{"id":34976,"date":"2019-10-31T22:01:37","date_gmt":"2019-10-31T19:01:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/okolo-5-5-vyyavlyaemyh-uyazvimostej-ispolzuyutsya-dlya-osushhestvleniya-atak\/"},"modified":"2019-10-31T22:01:37","modified_gmt":"2019-10-31T19:01:37","slug":"okolo-5-5-vyyavlyaemyh-uyazvimostej-ispolzuyutsya-dlya-osushhestvleniya-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/okolo-5-5-vyyavlyaemyh-uyazvimostej-ispolzuyutsya-dlya-osushhestvleniya-atak","title":{"rendered":"P\u0159ibli\u017en\u011b 5,5 % odhalen\u00fdch zranitelnost\u00ed se pou\u017e\u00edv\u00e1 k prov\u00e1d\u011bn\u00ed \u00fatok\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f z Virginia Polytechnic Institute a tak\u00e9 z firem Cyentia a RAND, publikovala<\/a><\/noindex> analyzovala rizika spojen\u00e1 s r\u016fzn\u00fdmi strategiemi opravy zranitelnost\u00ed. Zkoum\u00e1n\u00edm 76 tis\u00edc zranitelnost\u00ed nalezen\u00fdch v obdob\u00ed od roku 2009 do 2018 bylo zji\u0161t\u011bno, \u017ee pouze 4183 z nich (5,5 %) byly vyu\u017eity p\u0159i skute\u010dn\u00fdch \u00fatoc\u00edch. Tento \u00fadaj je p\u011btkr\u00e1t vy\u0161\u0161\u00ed ne\u017e d\u0159\u00edve publikovan\u00e9 odhady, kter\u00e9 p\u0159edpokl\u00e1daly, \u017ee zneu\u017eiteln\u00fdch probl\u00e9m\u016f je p\u0159ibli\u017en\u011b 1,4 %.<\/p>\n

P\u0159i\u010dem\u017e nebyla nalezena \u017e\u00e1dn\u00e1 korelace mezi publikov\u00e1n\u00edm prototyp\u016f exploit\u016f ve ve\u0159ejn\u00e9m prostoru a pokusy o zneu\u017eit\u00ed zranitelnosti. Ze v\u0161ech zn\u00e1m\u00fdch p\u0159\u00edpad\u016f zneu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed byl prototyp exploitu do t\u00e9 doby publikov\u00e1n v otev\u0159en\u00fdch zdroj\u00edch pouze v polovin\u011b p\u0159\u00edpad\u016f. Nep\u0159\u00edtomnost prototypu exploitu nebr\u00e1n\u00ed \u00fato\u010dn\u00edk\u016fm, kte\u0159\u00ed si v p\u0159\u00edpad\u011b pot\u0159eby vytv\u00e1\u0159ej\u00ed exploity sami.<\/p>\n

Z dal\u0161\u00edch z\u00e1v\u011br\u016f lze vyzdvihnout, \u017ee pro zneu\u017eit\u00ed jsou p\u0159ev\u00e1\u017en\u011b \u017e\u00e1d\u00e1ny zranitelnosti s vysokou \u00farovn\u00ed nebezpe\u010dnosti podle klasifikace CVSS. V t\u00e9m\u011b\u0159 polovin\u011b \u00fatok\u016f byly vyu\u017eity zranitelnosti s v\u00e1hou alespo\u0148 9. <\/p>\n

Celkov\u00fd po\u010det publikovan\u00fdch prototyp\u016f exploit\u016f za posuzovan\u00e9 obdob\u00ed byl vyhodnocen na 9726. Pou\u017eit\u00e9 \u00fadaje o exploitech v t\u00e9to studii byly z\u00edsk\u00e1ny z
\nkolekc\u00ed Exploit DB, Metasploit, D2 Security's Elliot Kit, Canvas Exploitation Framework, Contagio, Reversing Labs a Secureworks CTU.
\nInformace o zranitelnostech byly z\u00edsk\u00e1ny z datab\u00e1ze NIST NVD<\/a><\/noindex> (N\u00e1rodn\u00ed datab\u00e1ze zranitelnost\u00ed). Informace o skute\u010dnostech exploitace byly shrnuty na z\u00e1klad\u011b \u00fadaj\u016f od FortiGuard Labs, SANS Internet Storm Center, Secureworks CTU, Alienvault's OSSIM a ReversingLabs.<\/p>\n

Studie byla provedena s c\u00edlem ur\u010dit optim\u00e1ln\u00ed rovnov\u00e1hu mezi aplikac\u00ed aktualizac\u00ed p\u0159i odhalov\u00e1n\u00ed jak\u00fdchkoli zranitelnost\u00ed a odstran\u011bn\u00edm pouze nejnebezpe\u010dn\u011bj\u0161\u00edch probl\u00e9m\u016f. V prvn\u00edm p\u0159\u00edpad\u011b se dosahuje vysok\u00e9 \u00fa\u010dinnosti ochrany, ale vy\u017eaduje se v\u00edce zdroj\u016f na \u00fadr\u017ebu infrastruktury, kter\u00e9 se p\u0159ev\u00e1\u017en\u011b vynakl\u00e1daj\u00ed na \u0159e\u0161en\u00ed m\u00e9n\u011b v\u00fdznamn\u00fdch probl\u00e9m\u016f. Ve druh\u00e9m p\u0159\u00edpad\u011b je velk\u00e9 riziko, \u017ee se p\u0159ehl\u00e9dne zranitelnost, kter\u00e1 m\u016f\u017ee b\u00fdt pou\u017eita k \u00fatoku. Studie prok\u00e1zala, \u017ee p\u0159i rozhodov\u00e1n\u00ed o instalaci aktualizace k odstran\u011bn\u00ed zranitelnosti nelze spol\u00e9hat na absenci zve\u0159ejn\u011bn\u00e9ho prototypu exploit\u016f a \u0161ance na zneu\u017eit\u00ed p\u0159\u00edmo z\u00e1vis\u00ed na \u00farovni nebezpe\u010dnosti zranitelnosti.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041f\u043e\u043b\u0438\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0412\u0438\u0440\u0433\u0438\u043d\u0438\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Cyentia \u0438 RAND, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0440\u0438\u0441\u043a\u043e\u0432 \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u0439 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0418\u0437\u0443\u0447\u0438\u0432 76 \u0442\u044b\u0441\u044f\u0447 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0445 \u0441 2009 \u043f\u043e 2018 \u0433\u043e\u0434, \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e, \u0447\u0442\u043e \u0442\u043e\u043b\u044c\u043a\u043e 4183 \u0438\u0437 \u043d\u0438\u0445 (5.5%) \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0438\u0441\u044c \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a. \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0439 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u0432 \u043f\u044f\u0442\u044c \u0440\u0430\u0437 \u043f\u0440\u0435\u0432\u044b\u0448\u0430\u0435\u0442 \u0440\u0430\u043d\u0435\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u043d\u043e\u0437\u044b, \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-34976","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u0159ibli\u017en\u011b 5.5% odhalen\u00fdch zranitelnost\u00ed se pou\u017e\u00edv\u00e1 k prov\u00e1d\u011bn\u00ed \u00fatok\u016f | ProHoster","description":"Skupina v\u00fdzkumn\u00edk\u016f z Virginia Polytechnic Institute a tak\u00e9 z firem Cyentia a RAND,","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/okolo-5-5-vyyavlyaemyh-uyazvimostej-ispolzuyutsya-dlya-osushhestvleniya-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043a\u043e\u043b\u043e 5.5% \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041f\u043e\u043b\u0438\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0412\u0438\u0440\u0433\u0438\u043d\u0438\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Cyentia \u0438 RAND,","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/okolo-5-5-vyyavlyaemyh-uyazvimostej-ispolzuyutsya-dlya-osushhestvleniya-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:37+00:00","article:modified_time":"2019-10-31T19:01:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34976","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:21:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:12:26","updated":"2026-01-21 21:21:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/34976","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=34976"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/34976\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=34976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=34976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=34976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}