{"id":112727,"date":"2024-01-06T21:10:22","date_gmt":"2024-01-06T19:10:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/orange-espana-vzlomali-iz-za-togo-chto-parol-u-polzovatelya-admin-uchetnoj-zapisi-ripe-ncc-byl-ripeadmin"},"modified":"2024-01-06T21:10:22","modified_gmt":"2024-01-06T19:10:22","slug":"orange-espana-vzlomali-iz-za-togo-chto-parol-u-polzovatelya-admin-uchetnoj-zapisi-ripe-ncc-byl-ripeadmin","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/orange-espana-vzlomali-iz-za-togo-chto-parol-u-polzovatelya-admin-uchetnoj-zapisi-ripe-ncc-byl-ripeadmin","title":{"rendered":"Orange Espa\u00f1a byla napadena kv\u016fli tomu, \u017ee heslo u\u017eivatele admin \u00fa\u010dtu RIPE NCC bylo ripeadmin.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Orange Espa\u00f1a, druh\u00fd nejv\u011bt\u0161\u00ed mobiln\u00ed oper\u00e1tor ve \u0160pan\u011blsku, \u010delil v\u00e1\u017en\u00e9mu v\u00fdpadku ve st\u0159edu pot\u00e9, co se nezn\u00e1m\u00e1 strana dostala k \u00fa\u010dtu pro spr\u00e1vu glob\u00e1ln\u00ed tabulky routov\u00e1n\u00ed pomoc\u00ed \u201e sm\u011b\u0161n\u011b slab\u00e9ho\u201c hesla. Od 9:28 UTC se osoba vystupuj\u00edc\u00ed pod p\u0159ezd\u00edvkou Snow p\u0159ihl\u00e1sila do \u00fa\u010dtu Orange na RIPE NCC s pou\u017eit\u00edm hesla ripeadmin. RIPE NCC odpov\u00edd\u00e1 za spr\u00e1vu a distribuci IP adres a obsluhuje 75 zem\u00ed Evropy, Bl\u00edzk\u00e9ho v\u00fdchodu a St\u0159edn\u00ed Asie.<\/p>\n
Snow nejprve p\u0159idal nov\u00e9 ROAs (Route Origin Authorizations) do glob\u00e1ln\u00ed tabulky routov\u00e1n\u00ed, kter\u00e9 p\u016fvodn\u011b nezp\u016fsobily \u017e\u00e1dn\u00e9 probl\u00e9my. Nicm\u00e9n\u011b pozd\u011bji Snow p\u0159idal ROAs s \u201efale\u0161n\u00fdmi zdroji\u201c, co\u017e vedlo k podstatn\u00e9mu zmen\u0161en\u00ed platn\u00fdch tras Orange, co\u017e zase zp\u016fsobilo v\u00fdpadek slu\u017eby. Probl\u00e9m byl zhor\u0161en pou\u017eit\u00edm syst\u00e9mu RPKI (Resource Public Key Infrastructure), kter\u00fd je ur\u010den k prevenci neopr\u00e1vn\u011bn\u00e9ho p\u0159esm\u011brov\u00e1n\u00ed tras, co\u017e efektivn\u011b u\u010dinilo s\u00ed\u0165 Orange nefunk\u010dn\u00ed.<\/p>\n
Firma Hudson Rock objevila p\u0159ihla\u0161ovac\u00ed \u00fadaje na prodej v online obchodech, kter\u00e9 byly ukradeny pomoc\u00ed malwaru nainstalovan\u00e9ho na po\u010d\u00edta\u010di Orange od z\u00e1\u0159\u00ed. V\u00fdzkumn\u00edci tak\u00e9 upozornili na tis\u00edce dal\u0161\u00edch p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f, kter\u00e9 chr\u00e1n\u00ed \u00fa\u010dty RIPE, dostupn\u00e9 na takov\u00fdch tr\u017ei\u0161t\u00edch.<\/p>\n
Tento incident podtrhuje k\u0159ehkost syst\u00e9mu BGP a odhaluje v\u00e1\u017en\u00e9 bezpe\u010dnostn\u00ed probl\u00e9my v Orange. Pou\u017eit\u00ed slab\u00e9ho hesla a absence v\u00edcefaktorov\u00e9 autentizace, stejn\u011b jako nainstalovan\u00fd malware na po\u010d\u00edta\u010di zam\u011bstnance, kter\u00fd z\u016fstal bez pov\u0161imnut\u00ed po dobu \u010dty\u0159 m\u011bs\u00edc\u016f, jsou v\u00e1\u017en\u00e9 nedostatky, kter\u00e9 by se v organizaci s takov\u00fdm rozsahem podnik\u00e1n\u00ed, jako je Orange, nikdy nem\u011bly st\u00e1t. V\u00fdzkumn\u00edci doufaj\u00ed, \u017ee tento incident bude varovn\u00fdm sign\u00e1lem pro ostatn\u00ed poskytovatele slu\u017eeb a p\u0159im\u011bje je k pos\u00edlen\u00ed bezpe\u010dnostn\u00edch opat\u0159en\u00ed.<\/p>\n