安全研究
CVE-2023-31893 Vivo Play IPTV DNS 递归 DoS：从运营商固件看放大攻击
Thinking
2024-02-08
3 分钟阅读
研究档案
#漏洞分析#代码审计#网络攻击
Telefônica Brasil 旗下 Vivo Play IPTV 设备的 DNS 递归服务对公网开放，攻击者用 DDoS Ripper 类的放大工具就能把它打瘫。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9247686ce82236b0cc05eab1ae8ad061b7576f70f95833110a4aae064ecdeeefe457b7dc502ef8a9012b8262c541d3f8c04818e38e910f0f93e19ce3ef13e26b83af0c8af8c4a3bc0cbfaf1af36adc32172ddb5ba81dd0a0d8e7f0caf816b04694cd48f3e389e7b218ca1bbb5e4faa77c394d39e52906492915dbbb472c12a6fe0e3429d28579e50f7f33f726880c2113683486fee0e1eb18c5334ae770b2fdef7db4db3708973c662dcd2d562910d5a8eb7de8b2c6cef938e899d057249182b94d6c4e9053b9ccff1fb3df4d32dd78462fdc4dd429bdf4b14470827a829c130a7cc1be4708a21952cc7f9ea71df3227b1ca66afc5d94686a78754f271b74245e717616c0bb86d6120a70f6932a081a8b150ca595eef0f505c137b583c047674a5fd4acb8d424501e9f48d7e02a3162878f91f41c6da41c5d60ef8b373b805de994dc683f5be0aa84160c3a56b58fb7c0e6eb13cd822c2dbafd29427a8681d7b8e1b95919731eba10822a98a22659b78903d1ae56a59e07e488751e78390cafb5eb0dc5bdf5ebf4cbeb5cc013ad100a16fc33bf8e691805e5c6cb94989364234a985259b7d69068fc45e4e93bd0241b58340cd6891f71296a84d5b89fd90504258356ec6a98b74fc9dc14945cbb1f9699ea40953f2563aafdefe037b9bfb26d4b7ee2720ada33497cb9444a5c30d0c548e52c3d286f170f2a6c7a1eacd69b64cfe90b32b1783ca2719df1baab43c10ca06dbe1bf532004c7e937983ead11fb1d91c7a5a03cd32394747c770214b9bbe5f8ac773ab3210a079e5ff837c083041248a2039091721e59caee9065ca3ea98e85b2e2a0314b79050205b72bcfd0602bc264eb27ebce2b1c6598c33d38aafe4ec1ae665e4d2ef141a6df0380ef43a41042195fe949f8665c16b76f246b4cdce56674de0f6c0855ea59fa4f32c012d8cccbbae8055f928016b59afdf39152b69cb95e33df05709b5f1d6dd0844f4a8715445e94267174b6ae0301d936f7c62fa265048a774406422390584880008f75001d8b80e36c390861f2c6ac35c1368dc79421aeea6fe658c273a9eb5eea23daded762b19c06a5943d9f44c51a19ad349283fa49134226436b5e006c0c773b25315712816d312cff84d42d8a49ee3414993aa4f606a790aaadfd9623bdbf7835e77584ab4d6555e3844763924640b43553a03138a79ce1b94f8124a4b4ccd70cf4537db0376f60c94b6ceaaaf47122fc3f9a047848c7a410cc1610766f95d8a3c213c10402229d3b81453c067e16b2766403fbec0ae440c5956a94bd1ff35e618be49016f410080e0897bb5177217aacbd5a409def72e3f950bceba7cf0579a516153a345280925b20a84cfe79d23f193d2be81fe9148b36c18f71c9887e8a0830334c9decce292a246111fa1b602ecf5bf864578e5791cff2da60ba2f30eb30e31ce66686cd07659ba78b3b57774a4a074aca5f2423cd4d1245d92a802a7a1386c32962657912bcc60455626dd3c5063cd545969689796f46f4d44a8b6285d3506598c4707a5b4539a92de7c6f2ddd2fc1e02996af6dcdbf07f838aea51fcf5c8854749bcfbc4f9aa6a85c0fca9236a7f3bab58653bb563d92e42aa561f5d7d19b1e0cf4631cece83c569657e264929e14b351b60fa53b5d108c98577b436c0a6b75ac3128e309e562c27a8bbab5a6e4646d247da1a55c7c3fe3082d21e38b3f9af3150cb7d7e7b3e7d59e9dd2c24b9cc5f4331eeeea2899b23e1126ce7182d71a12e8159d02247ce11a2b9332afc9a3c2161859bd56e384869f9cbbe5397b87fdbd39b5c1584e68edf5e7742c6d3d69fd6ead47413cd06f3ac1f6cbcf16e46f29419d5203f1824a7a1b1fe3d2289950170760a6996a03e76d1a2a8cc47c6915986b98d3b36df89ecc3d9a64e27753237e9ef6d27c081729d42d0180ddeb78373b2f706ffe77fe13fb9f0b62e6ff23cefe728d040c5ef88784e436b1077c780d72422c14f9b48bf39ec8c6b0775fc4a8f0c144c2f51aa87cf398c60dd48f3b249aac6cd3e4c3e7c4184a4c41cc88b7a1245e10964d4095a3256e4243470daf74027cd0148552a5b45ab73645068dc106d4323eecce82d9bc4ca8e8f9a754b85c23ae466c7685442936b95d5bd08fa3dd196cd9a488e9e6e48709bc7fcbda8db9d66d9e7e610e573dc068b4a4ae5487e7dacf40093c1820db41e9625be1a07e6eb89ec2a44a423e5cdc00a8d17e677a393c6dcbb06f38f5ad3ffef22d8c65391926d942a33c6fa723f740b93f7b6eaa0db06f1ce6a3a8e9d8151ab1d34a5b362ce9b2893639e5f04316e3482bad54f2d3d449e20d3974d0d075d9ddacb33a0120bb88050f5e6886650280fd87608f9572d229950718ac50ea4132140f8e61f89c760e419fcfc67aed40143b6027d620e46c2055c47311525ab6de6082e9c8234a10f078d3fcbc33aab8d1c16053cde66de17e89671a70d2b1cbabdab3987a19c70ce3759b9e8d1bfd57d47a92b4f43c9d480a1eab110dc532d7ddbd6e5afde83ccfd8d7c74ec4cf0804984964df7d5d06356b77e9c3abc57de4b7617b5e35cb1857afd21241e45f9f1c8992881f6dbae8dc683b06917cdabaff9483953858fd19845eb3f2646e84764156f80a13074138fe13b6c20e6e8dbec88997a57ea7710d4091b0527669607d773a30cb8208f11f65e1ad1af113e6143f705b57e4097efff05289e0440fe59d961df4a1d74cedbb511b7a6db64550e45b9b0ea4d41e6b1cdfabbbbef6d76d54d9352b1ec66061b517261b35ade1756048d00246e66db29006ef1cd620831a999312c967339e27c2a94b96533ebe1fd0944165cb6103a18da120880bc61cd43ba45a75c9521497e452b0fce7052b7cc1217083684a8cdb2b85ad6382e22b0803aee29e2a284ea05fa5ea7b0d925dd7f2b7fd995d8986a09950d9c58c4a96a52def6ad443bdeb4d256578cc56da8a419d86dc8ed6a688cda7ff8527271ca4485dc63205b967bb0a983ccf4e508630f5b8e65222b1e09366a8879b23654be7ed484bea40b0544353e276c22fe58a603c93e8060802ab8c459a6689a78620aca9aaf3cd235f2deda46d186add8e07e2729aa4dbbd07381fa23eee111d27d7cf6a10fba6ef9cad16542082da4232d2af5ea7e587ef7d4e175293c6da9f63a9fbe6589f9f593f18fb811d08c125fb31b0e3b0ca10a573a4c3c881006cdb62b30f6c5561139b8c582b4d8d5dcd7f94466b53f3b829ee90d02946ee8273084e01e0dd87ed0c980b56acc80e00d83d9fdba76ed7e2aaa2bffaedd2aadd0dd7e35132e9e83175234e74012775d093ad9cfd8740710bbc7e4fb961eeafda7d9d2f2e3a8a350a0a3170a68af686c24fd47380e1aa09681a33f413828a0c60d3f00ba6a74b74f105a06338cf64f71219d741c778f87aefa6de1fb4a41751352caf9dc443f607492bef02e959075ba1b6808e3aa9957fa75bc3a17206eb6af4b4cae34b1985a6ef80fdbb9d00216f55b0cb848511390d20520ff82ede452598501eac2ff202ab0316680f64a653c719deaa686adbadccaa0c7272ab9f74b69b58ed7b246bedea862c53aea521f65e63bdfde149543544aa96d5f20c94c5dba733a939c1779c9a8e8359392820b4ab296c7663df8782897e122ce5187f790f3d5228ab648975686699eafe1c555a1b0d87ad85988aa3e13ec558297fa36a10f9f22a6786e9a71b77db29e34de0fddd8d323d8999e8eae24980e8d7cb3a25bc83724ef688132867fc66ef0e2d1f7ceb50e423f2b9cf468ac96f5019281ef7d8358715f7ec2e5c4e7afc20bb909999e754629238881f05aec886de17b58a732628f895520cc60ec472ceb7fc3b6a163a07f751869b878943c18bdc19831a83fe7609f226b3098080279214e2ff9598081291d6830059042ca6ed8d928ea8ae0b5758aeffea34cf4e9dbed4c59124e69ab95506d5612597005b27bafd77635716bf9dcff3dbfccd55cfcc85d5ec3651e1f054faad308f7119fb527cc3bd5c7dcfe00128a1293befd9c830368a2b46945b38408b72dea1c1a1175468711b6ddde7d00199a0bb7943ff471f5eb7193b0bf069e0ec2f0b236e6a65682d71bda98591b010eadc5e1b893261e8a68c991d42fdbcd6a967d38f41f34177910dbd042e61984b77b26db7142409df1a3403834b37f8fe0c03660e64e4bad7f9b9180c1af95c1f3b40030fc71f7ceb27c78e87480827d9e190211edb9465f36fa12dc1df159041831d50e77d5a4c0c7b2d6e882d96b75e7880232cefcfde8415aa27703d213672dcca0556fc7cf61286d0f822a634af0b230a4fa5f84c374aa6c45d645528bedd3e0d5569eef3fcd6d833d0f72b1aba025e0704cbc9bb0ed98ae80aaa1f32704a396d239eb859c78817d16d345b4e9592f5ffc9cb7fb7f7336d87285b840960b823a2c8d51936ba6c6500107d4b67169d647d3ed413ae56bbd05c330346efafeb5ca976de9056a2b278702062621e1ec5f500b2a476560f2258e41ddc073644b252171d8d4eedc51652636db898dce82bad8f35a45b7544bdff4e3b4841f0f2f72c818995f91b168c6619db5dbe9e6988da33b10c5cc0dab6e37a0e45264ba9d646895e3fd920733cbfe43730df8f6c65c23728d2a5e17fbc9137f0e78474d64b4468adf2456c05b2fbadc205304ac22c617c7208580617e395b2e720e9d28080726dda5531e75168fa26e7b86ebe8091e2888cdc801b417d3c79abbb0eb6dd1c93d0df94ec6996b26d84e547be1846148ae310ffa419893fcb4012b5876f01727b39a681788f26e3658811229c88d2dd2057a0d599388a83042b465b1104d7d7aa6ba79d96d4da38119dcfbd22710263bc6bc93b00d8fa9f41575e3a6df0cd258657285b499e7a853e0ca54d954de14932892aeaaec4afb15d2a9cf75178f7f946069c2fdea816095efb74f6b6d634088fde850b8fc22d4bc8ebe405c119dc2339f1f57c6b086dc203c531187067d2e8a0e273202b51dafd499d6f6371fc32cfa47136ac16b911408ee0a1481c866f6dc16bbb75485e6f77c2d4714fae4531889618b14a01a146198d9d7a6b29c7b553eccafcf190d2869dead79bfadd6055715374fa0abc2a3ae0c08fbd21ddd2cb09d3f12a90f51533abf9b25c3bf97d56c6c509cdae671f4056775664f031b3d898a1ffd027b3304a670488854b31acbe0395899b14c86e933cfd866ae0558804c5fba45064b54a0050575fa4e0025af6032a4943047558585903113e82be17a04f7480b69dc2a08c843afe7772cd44afcdd2bda3b0df0b9d3c34e4f964160a4da76a014728d6d87a1978e2de8baf3412d6b8903d6a86e947e7b9552bedf5f87b64489cbf496afb95190305acb145a2ad101314b3ea8ebbd18abecca6e8705c513264d82597510c7b951ee2277b3f39e9d0c566dea290980d483ab318c91d46cf2b058ef57f2e7a74e399d462bbd1bd3e000853ad21bcca163142c41282577afd5960a75ec59c26e9662a14647085d80fb4d7a5e30a5862ba519ab606e097d9f02f22a5472156ae4fc547248cadd567eaff8e11118e9e6ecb3944b5d4eed7a97ce9195ba7c284dc4d01c63981ff576517e573412b19caf351235730528baf7a2a06f1bcf9d10e2be702c65af968a5d43b97fb0c207d5752a784984ba7213f963cd29d02120427398f42ef53bcdbc8ccf55273c013ed0bd48f0998f4be9e6b40a07efab8cbbfc6cdd1b4be7808e788819c41c326bbba81de2fb3304e134245bc8cbaf54b18d389a94794b2bca17fbf3c688dc914b66991dc52c8598a92ed6cb4db8f97acdaed36a4b348702c19310238f8e3a622fd83b51a8421b8ea031443f67634251693560817cd825eaadb30083acde7e820199441b7329ef48fd037d2ba7f831a21b899387085fc8b8917be52357094bad02ac667bb1e1c50403e4384db786e53be2e7572535ab4da2cd8d2bd3d8918ad5d0d6b940a99750644910ed0054420acac58679b7b533298a24d157386bd7fce99a3f681a080e072bc4bd6bf9ed4e70bc55e94d4ff520024d416074dd214e286e6497d51efa5a66ebbfc251ad80bd5760254255d6bc43043be45ebbb4f62eac1acdaae56ac77f14eb51577e6a317bcd31c3d34b0fbd078c9948d1dcf68a5ce2563b6c41203d9086ad2bdcb83481ecffbedb8427821e75c10c9e8ba6420ceaad000454d496015caed8ac13fa1540d4723ad5b10e2df241166218a45ce9c4105a69f5dfb7b7f19944885b70b85e07b06ec6969f8eebc1145befaee2a49ddd68c8036870a8fa23bbcc31e107998e7f74989148b5c8bc558d27ee44ea10dcf4176785e30dbae2831a4e49bfed2cdff43c23cf38534f7adc29d0da64bcec2ed09ebf83774d9434dfb16c752ab5629b3b561d1582aed4c64824ee78e3dd3aab4f01b2b605b0509da3456dbda27b9ff91e60409047f79b54f22a9d3f87084fc2b5e32eb047ccb07adc8bd8deea48227a890b42304284d8a3a74abe7c4db721b40ecf59c7ce063a3968d07b7e5e2d2ab5c8ef86127ba802f358b0deb55966c4550c1edd88cc00ef1c508aa9affae7559cc732dc68d229d5e1022c5545485a8ce67c85d772091cd81942554b7a06c27cfb8b635dbd19cbb7c8aff734144c730cf2435f3654ee3906e8151bfac0f30f7024887e56cb1ca682b600d742ed2b667931b0014c3396edf0f67af183ca06be081f45a918dc47295e59a7ec20e9dc23e6d3eb135f548c6e419bfd282fa47d7dea929a63fe5bd4b290a97f7fa44730f30b8a217958dcb900bc448829dbf1b72698bda57a810c6e6f4c927da027d653939bfbf96a2931213461c30d86659fc14228afd9e594b1228db72fb2e06258ee7d04df2d6dc6059de6d45ea44ab26425bd3a95aa4ed8bf6982a27042be0e2f2276033f941904cb8734e228c677757474e3c90ee8f2a3e1e9fff4bfecf17ff169657491319b4c91fef1f68ae80cf476f17b2a7c40b05783c727f06dce565cb69bfca7486bf0b86d712fee6d680fbbbfa633e1df81a76b2c4520855ba72d12c47549e09e87e5aace648d8b7308d2614c88c6ac178804e025a87884d41aa62541f6ff6126781189e3def47f7b6b853446f2233d3848afd9ea2c26dc1dfd19fc1ca7082723bd647d83d3905b41faac44b907a8dee9312a222ae673c8204b8ffaf5ee5b0440b59972cf3291926d67af3ac73d7d130665fa2f1a339ed09c9fd91a91660d641e720c9ec7be728d1424e17b15104c6dc2a44d0e499be0195848b5dc534c9810f2b5685698c95e61200b9bbb5af92f33c0c43e1ced87f2d4abbe13b2ad50bf1e970aebc5993910a9410eae0a0e71662cf290ffbdaa9ea0d94db1f48dfbfd474d3509cd1f7bfd1417377b0757adf91233117e5aac0d4c89d1a8719d659592420bcffdabd7b295b8ba1766297c70ac364429e3464f85f7345cc5ecc73169e52a59521fd67ca3f1c4a369f4c7f0edb8a379533fab6d1f115380ae6bde73061a3de21e3a4ecda38e552497fefd9e48ad4fadbc5016d7d77b8885fab13432096d39929c87174e628f89983f0bffccd0e33ab1709503b823565f2bd776391ce67037d3000c5a90f1ed74ee035faf5b93a93e279d4c1732e4c686b61b8db276c93bba9900588ad457b6d5b02e1db2e3d3ca14bff616f9fbe7c83ccd5adc24322ac1fe8d356d496dd357ab0911091bb995790f91aa802cc91c59d521aac9d38edb1dea3f1568c915d655838770c2d3844e22812b9a00992ab9128952216c5798deaeca1fac80ba5e49d268cd10a6f0aa8729334482a4de8f9c9cda46f2a74b51f248445a8c82b86bd83ac4079509214343918efadbed6f0e36129e1921943af3bbc17f2f6cd2e6a4fa96a67be0ea920cf6892767ecceead7d985c5c5b7b8354aace6065ff614845c607ab7407e1be7be5336e848347690d7164ab57f354d0e17ca289db9babc88e782068c1bfebe95e28a3e669400d26a7b9f9526dc2766dc146406b6f2c571ea7fa2df64c2d7baed192eb055c79088268f6b7a9be8cf067fc0a3132e753418611f38f7f279e5f3ac0eac316a136c4ad95920494510d691371a005a3a25752ecdc7a060f8003ea9bab7ed15aeba605c2f5a28984f5eccc331e54c29493d5e518d0683b9c2a7ec1f5c1f19b38a830b236ada2c4a703aa769ed1cef838a9e6d826fda40abbdc0a0c275c0ed21d33f68ecf3ee9e76c4fbc90648107f30c4de57af3136634a1e9ab3ec95b40453804f14bc8ae4e11e85ef38ca3b67fca89b085f2891b841807926d9b1521c207f70589873373edc0804bcb1444ad574843cdbe6a16c891bfc27edd210b03958b0f2ef4e26efd14f3eda7ecfc5a9dcf139f098f3d92b413da27590f46d85873a45970a3956eded5ec1fbda177fcc1d8d87104b2a0a3e49e2d8d45dc62fbb297557948b50442291bfaf828dfdb77d0efb20f02a336af99aa31e3bebea22b590e4ea60fe3e001888a1e9553b8cf992204c8eb92038d3a2407657a2a11b5d5776276b8d0326decfa27f16f9590bd01e478f8f57c454da26fdb29c3bf744001ee10dc52e2b76c072f02585650c18cdd39dc0c596668abe4a1a19f20a1d11ca584b9fa4246ebede6a320634f33ab621ad9cd866640100031226291a814d6690ef90345b8000f4d3dfb229bc6f8f6a341d30f7b83bf2836d74883d85539b367350220d2eced9ea7410826484d13948db8d3fefd299d14e7c8fce1fd7bbe5ac20b936872148b99970a973bc37c254114d01dc4c39c615dea8697ba528df67bea4d245655cc0d406122054d8b503892a0cc1fb12fab719e9aeee3fa2365eec594d17ed80e0e4b8cfbeca28a04153f6b876eec8f7fe46b97727b4344ee36fcdd86358d109955cb0573458b5382be0fddadea0094f22f9e602563f9ae06a969428733f41f680d9e734f395067282b98c00a102a6c630d6998db216f21d5dbd891f8fd36499e82460b0f2791bcaa9dae97fb4a02750703f716788b4259d0ca37aed8a2670c2b63ccdad3663ab2c8ba7aef3f178ebdb1f3c742f8a914b561db419371cd7735c9f77b50eb6bf0fdeba28e469f85f0c77900b1bbf8a62ab9732a73b7d7959b865e5e85fc04fd3f20f982732fae5cd38766cbba1c318506f23cfdcfb1f7c12fb23162473a699c1bd91b53473d7ff4814779f72c259a57a7a5130d8f870dcb6f7b4dcaa444e523961b68e4490136c9529d70bcf1b4a5fc6d55a956d7f95ec3719972d75535c77184d8528a8325a132c507ce1c5b5210e6ba8f583036158dc51e00bfef78f3f8254f178a7acdf372c90bd3df374824a9ee3b0980199d1d30d9af97aad34cddbf327d7da7554ce38936b7f0949f5ed552be037e67aea1d210986bd1393825c2c443046bed876cd3c9d8498f043ec0376c47dddef4da4c5a5e66c61e6ff2b6b02423015a680cee27b52e94c2322ebe1fa0efc3062f0acb9700d8ec8ddd5c43b756ae3447a64f5489757607620e9aa948021efa866491d4b921e7df2a27878bc9e19a287c3a7b9178e56b311ca7fad78989a4b252994a6ca2e2889700dd6475c2f13c81ded4a6bf5f52217093213a56c2de30623e8a4aac0bcd9c7e142390712282f7dd2e77f1a7a0ef9e2494a2b1e145176a114a80e6e1df9348c671bb468fd39f69708e8b50433a2c4b46e12f0d1b1f06e9e15ea1627299592363e97a349fde01d8fe845392a2b67d4b97d09a95b2b33fd891c3f494042f53a82749927880673713711d6bee2b9a2ff9a3c5e77390eea9df5893abbfe0c6a889e32a4e1ae56685bb275e92cbccd1f6af49ff65de0f53f46ef2258baac153d31c6e6da3b8e18e535e007d7efdde114be8735c6c6632a8e5abce91e1abe514b20327bf98771a7d8e2a6d52a0a22506757f110951e526c26bd18cf7308e144dc7a9bf7e8e9d0dc5c58889adcd83043394c2c4906d265dba4d1c936331d82326c05cf4e4fcbc3ff2fc157fc64be926001749029cb784fa5c457c6a49b023c641312ec16943b33c2b4daa8e0fb187d219d6e5ed038124cc0a46163105eaea54a74efd170efbfdd0579d7600977fb985768ea0954a70244472f5e0fc1107f93e09f1eda667bf8248330ca10276ac55f0bae582c74c91113d1e0faf9653bbcd07dc37b6104043c99869960c6dbd67c46f35369f9f1b29b82361a5703162fe09d1981a7fa63f59c37e288786055f92d18eb8f89b2f5e8eed37d6d1d368a9ae9ade09a81c5e479d53abdc394841be47a722e1191e032c3378d53f032a8700abf474593f3387294875df7b9adf9c4f46d03e449b9b4fbff9aa6e1c3eecd3