{"id":55145,"date":"2020-01-13T00:00:00","date_gmt":"2020-01-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta"},"modified":"2020-02-18T14:03:13","modified_gmt":"2020-02-18T11:03:13","slug":"obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta","title":{"rendered":"Oklam m\u011b, pokud m\u016f\u017ee\u0161: rysy prov\u00e1d\u011bn\u00ed sociotechnick\u00e9ho pentestu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Oklam m\u011b, pokud m\u016f\u017ee\u0161: rysy prov\u00e1d\u011bn\u00ed sociotechnick\u00e9ho pentestu\" src=\"\/wp-content\/uploads\/2020\/01\/fa938cb2a5cb85adb395a1b2c3b14d4b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159edstavte si takovou situaci. Chladn\u00e9 \u0159\u00edjnov\u00e9 r\u00e1no, projektov\u00fd \u00fastav v oblastn\u00edm centru jednoho z region\u016f Ruska. N\u011bkdo z odd\u011blen\u00ed lidsk\u00fdch zdroj\u016f nav\u0161t\u011bvuje jednu z str\u00e1nek s nab\u00eddkami pr\u00e1ce na webu \u00fastavu, kter\u00e1 byla zve\u0159ejn\u011bna p\u0159ed p\u00e1r dny, a vid\u00ed tam fotografii ko\u010dky. R\u00e1no rychle p\u0159est\u00e1v\u00e1 b\u00fdt nudn\u00e9... <\/p>\n<p>V tomto \u010dl\u00e1nku Pavel Supru\u0148uk, technick\u00fd vedouc\u00ed odd\u011blen\u00ed auditu a poradenstv\u00ed spole\u010dnosti Group-IB, vypr\u00e1v\u00ed o tom, jakou roli hraj\u00ed sociotechnick\u00e9 \u00fatoky v projektech zam\u011b\u0159en\u00fdch na hodnocen\u00ed praktick\u00e9 ochrany, jak\u00e9 neobvykl\u00e9 formy mohou nab\u00fdvat a tak\u00e9 o tom, jak se proti t\u011bmto \u00fatok\u016fm br\u00e1nit. Autor up\u0159es\u0148uje, \u017ee \u010dl\u00e1nek m\u00e1 p\u0159ehledov\u00fd charakter, av\u0161ak pokud n\u011bkter\u00fd aspekt zaujme \u010dten\u00e1\u0159e, odborn\u00edci ze spole\u010dnosti Group-IB r\u00e1di odpov\u011bd\u00ed na ot\u00e1zky v koment\u00e1\u0159\u00edch. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex> <\/p>\n<h2>\u010c\u00e1st 1. Pro\u010d tak v\u00e1\u017en\u011b?<\/h2>\n<p>\nVr\u00e1t\u00edme se k na\u0161\u00ed ko\u010dce. Po n\u011bjak\u00e9 dob\u011b odd\u011blen\u00ed lidsk\u00fdch zdroj\u016f odstran\u00ed fotografie (sn\u00edmky obrazovky zde a d\u00e1le jsou \u010d\u00e1ste\u010dn\u011b retu\u0161ov\u00e1ny, aby odhalily skute\u010dn\u00e1 jm\u00e9na), ale ta se ne\u00fanavn\u011b vrac\u00ed, znovu ji odstran\u00ed, a takto se to d\u011bje je\u0161t\u011b n\u011bkolikr\u00e1t. V odd\u011blen\u00ed lidsk\u00fdch zdroj\u016f ch\u00e1pou, \u017ee ko\u010dka m\u00e1 velmi v\u00e1\u017en\u00e9 \u00famysly a nechce odej\u00edt, a zavolaj\u00ed na pomoc webov\u00e9ho program\u00e1tora \u2014 \u010dlov\u011bka, kter\u00fd web vytvo\u0159il a rozum\u00ed mu, a nyn\u00ed ho spravuje. Program\u00e1tor se p\u0159ihl\u00e1s\u00ed na web, znovu odstran\u00ed obt\u011b\u017euj\u00edc\u00ed ko\u010dku, zjist\u00ed, \u017ee byla um\u00edst\u011bna jm\u00e9nem samotn\u00e9ho odd\u011blen\u00ed lidsk\u00fdch zdroj\u016f, a pak se domn\u00edv\u00e1, \u017ee heslo odd\u011blen\u00ed lidsk\u00fdch zdroj\u016f uniklo n\u011bjak\u00fdm s\u00ed\u0165ov\u00fdm v\u00fdtr\u017en\u00edk\u016fm, a zm\u011bn\u00ed ho. Ko\u010dka u\u017e se neobjev\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Oklam m\u011b, pokud m\u016f\u017ee\u0161: rysy prov\u00e1d\u011bn\u00ed sociotechnick\u00e9ho pentestu\" src=\"\/wp-content\/uploads\/2020\/01\/319d5d30d3b563897339362e0fac1a6e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCo se opravdu stalo? Specialist\u00e9 ze spole\u010dnosti Group-IB prov\u00e1d\u011bli penetra\u010dn\u00ed testy pro skupinu spole\u010dnost\u00ed, do kter\u00e9 \u00fastav pat\u0159il, ve form\u00e1tu bl\u00edzk\u00e9m Red Teamingu (jednodu\u0161e \u0159e\u010deno, je to simulace c\u00edlen\u00fdch \u00fatok\u016f na va\u0161i spole\u010dnost s pou\u017eit\u00edm nejpokro\u010dilej\u0161\u00edch metod a n\u00e1stroj\u016f z arzen\u00e1lu hackersk\u00fdch skupin). Podrobn\u011b jsme popisovali Red Teaming. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/group-ib\/blog\/460461\/\">zde<\/a><\/noindex>Je d\u016fle\u017eit\u00e9 v\u011bd\u011bt, \u017ee p\u0159i prov\u00e1d\u011bn\u00ed takov\u00e9ho testu m\u016f\u017ee b\u00fdt pou\u017eit velmi \u0161irok\u00fd rozsah \u00fatok\u016f ze p\u0159edem dohodnut\u00fdch, v\u010detn\u011b soci\u00e1ln\u00ed in\u017een\u00fdrstv\u00ed. Je jasn\u00e9, \u017ee um\u00edst\u011bn\u00ed ko\u010dky samo o sob\u011b nebylo kone\u010dn\u00fdm c\u00edlem ud\u00e1lost\u00ed. C\u00edlem bylo n\u00e1sleduj\u00edc\u00ed:<\/p>\n<ul>\n<li>webov\u00fd server \u00fastavu byl um\u00edst\u011bn na serveru uvnit\u0159 s\u00edt\u011b \u00fastavu, nikoli na extern\u00edch serverech;<\/li>\n<li>Byla nalezena \u00fanik \u00fadaj\u016f z person\u00e1ln\u00edho odd\u011blen\u00ed (soubor protokolu e-mail\u016f v ko\u0159enov\u00e9m adres\u00e1\u0159i webu). S t\u00edmto \u00fa\u010dtem nebylo mo\u017en\u00e9 spravovat web, ale mohlo se editovat str\u00e1nky s nab\u00eddkami.<\/li>\n<li>\u00dapravou str\u00e1nek bylo mo\u017en\u00e9 um\u00edstit vlastn\u00ed skripty napsan\u00e9 v jazyce JavaScript. Obvykle \u010din\u00ed str\u00e1nky interaktivn\u00edmi, ale v t\u00e9to situaci mohly tyto skripty ukr\u00e1st z prohl\u00ed\u017ee\u010de n\u00e1v\u0161t\u011bvn\u00edka to, co odli\u0161ovalo person\u00e1ln\u00ed odd\u011blen\u00ed od program\u00e1tora a program\u00e1tora od b\u011b\u017en\u00e9ho n\u00e1v\u0161t\u011bvn\u00edka - ID sezen\u00ed na webu. Ko\u010dka byla spou\u0161t\u011b\u010dem \u00fatoku a obr\u00e1zkem pro p\u0159il\u00e1k\u00e1n\u00ed pozornosti. V jazyce HTML to vypadalo takto: pokud se v\u00e1m na\u010detlo obr\u00e1zek, JavaScript se ji\u017e provedl a va\u0161e ID sezen\u00ed spolu s \u00fadaji o va\u0161em prohl\u00ed\u017ee\u010di a IP adresou u\u017e bylo ukradeno.<\/li>\n<li> S ukraden\u00fdm ID sezen\u00ed administr\u00e1tora by bylo mo\u017en\u00e9 z\u00edskat pln\u00fd p\u0159\u00edstup na web, nahr\u00e1vat spustiteln\u00e9 str\u00e1nky v PHP, a tedy z\u00edskat p\u0159\u00edstup k opera\u010dn\u00edmu syst\u00e9mu serveru, a n\u00e1sledn\u011b i do samotn\u00e9 lok\u00e1ln\u00ed s\u00edt\u011b, co\u017e bylo d\u016fle\u017eit\u00fdm mezikrokem projektu.<\/li>\n<\/ul>\n<p>\n\u00datok skon\u010dil \u010d\u00e1ste\u010dn\u00fdm \u00fasp\u011bchem - ID sezen\u00ed administr\u00e1tora bylo ukradeno, ale bylo v\u00e1z\u00e1no na IP adresu. Poda\u0159ilo se to obej\u00edt, nemohli jsme zv\u00fd\u0161it privilegium na webu na administr\u00e1torsk\u00e9, ale zlep\u0161ili jsme si n\u00e1ladu. Kone\u010dn\u00fd v\u00fdsledek jsme nakonec z\u00edskali na jin\u00e9m m\u00edst\u011b s\u00ed\u0165ov\u00e9 hranice.<\/p>\n<h2>\u010c\u00e1st 2. P\u00ed\u0161u v\u00e1m - co v\u00edc? A tak\u00e9 vol\u00e1m a tlesk\u00e1m u v\u00e1s v kancel\u00e1\u0159i, upou\u0161t\u00edm flash disky.<br \/>\n<\/h2>\n<p>\nTo, co se stalo v situaci s ko\u010dkou - p\u0159\u00edklad soci\u00e1ln\u00ed in\u017een\u00fdrstv\u00ed, a\u010dkoliv ne zcela klasick\u00e9ho. Ve skute\u010dnosti bylo v t\u00e9to p\u0159\u00edb\u011bhu v\u00edce ud\u00e1lost\u00ed: byla ko\u010dka, institut, person\u00e1ln\u00ed odd\u011blen\u00ed, program\u00e1tor, ale byly tak\u00e9 e-maily s up\u0159es\u0148uj\u00edc\u00edmi ot\u00e1zkami, kter\u00e9 jakoby psali \"kandid\u00e1ti\" p\u0159\u00edmo do person\u00e1ln\u00edho odd\u011blen\u00ed a osobn\u011b program\u00e1torovi, aby je vyprovokovali k n\u00e1v\u0161t\u011bv\u011b str\u00e1nky webu.<\/p>\n<blockquote><p>Mimochodem o e-mailech. Obvykl\u00fd e-mail - asi hlavn\u00ed dopravn\u00ed prost\u0159edek pro prov\u00e1d\u011bn\u00ed soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed - neztr\u00e1c\u00ed svou aktu\u00e1lnost u\u017e n\u011bkolik des\u00edtek let a n\u011bkdy vede k nejneobvyklej\u0161\u00edm n\u00e1sledk\u016fm. <\/p><\/blockquote>\n<p>P\u0159\u00edb\u011bh, kter\u00fd \u010dasto vypr\u00e1v\u00edme na na\u0161ich akc\u00edch, proto\u017ee je velmi v\u00fdmluvn\u00fd.<\/p>\n<p>Obvykle na z\u00e1klad\u011b v\u00fdsledk\u016f projekt\u016f se soci\u00e1ln\u00edm in\u017een\u00fdrstv\u00edm sestavujeme statistiku, kter\u00e1, jak je zn\u00e1mo, je v\u011bc\u00ed suchou a nudnou. Tolik procent p\u0159\u00edjemc\u016f otev\u0159elo p\u0159\u00edlohu z e-mailu, tolik p\u0159e\u0161lo na odkaz, a tito t\u0159i dokonce zadali sv\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje a heslo. V jednom projektu jsme z\u00edskali v\u00edce ne\u017e 100% zad\u00e1n\u00ed hesel \u2013 to znamen\u00e1, \u017ee se jich p\u0159ihl\u00e1silo v\u00edce, ne\u017e kolik bylo odesl\u00e1no. <\/p>\n<p>Stalo se to takto: bylo odesl\u00e1no phishingov\u00e9 e-mailov\u00e9 sd\u011blen\u00ed, \u00fadajn\u011b od CISO st\u00e1tn\u00ed korporace, s \u017e\u00e1dost\u00ed \"nal\u00e9hav\u011b otestovat zm\u011bny v e-mailov\u00e9 slu\u017eb\u011b\". E-mail se dostal k vedouc\u00edmu velk\u00e9ho odd\u011blen\u00ed, kter\u00e9 se zab\u00fdvalo technickou podporou. Vedouc\u00ed byl velmi pe\u010dliv\u00fd p\u0159i pln\u011bn\u00ed pokyn\u016f od vysok\u00e9ho veden\u00ed a p\u0159eposlal ho v\u0161em pod\u0159\u00edzen\u00fdm. Samotn\u00fd call centrum byl pom\u011brn\u011b velk\u00fd. Celkov\u011b jsou situace, kdy n\u011bkdo p\u0159epos\u00edl\u00e1 \"zaj\u00edmav\u00e9\" phishingov\u00e9 e-maily sv\u00fdm koleg\u016fm a ti tak\u00e9 nachyt\u00e1ni \u2013 docela \u010dast\u00fdm jevem. Pro n\u00e1s je to nejlep\u0161\u00ed zp\u011btn\u00e1 vazba k kvalit\u011b seps\u00e1n\u00ed e-mailu.<\/p>\n<p><img decoding=\"async\" alt=\"Oklam m\u011b, pokud m\u016f\u017ee\u0161: rysy prov\u00e1d\u011bn\u00ed sociotechnick\u00e9ho pentestu\" src=\"\/wp-content\/uploads\/2020\/01\/2af30148f4b5d22033c5137625f421ab.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMalou chv\u00edli pot\u00e9 n\u00e1s prokoukli (e-mail byl sta\u017een z kompromitovan\u00e9 po\u0161tovn\u00ed schr\u00e1nky):<\/p>\n<p><img decoding=\"async\" alt=\"Oklam m\u011b, pokud m\u016f\u017ee\u0161: rysy prov\u00e1d\u011bn\u00ed sociotechnick\u00e9ho pentestu\" src=\"\/wp-content\/uploads\/2020\/01\/1d36db3cb55d0e6d6061fb002d5f987a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTakov\u00fd \u00fasp\u011bch \u00fatoku byl zp\u016fsoben t\u00edm, \u017ee p\u0159i rozes\u00edl\u00e1n\u00ed byly vyu\u017eity ur\u010dit\u00e9 technick\u00e9 nedostatky po\u0161tovn\u00edho syst\u00e9mu klienta. Byl nastaven tak, \u017ee bylo mo\u017en\u00e9 pos\u00edlat jak\u00e9koliv e-maily jm\u00e9nem jak\u00e9hokoliv odes\u00edlatele samotn\u00e9 organizace bez autorizace, dokonce i z internetu. To znamen\u00e1, \u017ee se dalo vyd\u00e1vat za CISO, nebo vedouc\u00edho technick\u00e9 podpory, nebo n\u011bkoho jin\u00e9ho. Co v\u00edce, po\u0161tovn\u00ed rozhran\u00ed, kdy\u017e sledovalo e-maily z \"vlastn\u00ed\" dom\u00e9ny, pe\u010dliv\u011b p\u0159i\u0159adilo fotografii z adres\u00e1\u0159e, co\u017e dod\u00e1valo p\u0159irozenost odes\u00edlateli.<\/p>\n<p>Oprava, takov\u00fd \u00fatok nepat\u0159\u00ed mezi zvl\u00e1\u0161\u0165 slo\u017eit\u00e9 technologie, je to \u00fasp\u011b\u0161n\u00e1 exploatace zcela z\u00e1kladn\u00edho nedostatku nastaven\u00ed po\u0161ty. Pravideln\u011b se o tom diskutuje na odborn\u00fdch IT a bezpe\u010dnostn\u00edch zdroj\u00edch, ale p\u0159esto se st\u00e1le setk\u00e1vaj\u00ed spole\u010dnosti, kter\u00e9 to maj\u00ed. Proto\u017ee nikdo nen\u00ed ochoten d\u016fkladn\u011b kontrolovat slu\u017eebn\u00ed hlavi\u010dky po\u0161tovn\u00edho protokolu SMTP, e-mail se obvykle kontroluje na \"nebezpe\u010dnost\" podle varovn\u00fdch symbol\u016f po\u0161tovn\u00edho rozhran\u00ed, kter\u00e9 ne v\u017edy ukazuj\u00ed celou situaci.<\/p>\n<blockquote><p>Je zaj\u00edmav\u00e9, \u017ee tato zranitelnost funguje i opa\u010dn\u00fdm sm\u011brem: \u00fato\u010dn\u00edk m\u016f\u017ee poslat e-mail jm\u00e9nem va\u0161\u00ed spole\u010dnosti t\u0159et\u00ed stran\u011b. Nap\u0159\u00edklad m\u016f\u017ee zmanipulovat fakturu na pravidelnou platbu va\u0161\u00edm jm\u00e9nem, p\u0159i\u010dem\u017e m\u00edsto va\u0161ich \u00fadaj\u016f uvede jin\u00e9. Pokud nezva\u017eujeme ot\u00e1zky podvod\u016f a v\u00fdb\u011bru pen\u011bz, je to pravd\u011bpodobn\u011b jeden z nejjednodu\u0161\u0161\u00edch zp\u016fsob\u016f, jak ukr\u00e1st pen\u00edze pomoc\u00ed soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed.\n<\/p><\/blockquote>\n<p> Krom\u011b kr\u00e1de\u017ee hesel prost\u0159ednictv\u00edm phishingu je klasikou sociotechnick\u00fdch \u00fatok\u016f rozes\u00edl\u00e1n\u00ed spustiteln\u00fdch p\u0159\u00edloh. Pokud tyto p\u0159\u00edlohy p\u0159ekonaj\u00ed v\u0161echny ochrann\u00e9 prost\u0159edky, kter\u00e9 maj\u00ed modern\u00ed spole\u010dnosti obvykle, vytvo\u0159\u00ed se kan\u00e1l vzd\u00e1len\u00e9ho p\u0159\u00edstupu k po\u010d\u00edta\u010di ob\u011bti. Pro demonstraci n\u00e1sledk\u016f \u00fatoku lze z\u00edskan\u00e9 vzd\u00e1len\u00e9 \u0159\u00edzen\u00ed rozvinout a\u017e k p\u0159\u00edstupu k obzvl\u00e1\u0161\u0165 d\u016fle\u017eit\u00fdm d\u016fv\u011brn\u00fdm informac\u00edm. Zaj\u00edmav\u00e9 je, \u017ee drtiv\u00e1 v\u011bt\u0161ina \u00fatok\u016f, kter\u00fdmi n\u00e1s m\u00e9dia stra\u0161\u00ed, za\u010d\u00edn\u00e1 pr\u00e1v\u011b takto. <\/p>\n<blockquote><p>V na\u0161em auditn\u00edm odd\u011blen\u00ed pro zaj\u00edmavost po\u010d\u00edt\u00e1me p\u0159ibli\u017enou statistiku: jak\u00e1 je celkov\u00e1 hodnota aktiv spole\u010dnost\u00ed, ke kter\u00fdm jsme z\u00edskali p\u0159\u00edstup na \u00farovni 'Dom\u00e9nov\u00fd administr\u00e1tor' p\u0159ev\u00e1\u017en\u011b d\u00edky phishingu a rozes\u00edl\u00e1n\u00ed spustiteln\u00fdch p\u0159\u00edloh? V tomto roce dos\u00e1hla zhruba 150 miliard eur.\n<\/p><\/blockquote>\n<p> Je jasn\u00e9, \u017ee rozes\u00edl\u00e1n\u00ed provokativn\u00edch e-mail\u016f a umis\u0165ov\u00e1n\u00ed fotografi\u00ed ko\u010dek na weby nejsou jedin\u00e9 zp\u016fsoby soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed. V t\u011bchto p\u0159\u00edkladech jsme se sna\u017eili uk\u00e1zat rozmanitost forem \u00fatok\u016f a jejich n\u00e1sledk\u016f. Krom\u011b e-mail\u016f m\u016f\u017ee potenci\u00e1ln\u00ed \u00fato\u010dn\u00edk volat, aby z\u00edskal pot\u0159ebn\u00e9 informace, roz\u0161i\u0159ovat nosi\u010de (nap\u0159\u00edklad USB flash disky) se spustiteln\u00fdmi soubory v kancel\u00e1\u0159i c\u00edlov\u00e9 spole\u010dnosti, uch\u00e1zet se o pr\u00e1ci jako st\u00e1\u017eista, nebo z\u00edskat fyzick\u00fd p\u0159\u00edstup k m\u00edstn\u00ed s\u00edti pod z\u00e1minkou technika kamerov\u00e9ho syst\u00e9mu. To v\u0161e, mimochodem, jsou p\u0159\u00edklady z na\u0161ich \u00fasp\u011b\u0161n\u011b dokon\u010den\u00fdch projekt\u016f.<\/p>\n<h2>\u010c\u00e1st 3. U\u010den\u00ed je sv\u011btlo, zat\u00edmco neznal\u00ed jsou tma.<\/h2>\n<p>\nVyskytuje se rozumn\u00e1 ot\u00e1zka: dob\u0159e, existuje soci\u00e1ln\u00ed in\u017een\u00fdrstv\u00ed, vypad\u00e1 to nebezpe\u010dn\u011b, co s t\u00edm v\u0161\u00edm d\u011blat firmy? Na pomoc p\u0159ich\u00e1z\u00ed Kapit\u00e1n O\u010dividnost: je t\u0159eba se br\u00e1nit, a to komplexn\u011b. \u010c\u00e1st ochrany bude zam\u011b\u0159ena na ji\u017e klasick\u00e1 bezpe\u010dnostn\u00ed opat\u0159en\u00ed, jako jsou technick\u00e1 ochrana informac\u00ed, monitorov\u00e1n\u00ed, organiza\u010dn\u011b-pr\u00e1vn\u00ed zabezpe\u010den\u00ed proces\u016f, ale v\u011bt\u0161ina by podle na\u0161eho n\u00e1zoru m\u011bla sm\u011b\u0159ovat na p\u0159\u00edmou pr\u00e1ci se zam\u011bstnanci jako se slab\u00fdm \u010dl\u00e1nkem. A\u0165 u\u017e pos\u00edl\u00edte techniku, nebo nap\u00ed\u0161ete p\u0159\u00edsn\u00e9 p\u0159edpisy, v\u017edycky se najde u\u017eivatel, kter\u00fd vymysl\u00ed nov\u00fd zp\u016fsob, jak v\u0161echno zni\u010dit. A ani p\u0159edpisy, ani technika nebudou sta\u010dit za kreativitou u\u017eivatele, zvl\u00e1\u0161\u0165 pokud mu pom\u00e1h\u00e1 kvalifikovan\u00fd zlo\u010dinec.<\/p>\n<blockquote><p> V prvn\u00ed \u0159ad\u011b je d\u016fle\u017eit\u00e9 \u0161kolit u\u017eivatele: vysv\u011btlit, \u017ee i v jeho b\u011b\u017en\u00e9 pr\u00e1ci se mohou vyskytnout situace souvisej\u00edc\u00ed se soci\u00e1ln\u00edm in\u017een\u00fdrstv\u00edm. Pro na\u0161e klienty \u010dasto po\u0159\u00e1d\u00e1me <noindex><a rel=\"nofollow\" href=\"https:\/\/www.group-ib.ru\/cyber-education.html\">kurzy<\/a><\/noindex> digit\u00e1ln\u00ed hygieny \u2013 ud\u00e1lost, kter\u00e1 u\u010d\u00ed z\u00e1kladn\u00edm dovednostem na obranu proti \u00fatok\u016fm obecn\u011b.\n<\/p><\/blockquote>\n<p> Mohu dodat, \u017ee jedn\u00edm z nejlep\u0161\u00edch opat\u0159en\u00ed ochrany nebude ani tak memorov\u00e1n\u00ed pravidel informa\u010dn\u00ed bezpe\u010dnosti, jako sp\u00ed\u0161e tro\u0161ku distancovan\u00e1 evaluace situace: <\/p>\n<ol>\n<li>Kdo je m\u016fj rozhovorov\u00fd partner? <\/li>\n<li>Odkud se vzala jeho nab\u00eddka \u010di prosba (nikdy n\u011bco takov\u00e9ho nebylo, a te\u010f se objevilo)? <\/li>\n<li>Co je na tomto po\u017eadavku neobvykl\u00e9ho? <\/li>\n<\/ol>\n<p>\nI neobvykl\u00fd typ p\u00edsma nebo nezvykl\u00fd styl \u0159e\u010di odes\u00edlatele m\u016f\u017ee spustit \u0159et\u011bzec pochybnost\u00ed, kter\u00fd zastav\u00ed \u00fatok. Napsan\u00e9 pokyny jsou tak\u00e9 pot\u0159ebn\u00e9, ale funguj\u00ed jinak a nemohou konkretizovat v\u0161echny mo\u017en\u00e9 situace. Nap\u0159\u00edklad spr\u00e1vcov\u00e9 IT bezpe\u010dnosti v nich uv\u00e1d\u011bj\u00ed, \u017ee nen\u00ed dovoleno zad\u00e1vat sv\u00e9 heslo na ciz\u00edch str\u00e1nk\u00e1ch. Co v\u0161ak, kdy\u017e heslo \u017e\u00e1d\u00e1 \"sv\u00e9\", \"korpor\u00e1tn\u00ed\" s\u00ed\u0165ov\u00fd zdroj? U\u017eivatel si pomysl\u00ed: \u201eV na\u0161\u00ed spole\u010dnosti je u\u017e dvacet slu\u017eeb s jedn\u00edm u\u017eivatelsk\u00fdm \u00fa\u010dtem, pro\u010d by nemohla vzniknout dal\u0161\u00ed?\u201c Odtud vypl\u00fdv\u00e1 dal\u0161\u00ed pravidlo: dob\u0159e nastaven\u00fd pracovn\u00ed proces rovn\u011b\u017e p\u0159\u00edmo ovliv\u0148uje bezpe\u010dnost: pokud m\u016f\u017ee sousedn\u00ed odd\u011blen\u00ed po\u017e\u00e1dat o informace pouze p\u00edsemn\u011b a pouze prost\u0159ednictv\u00edm va\u0161eho nad\u0159\u00edzen\u00e9ho, osoba \u201eod d\u016fv\u011bryhodn\u00e9ho obchodn\u00edho partnera\u201c se u\u017e nem\u016f\u017ee zeptat po telefonu \u2014 pro v\u00e1s to bude nesmysl. Zvl\u00e1\u0161\u0165 pozor byste m\u011bli d\u00e1vat, pokud v\u00e1\u0161 prot\u011bj\u0161ek po\u017eaduje, abyste v\u0161echno ud\u011blali hned, nebo \u201eASAP\u201c, jak je m\u00f3dn\u00ed ps\u00e1t. I v b\u011b\u017en\u00e9 pr\u00e1ci takov\u00e1 situace \u010dasto nen\u00ed zdrav\u00e1, a v p\u0159\u00edpad\u011b mo\u017en\u00fdch \u00fatok\u016f je to siln\u00fd spou\u0161t\u011b\u010d. Nen\u00ed \u010das vysv\u011btlovat, spus\u0165te m\u016fj soubor!<\/p>\n<p>V\u0161imneme si, \u017ee na u\u017eivatele jako legendy pro sociotechnick\u00fd \u00fatok v\u017edy p\u016fsob\u00ed t\u00e9mata souvisej\u00edc\u00ed s pen\u011bzi v r\u016fzn\u00e9 form\u011b: slib zv\u00fd\u0161en\u00ed, v\u00fdhod, dar\u016f, jako\u017e i informace \u00fadajn\u011b o m\u00edstn\u00edch drbech a intrik\u00e1ch. Jin\u00fdmi slovy, funguj\u00ed b\u011b\u017en\u00e9 \u201esmrteln\u00e9 h\u0159\u00edchy\u201c: lakota, chamtivost a nadm\u011brn\u00e1 zv\u011bdavost. <\/p>\n<p>Dobr\u00e9 \u0161kolen\u00ed by v\u017edy m\u011blo zahrnovat praxi. Zde mohou pomoci specialist\u00e9 na penetra\u010dn\u00ed testov\u00e1n\u00ed. Dal\u0161\u00ed ot\u00e1zka zn\u00ed: co a jak budeme testovat? V Group-IB nab\u00edz\u00edme n\u00e1sleduj\u00edc\u00ed p\u0159\u00edstup \u2014 nejprve vybrat zam\u011b\u0159en\u00ed testov\u00e1n\u00ed: bu\u010f hodnotit p\u0159ipravenost na \u00fatoky samotn\u00fdch u\u017eivatel\u016f, nebo prov\u011b\u0159ovat zabezpe\u010den\u00ed spole\u010dnosti jako celku. A testovat metodami soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed, napodobuj\u00edc\u00edmi skute\u010dn\u00e9 \u00fatoky \u2014 tedy stejn\u00fdmi phishingov\u00fdmi technikami, rozes\u00edl\u00e1n\u00edm spustiteln\u00fdch dokument\u016f, telefon\u00e1ty a dal\u0161\u00edmi technikami.<\/p>\n<p>V prvn\u00edm p\u0159\u00edpad\u011b je \u00fatok pe\u010dliv\u011b p\u0159ipravov\u00e1n ve spolupr\u00e1ci s p\u0159edstaviteli objednatele, p\u0159ev\u00e1\u017en\u011b s jeho IT a bezpe\u010dnostn\u00edmi specialisty. Dohodnou se legendy, n\u00e1stroje a techniky \u00fatok\u016f. Objednatel s\u00e1m poskytuje c\u00edlov\u00e9 skupiny a seznamy u\u017eivatel\u016f pro \u00fatok, kter\u00e9 zahrnuj\u00ed v\u0161echny pot\u0159ebn\u00e9 kontakty. Vytv\u00e1\u0159ej\u00ed se v\u00fdjimky na ochrann\u00fdch prost\u0159edc\u00edch, proto\u017ee zpr\u00e1vy a spou\u0161t\u011bc\u00ed z\u00e1t\u011b\u017ee mus\u00ed nutn\u011b dorazit k p\u0159\u00edjemci, nebo\u0165 v takov\u00e9m projektu je zaj\u00edmav\u00e1 pouze reakce lid\u00ed. Voliteln\u011b lze do \u00fatoku zakomponovat zna\u010dky, podle kter\u00fdch se u\u017eivatel m\u016f\u017ee domyslet, \u017ee se jedn\u00e1 o \u00fatok \u2014 nap\u0159\u00edklad lze ud\u011blat p\u00e1r pravopisn\u00fdch chyb v zpr\u00e1v\u00e1ch nebo ponechat nep\u0159esnosti v kop\u00edrov\u00e1n\u00ed firemn\u00edho stylu. Po ukon\u010den\u00ed projektu vznik\u00e1 ta prav\u00e1 \u201esuch\u00e1 statistika\u201d: kter\u00e9 c\u00edlov\u00e9 skupiny a v jak\u00e9m objemu reagovaly na sc\u00e9n\u00e1\u0159e.<\/p>\n<p>Ve druh\u00e9m p\u0159\u00edpad\u011b \u2014 \u00fatok je prov\u00e1d\u011bn s nulov\u00fdmi po\u010d\u00e1te\u010dn\u00edmi znalostmi, metodou \u201e\u010dern\u00e9 sk\u0159\u00ed\u0148ky\u201c. Sami shroma\u017e\u010fujeme informace o spole\u010dnosti, jej\u00edch zam\u011bstnanc\u00edch, s\u00ed\u0165ov\u00e9m perimetru, formulujeme legendy pro \u00fatok, vyb\u00edr\u00e1me metody, hled\u00e1me mo\u017en\u00e9 ochrann\u00e9 prost\u0159edky vyu\u017e\u00edvan\u00e9 c\u00edlovou spole\u010dnost\u00ed, p\u0159izp\u016fsobujeme n\u00e1stroje a sestavujeme sc\u00e9n\u00e1\u0159e. Na\u0161i specialist\u00e9 pou\u017e\u00edvaj\u00ed jak klasick\u00e9 metody zpravodajstv\u00ed z otev\u0159en\u00fdch zdroj\u016f (OSINT), tak vlastn\u00ed produkt spole\u010dnosti Group-IB \u2014 Threat Intelligence, syst\u00e9m, kter\u00fd m\u016f\u017ee p\u0159i p\u0159\u00edprav\u011b na phishing fungovat jako agreg\u00e1tor informac\u00ed o spole\u010dnosti po del\u0161\u00ed obdob\u00ed, v\u010detn\u011b uzav\u0159en\u00fdch informac\u00ed. Samoz\u0159ejm\u011b, aby \u00fatok nebyl nep\u0159\u00edjemn\u00fdm p\u0159ekvapen\u00edm, tak\u00e9 se dohoduj\u00ed detaily s objednatelem. Z\u00edsk\u00e1v\u00e1 se plnohodnotn\u00fd test na pr\u016fnik, ale jeho z\u00e1kladem bude pokro\u010dil\u00e1 soci\u00e1ln\u00ed in\u017een\u00fdrstv\u00ed. Logickou volbou v takov\u00e9m p\u0159\u00edpad\u011b je roz\u0161\u00ed\u0159en\u00ed \u00fatoku uvnit\u0159 s\u00edt\u011b a\u017e k z\u00edsk\u00e1n\u00ed nejvy\u0161\u0161\u00edch pr\u00e1v v intern\u00edch syst\u00e9mech. Mimochodem, podobn\u00fdm zp\u016fsobem aplikujeme sociotechnick\u00e9 \u00fatoky i v <noindex><a rel=\"nofollow\" href=\"https:\/\/www.group-ib.ru\/red-teaming.html\">Red Teaming<\/a><\/noindex>, a v n\u011bkter\u00fdch testech na pr\u016fnik. V d\u016fsledku toho objednatel z\u00edsk\u00e1 nez\u00e1visl\u00fd komplexn\u00ed pohled na svou ochranu p\u0159ed ur\u010dit\u00fdm typem sociotechnick\u00fdch \u00fatok\u016f, stejn\u011b jako demonstraci \u00fa\u010dinnosti (nebo naopak ne\u00fa\u010dinnosti) vybudovan\u00e9 obrann\u00e9 linie proti vn\u011bj\u0161\u00edm hrozb\u00e1m.<\/p>\n<p>Doporu\u010dujeme prov\u00e1d\u011bt takov\u00e9 \u0161kolen\u00ed minim\u00e1ln\u011b dvakr\u00e1t ro\u010dn\u011b. Za prv\u00e9, v ka\u017ed\u00e9 spole\u010dnosti je vysok\u00e1 fluktuace zam\u011bstnanc\u016f a p\u0159edchoz\u00ed zku\u0161enosti se postupn\u011b zapom\u00ednaj\u00ed. Za druh\u00e9, neust\u00e1le se m\u011bn\u00ed metody a techniky \u00fatok\u016f, co\u017e vede k nutnosti p\u0159izp\u016fsobit bezpe\u010dnostn\u00ed procesy a ochrann\u00e9 prost\u0159edky.<\/p>\n<p>Pokud hovo\u0159\u00edme o technick\u00fdch opat\u0159en\u00edch na ochranu p\u0159ed \u00fatoky, nejv\u00edce pom\u00e1haj\u00ed n\u00e1sleduj\u00edc\u00ed:<\/p>\n<ul>\n<li>Povinn\u00e1 dvoufaktorov\u00e1 autentizace na slu\u017eb\u00e1ch, kter\u00e9 jsou publikov\u00e1ny na internetu. Spou\u0161t\u011bt v roce 2019 takov\u00e9 slu\u017eby bez syst\u00e9m\u016f Single Sign On, bez ochrany proti prolomen\u00ed hesel a bez dvoufaktorov\u00e9 autentizace ve spole\u010dnosti o n\u011bkolika stovk\u00e1ch lid\u00ed je rovno otev\u0159en\u00e9 v\u00fdzv\u011b \"rozbij m\u011b\". Spr\u00e1vn\u011b implementovan\u00e1 ochrana u\u010din\u00ed rychl\u00e9 pou\u017eit\u00ed ukraden\u00fdch hesel nemo\u017en\u00fdm a poskytne \u010das na odstran\u011bn\u00ed n\u00e1sledk\u016f phishingov\u00e9ho \u00fatoku.<\/li>\n<li>Kontrola p\u0159\u00edstupov\u00fdch opr\u00e1vn\u011bn\u00ed, minimalizace pr\u00e1v u\u017eivatel\u016f v syst\u00e9mech a dodr\u017eov\u00e1n\u00ed pokyn\u016f pro bezpe\u010dn\u00e9 nastaven\u00ed produkt\u016f, kter\u00e9 vyd\u00e1v\u00e1 ka\u017ed\u00fd v\u00fdznamn\u00fd v\u00fdrobce. To jsou \u010dasto jednoduch\u00e1, ale velmi efektivn\u00ed a obt\u00ed\u017en\u00e1 opat\u0159en\u00ed v praktick\u00e9 realizaci, kter\u00fdmi se v\u0161ichni do jist\u00e9 m\u00edry zanedb\u00e1vaj\u00ed ve prosp\u011bch rychlosti pr\u00e1ce. N\u011bkter\u00e1 jsou natolik nezbytn\u00e1, \u017ee bez nich \u017e\u00e1dn\u00fd ochrann\u00fd prost\u0159edek nepom\u016f\u017ee.<\/li>\n<li>Dob\u0159e nastaven\u00e1 filtra\u010dn\u00ed linie pro elektronickou po\u0161tu. Antispam, celkov\u00e1 kontrola p\u0159\u00edloh na p\u0159\u00edtomnost \u0161kodliv\u00e9ho k\u00f3du, v\u010detn\u011b dynamick\u00e9ho testov\u00e1n\u00ed p\u0159es sandboxy. Dob\u0159e p\u0159ipraven\u00fd \u00fatok vy\u017eaduje, aby vykon\u00e1van\u00e1 p\u0159\u00edloha nebyla detekov\u00e1na antivirov\u00fdmi prost\u0159edky. Sandbox naopak zkontroluje v\u0161e na sob\u011b, pou\u017e\u00edvaj\u00edc\u00ed soubory tak, jak je pou\u017e\u00edv\u00e1 \u010dlov\u011bk. V d\u016fsledku toho bude potenci\u00e1ln\u00ed \u0161kodliv\u00e1 slo\u017eka odhalena na z\u00e1klad\u011b prov\u00e1d\u011bn\u00fdch zm\u011bn uvnit\u0159 sandboxu.<\/li>\n<li>Ochrana proti c\u00edlen\u00fdm \u00fatok\u016fm. Jak ji\u017e bylo uvedeno, klasick\u00e9 antivirov\u00e9 programy nebudou detekovat \u0161kodliv\u00e9 soubory p\u0159i dob\u0159e napl\u00e1novan\u00e9m \u00fatoku. Nejpokro\u010dilej\u0161\u00ed produkty by m\u011bly automaticky sledovat souhrn ud\u00e1lost\u00ed, kter\u00e9 se d\u011bj\u00ed v s\u00edti \u2014 jak na \u00farovni jednotliv\u00e9ho hostitele, tak na \u00farovni provozu uvnit\u0159 s\u00edt\u011b. P\u0159i \u00fatoc\u00edch se projevuj\u00ed velmi charakteristick\u00e9 \u0159et\u011bzce ud\u00e1lost\u00ed, kter\u00e9 lze vystopovat a zastavit, pokud se pou\u017e\u00edv\u00e1 zam\u011b\u0159en\u00fd monitoring t\u011bchto ud\u00e1lost\u00ed.<\/li>\n<\/ul>\n<p>\nOrigin\u00e1l \u010dl\u00e1nku <noindex><a rel=\"nofollow\" href=\"http:\/\/lib.itsec.ru\/articles2\/Oborandteh\/obmani-menya--esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta\">byla vyd\u00e1na<\/a><\/noindex> v \u010dasopisu \u201eInformation Security\/ Informa\u010dn\u00ed bezpe\u010dnost\u201c \u010d. 6, 2019.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/group-ib\/blog\/483652\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435 \u0441\u0435\u0431\u0435 \u0442\u0430\u043a\u0443\u044e \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e. \u0425\u043e\u043b\u043e\u0434\u043d\u043e\u0435 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0435 \u0443\u0442\u0440\u043e, \u043f\u0440\u043e\u0435\u043a\u0442\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u043d\u043e\u043c \u0446\u0435\u043d\u0442\u0440\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0440\u0435\u0433\u0438\u043e\u043d\u043e\u0432 \u0420\u043e\u0441\u0441\u0438\u0438. \u041a\u0442\u043e-\u0442\u043e \u0438\u0437 \u043e\u0442\u0434\u0435\u043b\u0430 \u043a\u0430\u0434\u0440\u043e\u0432 \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043d\u0430 \u043e\u0434\u043d\u0443 \u0438\u0437 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0432\u0430\u043a\u0430\u043d\u0441\u0438\u0439 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442\u0430, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434, \u0438 \u0432\u0438\u0434\u0438\u0442 \u0442\u0430\u043c \u0444\u043e\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e \u043a\u043e\u0442\u0430. \u0423\u0442\u0440\u043e \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043a\u0443\u0447\u043d\u044b\u043c\u2026 \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u041f\u0430\u0432\u0435\u043b \u0421\u0443\u043f\u0440\u0443\u043d\u044e\u043a, \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0434\u0435\u043f\u0430\u0440\u0442\u0430\u043c\u0435\u043d\u0442\u0430 \u0430\u0443\u0434\u0438\u0442\u0430 \u0438 \u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433\u0430 Group-IB, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55145","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043c\u0430\u043d\u0438 \u043c\u0435\u043d\u044f, \u0435\u0441\u043b\u0438 \u0441\u043c\u043e\u0436\u0435\u0448\u044c: \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u043e\u0446\u0438\u043e\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-01-12T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:03:13+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Oklam m\u011b, pokud m\u016f\u017ee\u0161: charakteristiky prov\u00e1d\u011bn\u00ed socio-technick\u00e9ho penetra\u010dn\u00edho testu | ProHoster","description":"P\u0159edstavte si.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043c\u0430\u043d\u0438 \u043c\u0435\u043d\u044f, \u0435\u0441\u043b\u0438 \u0441\u043c\u043e\u0436\u0435\u0448\u044c: \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u043e\u0446\u0438\u043e\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0430 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55145","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:50:02","updated":"2022-09-29 07:35:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=55145"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55145\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=55145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=55145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=55145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}