạo một chứng chỉ số được ký bởi CA trong hạ tầng khóa công khai
X509
20
RX"D</etc/httpd/conf/httpd.conf
NameVirtualHost 192.168.2.10
<VirtualHost 192.168.2.10>

ServerAdmin
DocumentRoot /var/www/html/web
ServerName www.test.com
ErrorLog logs/test.error
CustomLog logs/test.log combined
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/ca.crt
SSLCertificateKeyFile /etc/pki/tls/private/ca.key
</VirtualHost>
RX"D</etc/httpd/conf.d/ssl.conf
DocumentRoot "/var/www/html/web"
ServerName *:443
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/ca.crt
SSLCertificateKeyFile /etc/pki/tls/private/ca.key
G[-')V%8>[:service httpd restart
G9    %:  &  -=  "  >A  %:   /  <  %&    {>Q

Hình 2.7. Giao diện trang web:
M0 '%&>9 5-VX-9>'@)r
-9>2%:- /1): Q
21
Hình 2.8. Tham số an toàn bảo vệ www.test.com
U0†w{Rs‡-9EX"6N(/N{>Q
Hình 2.9. Chứng chỉ số của máy chủ web www.test.com
22
2.2.4. Cài đặt cơ sở dữ liệu cho trang web www.test.com
?_<%&/Fˆ,F%>Am :Q
#mysql –u root –p
G-_<mysql"H/  )r-=<5a &52

root+‰-m/7&52root"H--=<5a &†123456’+
Hình 2.10. Đăng nhập vào MySQL Server
C!"[): test{>{{{+"+%&!"[)
: &/E'>2userE$)r>Ousername%&
password$3 (:Q
mysql>create database test;
mysql> use test;
mysql>create table users(id INT(10) UNSIGNED NOT NULL
AUTO_INCREMENT, username VARCHAR(200) NOT NULL, password
CHAR(200) NOT NULL, PRIMARY KEY(id));
R&  -=  $  8  3 2  K  q/•)+  C    &  -=
q/•)Q
#yum install phpmyadmin
q/•)  -  &  -=  &  $  5  -_  <  -  %&
"S/)7k+gf+ˆ (7-_<"H"D)8&
52root%&<5a &123456N/Fˆ,F%+
23
Hình 2.11. Cài đặt PhpMyAdmin thành công
C$')r‘trung’%<5a &‘123456’%&
>2userN!"[): test>Aq/•)+C8†"‡
N!"[): "&-1$)r7k+gg
†n‡-9&&+
Hình 2.12. Thêm người dùng vào cơ sở dữ liệu
24
G6!"[): Q:7{{{+"+5$
3 7(!"[): /Fˆ,F%+w7%</-9{{{+"+
"D)8-!"[): "/Fˆ,F%72'
56&/var/www/html/database.php') " Q
<?php
////////// Database Connection ///////////

// MySQL information MODIFY IT HERE.
$db_name = "test"; // Database Name
$host = "localhost"; // Database host (probably won't change)
$db_user = "root"; // Database username
$db_password = "123456"; // Database password
$dbconnect = mysql_connect("$host", "$db_user", "$db_password");
// Database Connection DON'T MODIFY
if (!$dbconnect) {
echo( "<p>Unable to connect to the database server at this time.</p>");
exit();
}
if (! mysql_select_db("$db_name") ) {
echo( "<p>Unable to locate the database at this time.</p>");
exit();
}
?>
G[/)V%8/"3>Am :service mysqld restart+G9
%:56!"[): >A( /<"QSS{{{+"+%&
-_<%username &†trung’%&password&†123456’+
25