{"id":30310,"date":"2019-10-31T21:34:48","date_gmt":"2019-10-31T18:34:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ya-proskaniroval-ukrainu\/"},"modified":"2019-10-31T21:34:48","modified_gmt":"2019-10-31T18:34:48","slug":"ya-proskaniroval-ukrainu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/ya-proskaniroval-ukrainu","title":{"rendered":"Prozkoumal jsem Ukrajinu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V \u00fanoru zve\u0159ejnil rakousk\u00fd Christian Haschek na sv\u00e9m blogu zaj\u00edmav\u00fd \u010dl\u00e1nek s n\u00e1zvem \u201eProskenoval jsem cel\u00e9 Rakousko\u201c<\/a><\/noindex>. Samoz\u0159ejm\u011b m\u011b zaj\u00edmalo, co se stane, kdy\u017e toto \u0161et\u0159en\u00ed zopakuji, ale u\u017e na Ukrajin\u011b. N\u011bkolik t\u00fddn\u016f nep\u0159etr\u017eit\u00e9ho shroma\u017e\u010fov\u00e1n\u00ed informac\u00ed, je\u0161t\u011b p\u00e1r dn\u00ed na seps\u00e1n\u00ed \u010dl\u00e1nku a b\u011bhem tohoto v\u00fdzkumu rozhovory s r\u016fzn\u00fdmi \u010dleny na\u0161\u00ed spole\u010dnosti, abych up\u0159esnil nebo se dozv\u011bd\u011bl v\u00edce. Pros\u00edm, \u010dt\u011bte d\u00e1l\u2026
\n<\/a><\/noindex><\/p>\n

TL;DR<\/h2>\n

\nP\u0159i sb\u011bru informac\u00ed nebyly pou\u017eity \u017e\u00e1dn\u00e9 speci\u00e1ln\u00ed prost\u0159edky (a\u010dkoli n\u011bkolik lid\u00ed doporu\u010dilo pou\u017e\u00edt OpenVAS, aby bylo \u0161et\u0159en\u00ed d\u016fkladn\u011bj\u0161\u00ed a informativn\u011bj\u0161\u00ed). Co se t\u00fd\u010de bezpe\u010dnosti IP adres pat\u0159\u00edc\u00edch k Ukrajin\u011b (n\u00ed\u017ee o metod\u011b ur\u010den\u00ed), situace je podle m\u011b docela \u0161patn\u00e1 (a rozhodn\u011b hor\u0161\u00ed ne\u017e to, co se d\u011bje v Rakousku). Nebyly provedeny \u017e\u00e1dn\u00e9 pokusy o vyu\u017eit\u00ed zraniteln\u00fdch server\u016f.<\/p>\n

P\u0159edev\u0161\u00edm: jak z\u00edskat v\u0161echny IP adresy, kter\u00e9 pat\u0159\u00ed ur\u010dit\u00e9 zemi?<\/h2>\n

\nTo je ve skute\u010dnosti velmi jednoduch\u00e9. IP adresy nejsou generov\u00e1ny samotnou zem\u00ed, ale jsou j\u00ed p\u0159id\u011bleny. Existuje tedy seznam (a je ve\u0159ejn\u00fd) v\u0161ech zem\u00ed a v\u0161ech IP adres, kter\u00e9 jim pat\u0159\u00ed.<\/p>\n

Ka\u017ed\u00fd si m\u016f\u017ee st\u00e1hnout tento seznam<\/a><\/noindex>, a pot\u00e9 ho filtrovat pomoc\u00ed grep Ukraine IP2LOCATION-LITE-DB1.CSV > ukraine.csv<\/p>\n

Jednoduch\u00fd skript, kter\u00fd vytvo\u0159il Christian<\/a><\/noindex>, umo\u017e\u0148uje p\u0159ev\u00e9st seznam do u\u017eivatelsky p\u0159\u00edjemn\u011bj\u0161\u00ed podoby.<\/p>\n

Ukrajin\u011b pat\u0159\u00ed t\u00e9m\u011b\u0159 stejn\u00e9 mno\u017estv\u00ed IPv4 adres jako Rakousku, v\u00edce ne\u017e 11 milion\u016f. P\u0159esn\u011b 11 640 409 (pro srovn\u00e1n\u00ed v Rakousku \u2014 11 170 487).<\/p>\n

Pokud si nechcete hr\u00e1t se sv\u00fdmi IP adresami (a to nedoporu\u010duji!), m\u016f\u017eete pou\u017e\u00edt slu\u017ebu Shodan.io<\/a><\/noindex>.<\/p>\n

Existuj\u00ed na Ukrajin\u011b neopraven\u00e9 Windows stroje, kter\u00e9 maj\u00ed p\u0159\u00edm\u00fd p\u0159\u00edstup na internet?<\/h2>\n

\nSamoz\u0159ejm\u011b, \u017e\u00e1dn\u00fd uv\u011bdom\u011bl\u00fd Ukrajinec nebude otev\u00edrat takov\u00fd p\u0159\u00edstup pro sv\u00e9 po\u010d\u00edta\u010de. Anebo ano?<\/p>\n

masscan -p445 --rate 300 -iL ukraine.ips -oG ukraine.445.scan && cat ukraine.445.scan | wc -l<\/code><\/pre>\n
\nBylo nalezeno 5669 stroj\u016f s Windows s p\u0159\u00edm\u00fdm p\u0159\u00edstupem do s\u00edt\u011b (v Rakousku jich bylo jen 1273, ale i to je hodn\u011b).<\/p>\n
Omlouv\u00e1m se. Existuj\u00ed mezi nimi n\u011bjak\u00e9, kter\u00e9 by bylo mo\u017en\u00e9 napadnout pomoc\u00ed exploit\u016f ETHERNALBLUE, kter\u00e9 je zn\u00e1mo u\u017e od roku 2017? V Rakousku nebylo \u017e\u00e1dn\u00e9 takov\u00e9 za\u0159\u00edzen\u00ed a doufal jsem, \u017ee ani na Ukrajin\u011b nebude nalezeno. Bohu\u017eel, to byla marn\u00e1 nad\u011bje. Bylo nalezeno 198 IP adres, kter\u00e9 neuzav\u0159ely tuto \"d\u00edru\".<\/p>\n
DNS, DDoS a hloubka kr\u00e1li\u010d\u00ed nory<\/h2>\n
\nDost o Windows. Poj\u010fme se pod\u00edvat, co m\u00e1me s DNS servery, kter\u00e9 jsou open-resolvers a mohou b\u00fdt pou\u017eity pro DDoS \u00fatok.<\/p>\n
Funguje to zhruba takto. \u00dato\u010dn\u00edk ode\u0161le mal\u00fd DNS dotaz a zraniteln\u00fd server odpov\u00ed ob\u011bti paketem, kter\u00fd je a\u017e 100kr\u00e1t v\u011bt\u0161\u00ed. Bum! Firemn\u00ed s\u00edt\u011b mohou velmi rychle zkolabovat p\u0159i takov\u00e9m objemu dat, a pro \u00fatok je zapot\u0159eb\u00ed \u0161\u00ed\u0159ky p\u00e1sma, kterou m\u016f\u017ee poskytnout modern\u00ed smartphone. A takov\u00e9 \u00fatoky byly neobvykl\u00e9<\/a><\/noindex> dokonce i na GitHubu.<\/p>\n
Pod\u00edvejme se, zda jsou takov\u00e9 servery na Ukrajin\u011b.<\/p>\n
masscan -pU 53 -iL ukraine.ips -oG ukraine.53.scan && cat ukraine.53.scan | wc -l<\/code><\/pre>\n
\nPrvn\u00edm krokem je naj\u00edt ty, kter\u00e9 maj\u00ed otev\u0159en\u00fd port 53. V d\u016fsledku toho m\u00e1me seznam 58 730 IP adres, ale to je\u0161t\u011b neznamen\u00e1, \u017ee v\u0161echny mohou b\u00fdt pou\u017eity pro DDoS \u00fatok. Je pot\u0159eba splnit druhou podm\u00ednku, a to maj\u00ed b\u00fdt open-resolver.<\/p>\n
K tomu m\u016f\u017eeme pou\u017e\u00edt jednoduch\u00fd p\u0159\u00edkaz dig a vid\u011bt, \u017ee m\u016f\u017eeme \"vykopat\" dig + short test.openresolver.com TXT @ip.of.dns.server. Pokud server odpov\u011bd\u011bl open-resolver-detected, pak ho lze pova\u017eovat za potenci\u00e1ln\u00ed c\u00edl \u00fatoku. Open resolvery tvo\u0159\u00ed p\u0159ibli\u017en\u011b 25%, co\u017e je srovnateln\u00e9 s Rakouskem. Z hlediska celkov\u00e9ho po\u010dtu to p\u0159edstavuje p\u0159ibli\u017en\u011b 0,02% v\u0161ech ukrajinsk\u00fdch IP.<\/p>\n
Co dal\u0161\u00edho lze na Ukrajin\u011b naj\u00edt?<\/h2>\n
\nR\u00e1d, \u017ee se pt\u00e1te. Je snaz\u0161\u00ed (a pro m\u011b osobn\u011b nejzaj\u00edmav\u011bj\u0161\u00ed) pod\u00edvat se na IP s otev\u0159en\u00fdm portem 80 a co na n\u011bm \"b\u011b\u017e\u00ed\".<\/p>\n
webov\u00e9 servery<\/h3>\n
\n260 849 ukrajinsk\u00fdch IP odpov\u00edd\u00e1 na port 80 (http). 125 444 adres odpov\u011bd\u011blo kladn\u011b (200 status) na jednoduch\u00fd GET po\u017eadavek, kter\u00fd m\u016f\u017ee poslat v\u00e1\u0161 prohl\u00ed\u017ee\u010d. Ostatn\u00ed vydaly r\u016fzn\u00e9 chyby. Zaj\u00edmav\u00e9 je, \u017ee 853 server\u016f vydalo status 500, zat\u00edmco velmi vz\u00e1cn\u00fdmi statusy se staly 407 (po\u017eadavek na proxy autorizaci) a zcela netradi\u010dn\u00ed 602 (IP nen\u00ed v \"b\u00edl\u00e9m seznamu\") s jednou odpov\u011bd\u00ed.<\/p>\n
Apache dominuje naprosto \u2014 114 544 server\u016f pou\u017e\u00edv\u00e1 pr\u00e1v\u011b jeho. Nejd\u0159\u00edve nalezen\u00e1 verze na Ukrajin\u011b \u2014 1.3.29, vydan\u00e1 29. \u0159\u00edjna 2003 (!!!). nginx je na druh\u00e9m m\u00edst\u011b s 61 659 servery.<\/p>\n
11 server\u016f pou\u017e\u00edv\u00e1 WinCE, kter\u00e9 bylo vyd\u00e1no v roce 1996 a naposledy bylo aktualizov\u00e1no v roce 2013 (v Rakousku je jich pouze 4).<\/p>\n
Protokol HTTP\/2 pou\u017e\u00edv\u00e1 5 144 server\u016f, HTTP\/1.1 \u2014 256 836, HTTP\/1 \u2014 13 491.<\/p>\n
Tisk\u00e1rny\u2026 proto\u017ee\u2026 pro\u010d ne?<\/h3>\n
\n2 HP, 5 Epson a 4 Canon, kter\u00e9 jsou dostupn\u00e9 p\u0159es s\u00ed\u0165, z nich\u017e n\u011bkter\u00e9 jsou dostupn\u00e9 bez jak\u00e9koliv autorizace.<\/p>\n
\"Prozkoumal
\n <\/p>\n
webkamery<\/h3>\n
\nNen\u00ed novinkou, \u017ee na Ukrajin\u011b je OPRAVDU mnoho webkamer, kter\u00e9 se p\u0159en\u00e1\u0161ej\u00ed do internetu a jsou shrom\u00e1\u017ed\u011bny na r\u016fzn\u00fdch zdroj\u00edch. Nejm\u00e9ne 75 kamer se p\u0159en\u00e1\u0161\u00ed do internetu bez jak\u00e9koli ochrany. M\u016f\u017eete se na n\u011b pod\u00edvat zde<\/a><\/noindex>.<\/p>\n
\"Prozkoumal
\n <\/p>\n
Co d\u00e1l?<\/h2>\n
\nUkrajina je mal\u00e1 zem\u011b, stejn\u011b jako Rakousko, ale m\u00e1 stejn\u00e9 probl\u00e9my jako velk\u00e9 zem\u011b v oblasti IT. Mus\u00edme si l\u00e9pe vyjasnit, co je bezpe\u010dn\u00e9 a co ne, a v\u00fdrobci za\u0159\u00edzen\u00ed by m\u011bli poskytovat bezpe\u010dnou po\u010d\u00e1te\u010dn\u00ed konfiguraci sv\u00e9ho za\u0159\u00edzen\u00ed.<\/p>\n
Krom\u011b toho shroma\u017e\u010fuji partnersk\u00e9 spole\u010dnosti (st\u00e1t se partnerem<\/a><\/noindex>), kter\u00e9 v\u00e1m mohou pomoci zajistit integritu va\u0161\u00ed IT infrastruktury. Dal\u0161\u00edm krokem pl\u00e1nuji prov\u00e9st p\u0159ehled bezpe\u010dnosti ukrajinsk\u00fdch webov\u00fdch str\u00e1nek. Z\u016fsta\u0148te nalad\u011bni!
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e \u0410\u0432\u0441\u0442\u0440\u0438\u044e\u00bb. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043c\u043d\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u044d\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u0443\u0436\u0435 \u0441 \u0423\u043a\u0440\u0430\u0438\u043d\u043e\u0439. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043a\u0440\u0443\u0433\u043b\u043e\u0441\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0435\u0449\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0444\u043e\u0440\u043c\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e, \u0430 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0441\u0435\u0434\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30310","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Naskenoval jsem Ukrajinu | ProHoster","description":"V \u00fanoru rakousk\u00fd Christian Haschek na sv\u00e9m blogu zve\u0159ejnil zaj\u00edmav\u00fd \u010dl\u00e1nek s n\u00e1zvem \u201eNaskenoval jsem cel\u00fd.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/ya-proskaniroval-ukrainu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0423\u043a\u0440\u0430\u0438\u043d\u0443 | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/ya-proskaniroval-ukrainu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:48+00:00","article:modified_time":"2019-10-31T18:34:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30310","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/30310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=30310"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/30310\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=30310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=30310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=30310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}