We confirmed these behaviors by sending a number of probes to the Baidu server, requesting resources that trigger the GC’s injection. Each probe had a different source port. We sent 500 probes, each with the request split across three packets (so 1,500 packets total). The GC ignored each probe. We then sent 500 probes where the first packet’s data is an invalid HTTP request, and the second packet’s data is a complete, valid request for a targeted resource. The GC ignored each probe. We then sent a final 500 single-packet probes, each containing a complete, valid request for a targeted resource, to confirm normal GC operation. As expected, the GC injected malicious content in some cases, seemingly based on its probabilistic decision-making process.
我 们通过向百度服务器发送一些探测器，请求资源来触发巨炮的注入从而确认这些行为。每一个探测器都有不同的源端口。我们发送了500个探测器，每一个的请求 都分裂在三个包中（所以总共有1500个包）。巨炮忽略了每个探测器。接下来我们发送了500个探测器，第一个包的数据是无效的HTTP请求，第二个包的 数据是一个针对目标资源的完整有效的请求。巨炮忽略了每个探测器。接下来我们发送了最后500个单包探测器，每一个都包括了一个针对目标资源的完整有效的 请求，以确认正常的巨炮反应。就像期待的那样，巨炮在一些情形下注入了恶意内容，似乎是基于它的基于概率的做决定进程。
How big is the GC flow cache?
巨炮的流缓存有多大？
22/26 首页 上一页 20 21 22 23 24 25 下一页 尾页
|
