{"id":96228,"date":"2020-10-09T19:42:19","date_gmt":"2020-10-09T17:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit"},"modified":"2020-10-09T19:42:19","modified_gmt":"2020-10-09T17:42:19","slug":"nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","title":{"rendered":"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/b57d6aa03463566d8f17c4b51246a07e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Antivirov\u00e9 spole\u010dnosti, experti na kybernetickou bezpe\u010dnost a prost\u00ed nad\u0161enci zve\u0159ej\u0148uj\u00ed na internetu syst\u00e9my-lap\u00e1ky \u2014 honeypoty, aby \u201echytli na \u017eivce\u201c novou variantu viru nebo odhalili neobvyklou hackerskou taktiku. Honeypoty se vyskytuj\u00ed tak \u010dasto, \u017ee si kyberzlo\u010dinci vyvinuli ur\u010ditou imunitu: rychle zjist\u00ed, \u017ee p\u0159ed nimi je past a prost\u011b ji ignoruj\u00ed. Abychom prozkoumali taktiku modern\u00edch hacker\u016f, vytvo\u0159ili jsme realistick\u00fd honeypot, kter\u00fd po dobu sedmi m\u011bs\u00edc\u016f \u017eil na internetu a p\u0159itahoval nejr\u016fzn\u011bj\u0161\u00ed \u00fatoky. O tom, jak to prob\u00edhalo, jsme se pod\u011blili v na\u0161em v\u00fdzkumu \u201e<noindex><a rel=\"nofollow\" href=\"https:\/\/documents.trendmicro.com\/assets\/white_papers\/wp-caught-in-the-act-running-a-realistic-factory-honeypot-to-capture-real-threats.pdf\">Chyceni p\u0159i \u010dinu: Provozov\u00e1n\u00ed realistick\u00e9ho honeypotu ve fabrice pro zachycen\u00ed skute\u010dn\u00fdch hrozeb<\/a><\/noindex>\u201c. N\u011bkter\u00e9 fakty z v\u00fdzkumu \u2014 v tomto p\u0159\u00edsp\u011bvku. <\/i><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>V\u00fdvoj honeypotu: kontroln\u00ed seznam<\/h3>\n<p>\nHlavn\u00edm \u00fakolem p\u0159i vytv\u00e1\u0159en\u00ed na\u0161\u00ed superlapa\u010dky bylo nedopustit, aby n\u00e1s odhalili hacke\u0159i, kte\u0159\u00ed projevili z\u00e1jem. K tomu bylo t\u0159eba vykonat zna\u010dn\u00e9 \u00fasil\u00ed: <\/p>\n<ol>\n<li>Vytvo\u0159it realistickou legendu o spole\u010dnosti, zahrnuj\u00edc\u00ed jm\u00e9na a fotografie zam\u011bstnanc\u016f, telefonn\u00ed \u010d\u00edsla a e-maily.<\/li>\n<li>Vymyslet a realizovat model pr\u016fmyslov\u00e9 infrastruktury, odpov\u00eddaj\u00edc\u00ed legend\u011b o \u010dinnosti na\u0161\u00ed spole\u010dnosti. <\/li>\n<li>Rozhodnout, jak\u00e9 s\u00ed\u0165ov\u00e9 slu\u017eby budou dostupn\u00e9 z venku, ale p\u0159itom se nezapl\u00e9st do otev\u00edr\u00e1n\u00ed zraniteln\u00fdch port\u016f, aby to nevypadalo jako past pro naivky. <\/li>\n<li>Zorganizovat viditelnost \u00faniku informac\u00ed o zraniteln\u00e9 syst\u00e9mu a \u0161\u00ed\u0159it tyto informace mezi potenci\u00e1ln\u00edmi \u00fato\u010dn\u00edky.<\/li>\n<li>Realizovat nen\u00e1padn\u00e9 sledov\u00e1n\u00ed \u010dinnost\u00ed hacker\u016f v infrastruktu\u0159e pasti. <\/li>\n<\/ol>\n<p>\nA te\u010f v\u0161e postupn\u011b.<\/p>\n<h3><b>Vytv\u00e1\u0159\u00edme legendu<\/b><\/h3>\n<p>\nKyberzlo\u010dinci si ji\u017e zvykli, \u017ee se setk\u00e1vaj\u00ed s mnoha honeypoty, a proto nejpokro\u010dilej\u0161\u00ed z nich prov\u00e1d\u011bj\u00ed podrobn\u00e9 zkoum\u00e1n\u00ed ka\u017ed\u00e9ho zraniteln\u00e9ho syst\u00e9mu, aby se ujistili, \u017ee to nen\u00ed past. Z toho d\u016fvodu jsme se sna\u017eili dos\u00e1hnout nejen realismu honeypotu z pohledu designu a technick\u00fdch aspekt\u016f, ale tak\u00e9 vytvo\u0159it dojem skute\u010dn\u00e9 spole\u010dnosti.<\/p>\n<p>P\u0159edstavili jsme si, \u017ee jsme hypotetick\u00fd kulhacker, a vyvinuli jsme kontroln\u00ed algoritmus, kter\u00fd by rozli\u0161oval skute\u010dn\u00fd syst\u00e9m od pasti. Ten zahrnoval hled\u00e1n\u00ed IP adres spole\u010dnosti v reputa\u010dn\u00edch syst\u00e9mech, reverzn\u00ed zkoum\u00e1n\u00ed historie IP adres, vyhled\u00e1v\u00e1n\u00ed n\u00e1zv\u016f a kl\u00ed\u010dov\u00fdch slov vztahuj\u00edc\u00edch se ke spole\u010dnosti, a tak\u00e9 k jej\u00edm partner\u016fm a mnoha dal\u0161\u00edm v\u011bcem. Nakonec legenda byla velmi p\u0159esv\u011bd\u010div\u00e1 a p\u0159ita\u017eliv\u00e1.<\/p>\n<p>Rozhodli jsme se pozicionovat tov\u00e1rnu-past jako mal\u00fd butik pr\u016fmyslov\u00e9ho prototypov\u00e1n\u00ed, kter\u00fd pracuje pro velmi velk\u00e9 anonymn\u00ed z\u00e1kazn\u00edky z vojensk\u00e9ho a leteck\u00e9ho sektoru. To n\u00e1s zbavilo pr\u00e1vn\u00edch slo\u017eitost\u00ed spojen\u00fdch s pou\u017e\u00edv\u00e1n\u00edm existuj\u00edc\u00ed zna\u010dky.<\/p>\n<p>D\u00e1le jsme museli vymyslet vizi, misi a n\u00e1zev organizace. Rozhodli jsme se, \u017ee na\u0161e spole\u010dnost bude startup s mal\u00fdm po\u010dtem zam\u011bstnanc\u016f, ka\u017ed\u00fd z nich\u017e je zakladatelem. To dod\u00e1valo p\u0159esv\u011bd\u010divosti legend\u011b o specializaci na\u0161\u00ed spole\u010dnosti, co\u017e j\u00ed umo\u017e\u0148uje pracovat s delik\u00e1tn\u00edmi projekty pro velk\u00e9 a d\u016fle\u017eit\u00e9 z\u00e1kazn\u00edky. Cht\u011bli jsme, aby na\u0161e spole\u010dnost vypadala slab\u00e1 z hlediska kybernetick\u00e9 bezpe\u010dnosti, ale z\u00e1rove\u0148 bylo jasn\u00e9, \u017ee pracujeme s d\u016fle\u017eit\u00fdmi aktivy v c\u00edlov\u00fdch syst\u00e9mech.<\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/cefb9d754e08689bc4cedc91efa53bdc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Screenshot webov\u00fdch str\u00e1nek honeypot MeTech. Zdroj: Trend Micro<\/i><\/p>\n<p>Jako n\u00e1zev spole\u010dnosti jsme zvolili slovo MeTech. Web jsme vytvo\u0159ili na z\u00e1klad\u011b bezplatn\u00e9 \u0161ablony. Obrazov\u00e9 materi\u00e1ly jsme vzali z fotobank, p\u0159i\u010dem\u017e jsme vyu\u017eili nejm\u00e9n\u011b popul\u00e1rn\u00ed a upravili je, aby byly m\u00e9n\u011b rozpoznateln\u00e9. <\/p>\n<p>Cht\u011bli jsme, aby spole\u010dnost vypadala re\u00e1ln\u011b, proto bylo nutn\u00e9 p\u0159idat do jej\u00ed struktury zam\u011bstnance s profesion\u00e1ln\u00edmi dovednostmi odpov\u00eddaj\u00edc\u00edmi profil\u016fm \u010dinnosti. Vymysleli jsme pro n\u011b jm\u00e9na a osobnosti a pak jsme se sna\u017eili vybrat obr\u00e1zky z fotobank podle etnick\u00e9ho p\u016fvodu. <\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/3b7fa0a8287500349c0a25aa464fee2a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i><i>Screenshot webov\u00fdch str\u00e1nek honeypot MeTech. Zdroj: Trend Micro<\/i><\/i><\/p>\n<p>Abychom nebyli odhaleni, hledali jsme skupinov\u00e9 fotografie kvalitn\u00edho proveden\u00ed, ze kter\u00fdch jsme mohli vybrat pot\u0159ebn\u00e9 tv\u00e1\u0159e. Nakonec jsme od tohoto z\u00e1m\u011bru upustili, proto\u017ee potenci\u00e1ln\u00ed hacker by mohl vyu\u017e\u00edt reverzn\u00ed vyhled\u00e1v\u00e1n\u00ed obraz\u016f a zjistit, \u017ee na\u0161i \u201ezam\u011bstnanci\u201c existuj\u00ed pouze v fotobank\u00e1ch. Nakonec jsme pou\u017eili fotografie neexistuj\u00edc\u00edch osob vytvo\u0159en\u00fdch pomoc\u00ed neuronov\u00fdch s\u00edt\u00ed.<\/p>\n<p>Profily zam\u011bstnanc\u016f publikovan\u00e9 na webu obsahovaly d\u016fle\u017eit\u00e9 informace o jejich technick\u00fdch dovednostech, av\u0161ak vyh\u00fdbali jsme se uveden\u00ed konkr\u00e9tn\u00edch vzd\u011bl\u00e1vac\u00edch instituc\u00ed a m\u011bst.<br \/>\nPro vytvo\u0159en\u00ed e-mailov\u00fdch schr\u00e1nek jsme vyu\u017eili server hostingov\u00e9ho poskytovatele, a pot\u00e9 jsme si pronajali n\u011bkolik telefonn\u00edch \u010d\u00edsel v USA a slou\u010dili je do virtu\u00e1ln\u00ed pobo\u010dkov\u00e1 telefonn\u00ed \u00fast\u0159edny s hlasov\u00fdm menu a automatick\u00fdm odpov\u011bdn\u00edkem.<\/p>\n<h3><b>Infrastruktura honeypotu<\/b><\/h3>\n<p>\nAbychom se vyhnuli odhalen\u00ed, rozhodli jsme se pou\u017e\u00edt kombinaci skute\u010dn\u00e9ho pr\u016fmyslov\u00e9ho za\u0159\u00edzen\u00ed, fyzick\u00fdch po\u010d\u00edta\u010d\u016f a chr\u00e1n\u011bn\u00fdch virtu\u00e1ln\u00edch stroj\u016f. P\u0159edem m\u016f\u017eeme \u0159\u00edci, \u017ee v\u00fdsledek na\u0161ich snah jsme ov\u011b\u0159ili prost\u0159ednictv\u00edm vyhled\u00e1va\u010de Shodan, a ten uk\u00e1zal, \u017ee honeypot vypad\u00e1 jako skute\u010dn\u00fd pr\u016fmyslov\u00fd syst\u00e9m.<\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/77ff6f72dacafcf9326161f2150c91b8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>V\u00fdsledek skenov\u00e1n\u00ed honeypotu pomoc\u00ed Shodan. Zdroj: Trend Micro<\/i><\/p>\n<p>Jako \"hardware\" pro na\u0161i past jsme pou\u017eili \u010dty\u0159i PLC:<\/p>\n<ul>\n<li> Siemens S7-1200,<\/li>\n<li>dv\u011b Allen-Bradley MicroLogix 1100,<\/li>\n<li>Omron CP1L.<\/li>\n<\/ul>\n<p>\nTato PLC byla vybr\u00e1na pro svou popularitu na sv\u011btov\u00e9m trhu syst\u00e9m\u016f \u0159\u00edzen\u00ed. A nav\u00edc ka\u017ed\u00fd z t\u011bchto kontrol\u00e9r\u016f pou\u017e\u00edv\u00e1 sv\u016fj protokol, co\u017e n\u00e1m umo\u017enilo zjistit, kter\u00fd z PLC bude \u010dast\u011bji napad\u00e1n a zda v\u016fbec n\u011bkoho zaujme. <\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/f575a4cabd0b38f1af43b8d20cc0a8d4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Za\u0159\u00edzen\u00ed na\u0161\u00ed \"tov\u00e1rny\"-pasti. Zdroj: Trend Micro<\/i><\/p>\n<p>Nen\u00ed to jen tak, \u017ee jsme postavili za\u0159\u00edzen\u00ed a p\u0159ipojili je k internetu. Ka\u017ed\u00fd kontrol\u00e9r jsme naprogramovali k vykon\u00e1v\u00e1n\u00ed \u00faloh, mezi kter\u00fdmi bylo<\/p>\n<ul>\n<li>m\u00edch\u00e1n\u00ed,<\/li>\n<li>\u0159\u00edzen\u00ed ho\u0159\u00e1ku a dopravn\u00edho p\u00e1su,<\/li>\n<li>paletizace za pou\u017eit\u00ed robotick\u00e9ho manipul\u00e1toru.<\/li>\n<\/ul>\n<p>\nAby byl v\u00fdrobn\u00ed proces realistick\u00fd, naprogramovali jsme logiku pro n\u00e1hodn\u00e9 zm\u011bny parametr\u016f zp\u011btn\u00e9 vazby, simulaci spou\u0161t\u011bn\u00ed a zastavov\u00e1n\u00ed motor\u016f, zap\u00edn\u00e1n\u00ed a vyp\u00edn\u00e1n\u00ed ho\u0159\u00e1ku.<\/p>\n<p>V na\u0161\u00ed tov\u00e1rn\u011b byly t\u0159i virtu\u00e1ln\u00ed po\u010d\u00edta\u010de a jeden fyzick\u00fd. Virtu\u00e1ln\u00ed stroje byly pou\u017eity k \u0159\u00edzen\u00ed z\u00e1vodu, robotu paletiz\u00e1toru a jako pracovn\u00ed stanice in\u017een\u00fdra program\u00e1tora PLC. Fyzick\u00fd po\u010d\u00edta\u010d fungoval jako souborov\u00fd server.<\/p>\n<p>Krom\u011b sledov\u00e1n\u00ed \u00fatok\u016f na PLC jsme cht\u011bli monitorovat stav program\u016f nahran\u00fdch na na\u0161e za\u0159\u00edzen\u00ed. K tomu jsme vytvo\u0159ili rozhran\u00ed, kter\u00e9 umo\u017e\u0148ovalo rychle ur\u010dit, jak\u00fdm zp\u016fsobem byly modifikov\u00e1ny stavy na\u0161ich virtu\u00e1ln\u00edch v\u00fdkonn\u00fdch mechanism\u016f a konfigurac\u00ed. Ji\u017e v pl\u00e1novac\u00ed f\u00e1zi jsme zjistili, \u017ee je mnohem snaz\u0161\u00ed to implementovat pomoc\u00ed \u0159\u00eddic\u00edho programu ne\u017e p\u0159es p\u0159\u00edm\u00e9 programov\u00e1n\u00ed logiky kontrol\u00e9ru. K rozhran\u00ed pro \u0159\u00edzen\u00ed za\u0159\u00edzen\u00ed na\u0161eho honeypotu jsme otev\u0159eli p\u0159\u00edstup p\u0159es VNC bez hesla.<\/p>\n<p>Pr\u016fmyslov\u00e9 roboty jsou kl\u00ed\u010dovou sou\u010d\u00e1st\u00ed modern\u00edho chytr\u00e9ho v\u00fdroby. Vzhledem k tomu jsme se rozhodli p\u0159idat robota a ARM pro jeho \u0159\u00edzen\u00ed do vybaven\u00ed na\u0161\u00ed l\u00e1kac\u00ed tov\u00e1rny. Abychom ud\u011blali \"tov\u00e1rnu\" realisti\u010dt\u011bj\u0161\u00ed, nainstalovali jsme na ARM \u0159\u00edzen\u00ed skute\u010dn\u00fd software, kter\u00fd in\u017een\u00fd\u0159i pou\u017e\u00edvaj\u00ed k grafick\u00e9mu programov\u00e1n\u00ed logiky robota. A proto\u017ee obvykle pr\u016fmyslov\u00e9 roboty se nach\u00e1zej\u00ed v izolovan\u00e9 vnit\u0159n\u00ed s\u00edti, rozhodli jsme se ponechat nechr\u00e1n\u011bn\u00fd p\u0159\u00edstup p\u0159es VNC pouze k ARM pro \u0159\u00edzen\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/157e4891ccf19fb93d3b925309543c9d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Prost\u0159ed\u00ed RobotStudio s 3D modelem na\u0161eho robota. Zdroj: Trend Micro<\/i><\/p>\n<p>Na virtu\u00e1ln\u00edm stroji s ARM \u0159\u00edzen\u00ed robota jsme nainstalovali programovac\u00ed prost\u0159ed\u00ed RobotStudio od ABB Robotics. Po nastaven\u00ed RobotStudio jsme otev\u0159eli v n\u011bm soubor simulace s na\u0161\u00edm robotem tak, aby jeho 3D obr\u00e1zek byl viditeln\u00fd na obrazovce. V d\u016fsledku toho Shodan a dal\u0161\u00ed vyhled\u00e1vac\u00ed syst\u00e9my, kter\u00e9 objev\u00ed nechr\u00e1n\u011bn\u00fd VNC server, z\u00edskaj\u00ed tento obr\u00e1zek obrazovky a uk\u00e1\u017eou ho t\u011bm, kdo hledaj\u00ed pr\u016fmyslov\u00e9 roboty s otev\u0159en\u00fdm p\u0159\u00edstupem k \u0159\u00edzen\u00ed. <\/p>\n<p>Smyslem takov\u00e9 pozornosti k detail\u016fm bylo vytvo\u0159it atraktivn\u00ed a co nejrealisti\u010dt\u011bj\u0161\u00ed c\u00edl pro \u00fato\u010dn\u00edky, kte\u0159\u00ed by ho po jeho objeven\u00ed nav\u0161t\u011bvovali znovu a znovu.<\/p>\n<p><b><\/p>\n<h3>ARM in\u017een\u00fdra<\/h3>\n<p><\/b><br \/>\nPro programov\u00e1n\u00ed logiky PLC jsme p\u0159idali do infrastruktury in\u017een\u00fdrsk\u00fd po\u010d\u00edta\u010d. Na n\u011bj jsme nainstalovali pr\u016fmyslov\u00e9 software pro programov\u00e1n\u00ed PLC:<\/p>\n<ul>\n<li>TIA Portal pro Siemens,<\/li>\n<li>MicroLogix pro kontrol\u00e9r Allen-Bradley,<\/li>\n<li>CX-One pro Omron.<\/li>\n<\/ul>\n<p>\nRozhodli jsme se, \u017ee in\u017een\u00fdrsk\u00e9 pracovn\u00ed m\u00edsto nebude dostupn\u00e9 mimo s\u00ed\u0165. M\u00edsto toho jsme na n\u011bm nastavili stejn\u00fd heslo pro \u00fa\u010det spr\u00e1vce, jak\u00e9 m\u00e1me na internetov\u011b dostupn\u00fdch AIRM pro \u0159\u00edzen\u00ed robota a AIRM pro \u0159\u00edzen\u00ed tov\u00e1rny. Takov\u00e1 konfigurace je v mnoha spole\u010dnostech dost roz\u0161\u00ed\u0159en\u00e1.<br \/>\nBohu\u017eel, navzdory v\u0161em na\u0161im snah\u00e1m, se k AIRM in\u017een\u00fdra nedostal \u017e\u00e1dn\u00fd \u00fato\u010dn\u00edk.<\/p>\n<h3>Souborov\u00fd server<\/h3>\n<p>\nByl n\u00e1m pot\u0159eba jako n\u00e1vnada pro \u00fato\u010dn\u00edky a jako prost\u0159edek pro z\u00e1lohov\u00e1n\u00ed na\u0161ich vlastn\u00edch \"d\u011bl\" v tov\u00e1rn\u011b-past. D\u00edky tomu jsme mohli vym\u011b\u0148ovat soubory s na\u0161\u00edm honeypotem pomoc\u00ed USB za\u0159\u00edzen\u00ed, ani\u017e bychom zanech\u00e1vali stopy v s\u00edti pasti. Jako OS pro souborov\u00fd server jsme nainstalovali Windows 7 Pro, ve kter\u00fdch jsme vytvo\u0159ili sd\u00edlenou slo\u017eku, dostupnou pro \u010dten\u00ed a z\u00e1pis komukoli.<\/p>\n<p>Zpo\u010d\u00e1tku jsme na souborov\u00e9m serveru nevytv\u00e1\u0159eli \u017e\u00e1dnou hierarchii slo\u017eek a dokument\u016f. Uk\u00e1zalo se v\u0161ak, \u017ee \u00fato\u010dn\u00edci aktivn\u011b zkoumaj\u00ed tuto slo\u017eku, tak\u017ee jsme se rozhodli ji naplnit r\u016fzn\u00fdmi soubory. K tomu jsme napsali pythonov\u00fd skript, kter\u00fd vytvo\u0159il soubor n\u00e1hodn\u00e9 velikosti s jednou z dan\u00fdch koncovek, p\u0159i\u010dem\u017e n\u00e1zvy byly generov\u00e1ny na z\u00e1klad\u011b slovn\u00edku. <\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/5c1ec2c139d04200849443771b48872a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Skript pro generov\u00e1n\u00ed atraktivn\u00edch n\u00e1zv\u016f soubor\u016f. Zdroj: Trend Micro<\/i><\/p>\n<p>Po spu\u0161t\u011bn\u00ed skriptu jsme z\u00edskali po\u017eadovan\u00fd v\u00fdsledek v podob\u011b slo\u017eky, napln\u011bn\u00e9 soubory s velmi zaj\u00edmav\u00fdmi n\u00e1zvy. <\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/a1842a978ecb400e4390274e202af6f0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>V\u00fdsledek pr\u00e1ce skriptu. Zdroj: Trend Micro<\/i><\/p>\n<p><b><\/p>\n<h3>Prost\u0159ed\u00ed pro sledov\u00e1n\u00ed<\/h3>\n<p><\/b><br \/>\nPot\u00e9, co jsme vynalo\u017eili tolik \u00fasil\u00ed na vytvo\u0159en\u00ed realistick\u00e9 spole\u010dnosti, jsme si prost\u011b nemohli dovolit, aby na\u0161e monitorovac\u00ed prost\u0159ed\u00ed pro na\u0161e \"n\u00e1v\u0161t\u011bvn\u00edky\" selhalo. Pot\u0159ebovali jsme z\u00edsk\u00e1vat v\u0161echna data v re\u00e1ln\u00e9m \u010dase tak, aby \u00fato\u010dn\u00edci nezjistili, \u017ee jsou sledov\u00e1ni. <\/p>\n<p>To jsme realizovali pomoc\u00ed \u010dty\u0159 USB-Ethernet adapt\u00e9r\u016f, \u010dty\u0159 Ethernet splitter\u016f SharkTap, Raspberry Pi 3 a velk\u00e9ho extern\u00edho disku. Sch\u00e9ma na\u0161\u00ed s\u00edt\u011b vypadalo takto: <\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/2288c39fa3c4ceee6f5f30dd012de269.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Sch\u00e9ma s\u00edt\u011b honeypotu s vybaven\u00edm pro monitoring. Zdroj: Trend Micro<\/i><\/p>\n<p>T\u0159i splittery SharkTap jsme um\u00edstili tak, abychom monitorovali ve\u0161ker\u00fd extern\u00ed provoz k PLC, kter\u00fd byl p\u0159\u00edstupn\u00fd pouze ze vnit\u0159n\u00ed s\u00edt\u011b. \u010ctvrt\u00fd SharkTap sledoval provoz host\u016f zraniteln\u00e9 virtu\u00e1ln\u00ed ma\u0161iny. <\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/9440a392352b104c27056ee00bc3b2a9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Ethernet splitter SharkTap a router Sierra Wireless AirLink RV50. Zdroj: Trend Micro<\/i><\/p>\n<p>Raspberry Pi prov\u00e1d\u011bl denn\u00ed zachyt\u00e1v\u00e1n\u00ed provozu. P\u0159ipojen\u00ed k internetu jsme zorganizovali pomoc\u00ed mobiln\u00edho routeru Sierra Wireless AirLink RV50, kter\u00fd se \u010dasto pou\u017e\u00edv\u00e1 v pr\u016fmyslov\u00fdch podnic\u00edch. <\/p>\n<p>Bohu\u017eel, tento router n\u00e1m neumo\u017e\u0148oval selektivn\u011b blokovat \u00fatoky, kter\u00e9 neodpov\u00eddaly na\u0161im pl\u00e1n\u016fm, proto jsme do s\u00edt\u011b p\u0159idali firewall Cisco ASA 5505 v pr\u016fhledn\u00e9m re\u017eimu, abychom prov\u00e1d\u011bli blokace s minim\u00e1ln\u00edm dopadem na s\u00ed\u0165. <\/p>\n<p><b><\/p>\n<h3>Anal\u00fdza provozu<\/h3>\n<p><\/b><br \/>\nTshark a tcpdump jsou vhodn\u00e9 pro rychl\u00e9 \u0159e\u0161en\u00ed aktu\u00e1ln\u00edch probl\u00e9m\u016f, ale v na\u0161em p\u0159\u00edpad\u011b jejich mo\u017enosti nesta\u010dily, proto\u017ee jsme m\u011bli mnoho gigabajt\u016f provozu, jeho\u017e anal\u00fdzou se zab\u00fdval n\u011bkolik lid\u00ed. Vyu\u017eili jsme open-source analyz\u00e1tor Moloch, vyvinut\u00fd spole\u010dnost\u00ed AOL. Co do funk\u010dnosti je srovnateln\u00fd s Wireshark, ale m\u00e1 v\u00edce mo\u017enost\u00ed pro spolupr\u00e1ci, popis a ozna\u010dov\u00e1n\u00ed paket\u016f, export a dal\u0161\u00ed \u00fakoly.<\/p>\n<p>Proto\u017ee jsme necht\u011bli zpracov\u00e1vat shrom\u00e1\u017ed\u011bn\u00e1 data na po\u010d\u00edta\u010d\u00edch honeypotu, PCAP dumpy byly ka\u017ed\u00fd den exportov\u00e1ny do \u00falo\u017ei\u0161t\u011b AWS, odkud jsme je pot\u00e9 importovali na stroj s Moloch. <\/p>\n<h3><b>Z\u00e1znam obrazovky <\/b><\/h3>\n<p>\nAbychom zdokumentovali \u010dinnosti hacker\u016f v na\u0161em honeypotu, napsali jsme skript, kter\u00fd v dan\u00e9m intervalu po\u0159izoval sn\u00edmky obrazovky virtu\u00e1ln\u00edho stroje a porovn\u00e1val je s p\u0159edchoz\u00edm sn\u00edmkem, aby zjistil, zda se tam n\u011bco d\u011bje. P\u0159i zji\u0161t\u011bn\u00ed aktivity skript spustil z\u00e1znam obrazovky. Tento p\u0159\u00edstup se uk\u00e1zal jako nej\u00fa\u010dinn\u011bj\u0161\u00ed. Tak\u00e9 jsme se pokusili analyzovat VNC provoz z PCAP dumpu, abychom pochopili, jak\u00e9 zm\u011bny v syst\u00e9mu nastaly, ale nakonec p\u0159ijat\u00fd z\u00e1znam obrazovky se uk\u00e1zal jako jednodu\u0161\u0161\u00ed a p\u0159ehledn\u011bj\u0161\u00ed. <\/p>\n<p><b><\/p>\n<h3>Monitoring VNC sezen\u00ed<\/h3>\n<p><\/b><br \/>\nK tomu jsme pou\u017eili Chaosreader a VNCLogger. Ob\u011b utilitky extrahuj\u00ed ze PCAP dumpu stisky kl\u00e1ves, ale VNCLogger l\u00e9pe zach\u00e1z\u00ed s kl\u00e1vesami jako Backspace, Enter, Ctrl.<\/p>\n<p>VNCLogger m\u00e1 dv\u011b nev\u00fdhody. Prvn\u00ed: m\u016f\u017ee extrahovat kl\u00e1vesy pouze \"poslouch\u00e1n\u00edm\" provozu na rozhran\u00ed, proto jsme museli pro n\u011bj simulovat VNC sezen\u00ed pomoc\u00ed tcpreplay. Druhou nev\u00fdhodou je, \u017ee VNCLogger, stejn\u011b jako Chaosreader, nezobrazuje obsah schr\u00e1nky. K tomu jsme museli vyu\u017e\u00edt Wireshark. <\/p>\n<p><b><\/p>\n<h3>L\u00e1k\u00e1me hackery<\/h3>\n<p><\/b><br \/>\nVytvo\u0159ili jsme honeypot, aby na n\u011bj \u00fato\u010dili. K tomu jsme inscenovali \u00fanik informac\u00ed, kter\u00fd m\u011bl p\u0159it\u00e1hnout pozornost potenci\u00e1ln\u00edch hacker\u016f. Na honeypotu byly otev\u0159eny n\u00e1sleduj\u00edc\u00ed porty: <\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/0defa27d76010837c00aa7b97e993ac0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nPort RDP jsme museli zav\u0159\u00edt brzy po zah\u00e1jen\u00ed provozu, proto\u017ee kv\u016fli obrovsk\u00e9mu mno\u017estv\u00ed skenovac\u00edho provozu v na\u0161\u00ed s\u00edti vznikly probl\u00e9my s v\u00fdkonem.<br \/>\nVNC termin\u00e1ly nejprve pracovaly v re\u017eimu \"pouze pro \u010dten\u00ed\" bez hesla, a pot\u00e9 jsme je \"omylem\" p\u0159epnuli do re\u017eimu pln\u00e9ho p\u0159\u00edstupu. <\/p>\n<p>Abychom p\u0159il\u00e1kali \u00fato\u010dn\u00edky, zve\u0159ejnili jsme dva p\u0159\u00edsp\u011bvky s \"\u00fanikem\" informac\u00ed o dostupn\u00e9 pr\u016fmyslov\u00e9 syst\u00e9mu na PasteBin.<\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/2db7cc5aa60da13a6bf70a6f5e88a934.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Jeden z p\u0159\u00edsp\u011bvk\u016f, zve\u0159ejn\u011bn\u00fdch na PasteBin za \u00fa\u010delem p\u0159il\u00e1k\u00e1n\u00ed \u00fatok\u016f. Zdroj: Trend Micro<\/i><\/p>\n<p><b><\/p>\n<h3>\u00datoky<\/h3>\n<p><\/b><br \/>\nHoneypot byl online p\u0159ibli\u017en\u011b sedm m\u011bs\u00edc\u016f. Prvn\u00ed \u00fatok se stal m\u011bs\u00edc po spust\u011bn\u00ed honeypotu. <\/p>\n<p><b>Skenery<\/b><\/p>\n<p>Bylo mnoho provozu od skener\u016f zn\u00e1m\u00fdch spole\u010dnost\u00ed \u2014 ip-ip, Rapid, Shadow Server, Shodan, ZoomEye a dal\u0161\u00edch. Bylo jich natolik mnoho, \u017ee jsme je museli vylou\u010dit <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/lir\/ipv4\/\"   title=\"IP adres\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"676\">IP adres<\/a> z anal\u00fdzy: 610 z 9452, tedy 6,45 % v\u0161ech unik\u00e1tn\u00edch IP adres, pat\u0159ilo zcela legitimn\u00edm skener\u016fm.<\/p>\n<p><b>Podvodn\u00edci<\/b><\/p>\n<p>Jedn\u00edm z nejv\u011bt\u0161\u00edch rizik, se kter\u00fdmi jsme se museli vypo\u0159\u00e1dat, je vyu\u017eit\u00ed na\u0161eho syst\u00e9mu k neleg\u00e1ln\u00edm \u010dinnostem: k n\u00e1kupu smartphon\u016f na \u00fa\u010det abonenta, k vypl\u00e1cen\u00ed mil aerolinek pomoc\u00ed d\u00e1rkov\u00fdch karet a k dal\u0161\u00edm typ\u016fm podvod\u016f.<\/p>\n<p><b>Miners<\/b><\/p>\n<p>Jedn\u00edm z prvn\u00edch n\u00e1v\u0161t\u011bvn\u00edk\u016f na\u0161eho syst\u00e9mu byl miner. Na\u010d\u00edtal na n\u011bj software pro t\u011b\u017ebu Monera. Na na\u0161\u00ed konkr\u00e9tn\u00ed soustav\u011b by mnoho nevyd\u011blal kv\u016fli n\u00edzk\u00e9mu v\u00fdkonu. Pokud by v\u0161ak skombinoval \u00fasil\u00ed n\u011bkolika des\u00edtek \u010di dokonce stovek takov\u00fdch syst\u00e9m\u016f, mohlo by to dopadnout docela dob\u0159e. <\/p>\n<p><b>Ransomware <\/b><\/p>\n<p>B\u011bhem provozu honeypotu jsme se dv\u011bma setk\u00e1n\u00edm s prav\u00fdmi ransomwarov\u00fdmi viry. V prvn\u00edm p\u0159\u00edpad\u011b to byl Crysis. Jeho oper\u00e1to\u0159i se dostali do syst\u00e9mu p\u0159es VNC, ale pak nainstalovali TeamViewer a s jeho pomoc\u00ed prov\u00e1d\u011bli dal\u0161\u00ed kroky. Jakmile jsme obdr\u017eeli vyhn\u00e1n\u00ed \u017e\u00e1dosti o v\u00fdkupn\u00e9 ve v\u00fd\u0161i 10 tis\u00edc dolar\u016f v BTC, zah\u00e1jili jsme s podvodn\u00edky korespondenci a po\u017e\u00e1dali je, aby n\u00e1m de\u0161ifrovali jeden z soubor\u016f. Splnili na\u0161i \u017e\u00e1dost a op\u011btovn\u011b zopakovali po\u017eadavek na v\u00fdkupn\u00e9. Poda\u0159ilo se n\u00e1m vyjednat cenu na 6 tis\u00edc dolar\u016f, pot\u00e9 jsme prost\u011b obnovili syst\u00e9m na virtu\u00e1ln\u00ed stroj, proto\u017ee jsme z\u00edskali v\u0161echny pot\u0159ebn\u00e9 informace. <\/p>\n<p>Druh\u00fdm ransomwarov\u00fdm programem byl Phobos. Hacker, kter\u00fd jej nainstaloval, b\u011bhem hodiny prozkoumal souborov\u00fd syst\u00e9m honeypotu a skenoval s\u00ed\u0165, a pot\u00e9 skute\u010dn\u011b nainstaloval ransomware. <br \/>\nT\u0159et\u00ed \u00fatok ransomwaru se uk\u00e1zal b\u00fdt fale\u0161n\u00fd. Nezn\u00e1m\u00fd 'hacker' st\u00e1hl do na\u0161eho syst\u00e9mu soubor haha.bat, po \u010dem\u017e jsme n\u011bjakou dobu sledovali, jak se sna\u017e\u00ed donutit ho k pr\u00e1ci. Jedn\u00edm z pokus\u016f bylo p\u0159ejmenov\u00e1n\u00ed haha.bat na haha.rnsmwr. <\/p>\n<p><img decoding=\"async\" alt=\"Nepochopiteln\u011b atraktivn\u00ed: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit\" src=\"\/wp-content\/uploads\/2020\/10\/cab8571ce84fd25eed10d3f14ed3bff6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>'Hacker' zvy\u0161uje \u0161kodlivost bat-souboru zm\u011bnou jeho p\u0159\u00edpony na .rnsmwr. Zdroj: Trend Micro<\/i><\/p>\n<p>Kdy\u017e se batn\u00edk kone\u010dn\u011b spustil, 'hacker' jej upravil a zv\u00fd\u0161il v\u00fdkupn\u00e9 z 200 na 750 dolar\u016f. Pot\u00e9 '\u0161ifroval' v\u0161echny soubory, zanechal na plo\u0161e v\u00fdkupn\u00ed zpr\u00e1vu a zmizel, p\u0159i\u010dem\u017e zm\u011bnil hesla na na\u0161em VNC. <\/p>\n<p>B\u011bhem n\u011bkolika dn\u00ed se hacker vr\u00e1til a aby na sebe upozornil, spustil batn\u00edk, kter\u00fd otev\u00edral mnoho oken s pornografick\u00fdm webem. Z\u0159ejm\u011b se tak sna\u017eil p\u0159it\u00e1hnout pozornost ke sv\u00e9mu po\u017eadavku.<\/p>\n<p><b><\/p>\n<h3>Z\u00e1v\u011bry<\/h3>\n<p><\/b><br \/>\nB\u011bhem v\u00fdzkumu se uk\u00e1zalo, \u017ee jakmile byly informace o zranitelnosti zve\u0159ejn\u011bny, honeypot p\u0159it\u00e1hl pozornost, p\u0159i\u010dem\u017e aktivita rostla den co den. Aby past p\u0159it\u00e1hla pozornost, museli jsme povolit mnoho bezpe\u010dnostn\u00edch poru\u0161en\u00ed na\u0161\u00ed fiktivn\u00ed spole\u010dnosti. Bohu\u017eel, takov\u00e1 situace nen\u00ed mezi mnoha re\u00e1ln\u00fdmi spole\u010dnostmi, kter\u00e9 nemaj\u00ed st\u00e1l\u00e9 IT a bezpe\u010dnostn\u00ed pracovn\u00edky, nijak neobvykl\u00e1.<\/p>\n<p>Obecn\u011b by organizace m\u011bly pou\u017e\u00edvat princip minimalizace privilegi\u00ed, zat\u00edmco my jsme implementovali \u00fapln\u00fd opak za \u00fa\u010delem p\u0159il\u00e1k\u00e1n\u00ed \u00fato\u010dn\u00edk\u016f. A \u010d\u00edm d\u00e9le jsme sledovali \u00fatoky, t\u00edm sofistikovan\u011bj\u0161\u00ed se st\u00e1valy ve srovn\u00e1n\u00ed se standardn\u00edmi metodami penetra\u010dn\u00edho testov\u00e1n\u00ed.<\/p>\n<p>A co je nejd\u016fle\u017eit\u011bj\u0161\u00ed: v\u0161echny tyto \u00fatoky by selhaly, kdyby byly p\u0159i nastavov\u00e1n\u00ed s\u00edt\u011b implementov\u00e1ny adekv\u00e1tn\u00ed bezpe\u010dnostn\u00ed opat\u0159en\u00ed. Organizace by m\u011bly zajistit, aby jejich za\u0159\u00edzen\u00ed a sou\u010d\u00e1sti pr\u016fmyslov\u00e9 infrastruktury nebyly dostupn\u00e9 z internetu, jak jsme to \u00famysln\u011b ud\u011blali v na\u0161\u00ed pasti. <\/p>\n<p>I kdy\u017e jsme nezaznamenali \u017e\u00e1dn\u00fd \u00fatok na pracovn\u00ed stanici in\u017een\u00fdra, a\u010dkoli jsme pou\u017e\u00edvali stejn\u00e9 heslo m\u00edstn\u00edho administr\u00e1tora na v\u0161ech po\u010d\u00edta\u010d\u00edch, je vhodn\u00e9 se t\u00e9to praxe vyhnout, aby se minimalizovala mo\u017enost vniknut\u00ed. Slab\u00e1 bezpe\u010dnost toti\u017e slou\u017e\u00ed jako dal\u0161\u00ed pozv\u00e1nka k \u00fatoku na pr\u016fmyslov\u00e9 syst\u00e9my, kter\u00e9 u\u017e dlouho vzbuzuj\u00ed z\u00e1jem kyberzlo\u010dinc\u016f.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/trendmicro\/blog\/490406\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u044b \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b-\u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u2014 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u044b, \u0447\u0442\u043e\u0431\u044b \u00ab\u043f\u043e\u0439\u043c\u0430\u0442\u044c \u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb \u0441\u0432\u0435\u0436\u0443\u044e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0442\u0430\u043a\u0442\u0438\u043a\u0443. \u0425\u0430\u043d\u0438\u043f\u043e\u0442\u044b \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e, \u0447\u0442\u043e \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u0432\u044b\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0441\u044f \u0441\u0432\u043e\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0439 \u0438\u043c\u043c\u0443\u043d\u0438\u0442\u0435\u0442: \u043e\u043d\u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u044e\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434 \u043d\u0438\u043c\u0438 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044e\u0442 \u0435\u0451. \u0427\u0442\u043e\u0431\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0442\u0430\u043a\u0442\u0438\u043a\u0443 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u044b\u0439 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041d\u0435\u0432\u044b\u0440\u0430\u0437\u0438\u043c\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u0435\u043d: \u043a\u0430\u043a \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0438\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T17:42:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T17:42:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nehynouc\u00ed p\u0159ita\u017elivost: jak jsme vytvo\u0159ili honeypot, kter\u00fd nelze odhalit | ProHoster","description":"Antivirov\u00e9.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435\u0432\u044b\u0440\u0430\u0437\u0438\u043c\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u0435\u043d: \u043a\u0430\u043a \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0438\u0442\u044c | ProHoster","og:description":"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T17:42:19+00:00","article:modified_time":"2020-10-09T17:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2026-02-08 20:24:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/96228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=96228"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/96228\/revisions"}],"predecessor-version":[{"id":157867,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/96228\/revisions\/157867"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/96229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=96228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=96228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=96228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}