{"id":96242,"date":"2020-10-09T19:42:33","date_gmt":"2020-10-09T17:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza"},"modified":"2020-10-09T19:42:33","modified_gmt":"2020-10-09T17:42:33","slug":"dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","title":{"rendered":"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>(d\u011bkuji Sergey G. Brester za n\u00e1pad na nadpis) <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/users\/sebres\/\" class=\"user_link\">sebres<\/a><\/noindex>)<\/p>\n<p>Kolegov\u00e9, c\u00edlem tohoto \u010dl\u00e1nku je pod\u011blit se o zku\u0161enosti z ro\u010dn\u00ed testovac\u00ed exploatace nov\u00e9 t\u0159\u00eddy IDS \u0159e\u0161en\u00ed zalo\u017een\u00fdch na technologi\u00edch Deception. <\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/f641b6735cf846d12a0081c7709662e7.png\" style=\"display:block;margin: 0 auto;\" \/><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Abychom udr\u017eeli logickou n\u00e1vaznost textu, pova\u017euji za nutn\u00e9 za\u010d\u00edt p\u0159edpoklady. Tak\u017ee problematika:<\/p>\n<ol>\n<li>C\u00edlen\u00e9 \u00fatoky jsou nejnebezpe\u010dn\u011bj\u0161\u00edm typem \u00fatok\u016f, i kdy\u017e jejich pod\u00edl na celkov\u00e9m po\u010dtu hrozeb nen\u00ed velk\u00fd. <\/li>\n<li>N\u011bjak\u00fd garantovan\u00fd efektivn\u00ed prost\u0159edek na ochranu perimetru (nebo komplex takov\u00fdch prost\u0159edk\u016f) zat\u00edm nebyl vynalezen. <\/li>\n<li>C\u00edlen\u00e9 \u00fatoky obvykle prob\u00edhaj\u00ed ve n\u011bkolika f\u00e1z\u00edch. P\u0159ekon\u00e1n\u00ed perimetru je jen jedna z po\u010d\u00e1te\u010dn\u00edch f\u00e1z\u00ed, kter\u00e1 (m\u016f\u017eete m\u011b h\u00e1zet kamen\u00edm) pro \"ob\u011b\u0165\" nep\u0159in\u00e1\u0161\u00ed velk\u00e9 \u0161kody, pokud to nejsou \u00fatoky DEoS (Destruction of service) (\u0161ifrovac\u00ed malware a podobn\u011b). Opravdu \"bolestiv\u011b\" to za\u010d\u00edn\u00e1 pozd\u011bji, kdy\u017e se zachycen\u00e9 prost\u0159edky za\u010dnou pou\u017e\u00edvat pro p\u0159ep\u00edn\u00e1n\u00ed a rozvoj \u00fatoku \"do hloubky\", a my toho nezaregistrujeme. <\/li>\n<li>Jeliko\u017e za\u010d\u00edn\u00e1me n\u00e9st skute\u010dn\u00e9 ztr\u00e1ty ve chv\u00edli, kdy se \u00fato\u010dn\u00edci skute\u010dn\u011b dostanou k c\u00edl\u016fm \u00fatoku (servery aplikac\u00ed, DBMS, datov\u00e1 \u00falo\u017ei\u0161t\u011b, repozit\u00e1\u0159e, prvky kritick\u00e9 infrastruktury), je logick\u00e9, \u017ee jedn\u00edm z \u00fakol\u016f bezpe\u010dnostn\u00ed slu\u017eby je p\u0159eru\u0161it \u00fatoky p\u0159ed t\u00edmto \u0161kodliv\u00fdm ud\u00e1lost\u00ed. Ale abychom n\u011bco p\u0159eru\u0161ili, mus\u00edme o tom nejprve v\u011bd\u011bt. A \u010d\u00edm d\u0159\u00edve, t\u00edm l\u00e9pe. <\/li>\n<li>Proto je pro \u00fasp\u011b\u0161n\u00e9 \u0159\u00edzen\u00ed rizik (tj. sn\u00ed\u017een\u00ed \u0161kod zp\u016fsoben\u00fdch c\u00edlen\u00fdmi \u00fatoky) z\u00e1sadn\u00ed m\u00edt n\u00e1stroje, kter\u00e9 zajist\u00ed minim\u00e1ln\u00ed TTD (time to detect \u2013 \u010das od okam\u017eiku vniknut\u00ed do okam\u017eiku detekce \u00fatoku). V z\u00e1vislosti na odv\u011btv\u00ed a regionu tento obdob\u00ed pr\u016fm\u011brn\u011b \u010din\u00ed 99 dn\u00ed v USA, 106 dn\u00ed v regionu EMEA, 172 dn\u00ed v regionu APAC (M-Trends 2017, A View From the Front Lines, Mandiant). <\/li>\n<li>Co trh nab\u00edz\u00ed?\n<ul>\n<li>\"P\u00edse\u010dn\u00e9 boxy\". Dal\u0161\u00ed preventivn\u00ed kontrola, kter\u00e1 je daleko od ide\u00e1lu. Existuje mnoho efektivn\u00edch technik detekce a obch\u00e1zen\u00ed p\u00edse\u010dn\u00fdch box\u016f nebo whitelistingov\u00fdch \u0159e\u0161en\u00ed. Kluci z \"temn\u00e9 strany\" jsou zde zat\u00edm o krok nap\u0159ed. \n<\/li>\n<li>UEBA (syst\u00e9my profilov\u00e1n\u00ed chov\u00e1n\u00ed a detekce odchylek) \u2013 v teorii m\u016f\u017ee b\u00fdt velmi efektivn\u00ed. Ale, z m\u00e9ho pohledu, to je n\u011bco, co se m\u016f\u017ee st\u00e1t a\u017e daleko v budoucnosti. V praxi \u2013 zat\u00edm je to velmi drah\u00e9, nespolehliv\u00e9 a vy\u017eaduje velmi zralou a stabiln\u00ed IT a IB infrastrukturu, kde u\u017e existuj\u00ed v\u0161echny n\u00e1stroje, kter\u00e9 budou generovat data pro behavior\u00e1ln\u00ed anal\u00fdzu.\n<\/li>\n<li>SIEM \u2013 dobr\u00fd n\u00e1stroj pro vy\u0161et\u0159ov\u00e1n\u00ed, ale n\u011bco nov\u00e9ho, origin\u00e1ln\u00edho, nedok\u00e1\u017ee v\u010das uk\u00e1zat, proto\u017ee korela\u010dn\u00ed pravidla jsou vlastn\u011b ty sam\u00e9 signatury. <\/li>\n<\/ul>\n<p>\n <\/li>\n<li>Nakonec se objevila pot\u0159eba takov\u00e9ho n\u00e1stroje, kter\u00fd by:\n<ul>\n<li>\u00fasp\u011b\u0161n\u011b fungoval v podm\u00ednk\u00e1ch ji\u017e zkompromitovan\u00e9ho perimetru,\n<\/li>\n<li>odhaloval \u00fasp\u011b\u0161n\u00e9 \u00fatoky v re\u017eimu bl\u00edzk\u00e9m re\u00e1ln\u00e9mu \u010dasu bez ohledu na n\u00e1stroje a zranitelnosti, kter\u00e9 jsou vyu\u017e\u00edv\u00e1ny,<\/li>\n<li>nebyl z\u00e1visl\u00fd na signatur\u00e1ch\/pravidlech\/sc\u00e9n\u00e1\u0159\u00edch\/politik\u00e1ch\/profil\u00edch a jin\u00fdch statick\u00fdch v\u011bcech,<\/li>\n<li>nevy\u017eadoval velk\u00e9 objemy dat a jejich zdroje pro anal\u00fdzu,<\/li>\n<li>umo\u017e\u0148oval ur\u010dovat \u00fatoky ne jako n\u011bjak\u00e9 rizikov\u00e9 sk\u00f3re na z\u00e1klad\u011b \u201anejlep\u0161\u00ed na sv\u011bt\u011b, patentovan\u00e9 a proto uzav\u0159en\u00e9 matematiky\u2018, kter\u00e1 vy\u017eaduje dal\u0161\u00ed vy\u0161et\u0159ov\u00e1n\u00ed, ale prakticky jako bin\u00e1rn\u00ed ud\u00e1lost \u2013 \u201aAno, jsme napadeni\u2018 nebo \u201aNe, je v\u0161e v po\u0159\u00e1dku\u2018,<\/li>\n<li>byl univerz\u00e1ln\u00ed, efektivn\u011b \u0161k\u00e1lovateln\u00fd a re\u00e1ln\u011b implementovateln\u00fd v jak\u00e9mkoli heterogenn\u00edm prost\u0159ed\u00ed, bez ohledu na pou\u017e\u00edvanou fyzickou a logickou topologii s\u00edt\u011b.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>\nNa roli takov\u00e9ho n\u00e1stroje nyn\u00ed aspiruj\u00ed takzvan\u00e1 deception \u0159e\u0161en\u00ed. To znamen\u00e1 \u0159e\u0161en\u00ed, kter\u00e1 vych\u00e1zej\u00ed ze star\u00e9 dobr\u00e9 koncepce honeypot\u016f, ale s \u00fapln\u011b jinou \u00farovn\u00ed realizace. Toto t\u00e9ma je nyn\u00ed bezpochyby na vzestupu.<\/p>\n<p>Podle v\u00fdsledk\u016f <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gartner.com\/newsroom\/id\/3744917\">Gartner Security&amp;Risc management summit 2017<\/a><\/noindex> Deception \u0159e\u0161en\u00ed pat\u0159\u00ed do TOP-3 strategi\u00ed a n\u00e1stroj\u016f, kter\u00e9 se doporu\u010duje pou\u017e\u00edvat. <\/p>\n<p>Podle zpr\u00e1vy <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tag-cyber.com\/Annual\/2017\/\">TAG Cybersecurity Annual 2017<\/a><\/noindex> Deception je jedn\u00edm z hlavn\u00edch sm\u011br\u016f v\u00fdvoje \u0159e\u0161en\u00ed IDS (Intrusion Detection Systems).<\/p>\n<p>Cel\u00e1 sekce posledn\u00edho <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/security\/security-reports.html\">zpr\u00e1vy Cisco o stavu IT bezpe\u010dnosti<\/a><\/noindex>, v\u011bnovan\u00e1 SCADA, je postavena na datech jednoho z l\u00eddr\u016f tohoto trhu, TrapX Security (Izrael), jejich\u017e \u0159e\u0161en\u00ed u\u017e rok funguje v na\u0161\u00ed testovac\u00ed z\u00f3n\u011b. <\/p>\n<p>TrapX Deception Grid umo\u017e\u0148uje centr\u00e1ln\u011b budovat a provozovat masivn\u011b distribuovan\u00e9 IDS bez zv\u00fd\u0161en\u00ed licen\u010dn\u00ed z\u00e1t\u011b\u017ee a po\u017eadavk\u016f na hardwarov\u00e9 zdroje. V podstat\u011b je TrapX jak\u00fdmsi konstruktorem, kter\u00fd umo\u017e\u0148uje vytvo\u0159it z prvk\u016f st\u00e1vaj\u00edc\u00ed IT infrastruktury jeden velk\u00fd mechanismus detekce \u00fatok\u016f na \u00farovni cel\u00e9ho podniku, jakousi distribuovanou s\u00ed\u0165ovou \"signalizaci\". <\/p>\n<h3>Struktura \u0158e\u0161en\u00ed<\/h3>\n<p>\nV na\u0161\u00ed laborato\u0159i neust\u00e1le zkoum\u00e1me a testujeme r\u016fzn\u00e9 novinky v oblasti IT bezpe\u010dnosti. V sou\u010dasnosti je zde nasazeno p\u0159ibli\u017en\u011b 50 r\u016fzn\u00fdch virtu\u00e1ln\u00edch server\u016f, v\u010detn\u011b komponent TrapX Deception Grid.<\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/9c9c21101020c1005edc938a3a7ca393.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTak\u017ee, shora dol\u016f:<\/p>\n<ol>\n<li>TSOC (TrapX Security Operation Console) \u2013 mozek syst\u00e9mu. Toto je centr\u00e1ln\u00ed \u0159\u00eddic\u00ed konzole, pomoc\u00ed kter\u00e9 se prov\u00e1d\u00ed nastaven\u00ed, nasazen\u00ed \u0159e\u0161en\u00ed a ve\u0161ker\u00e1 ka\u017edodenn\u00ed pr\u00e1ce. Proto\u017ee se jedn\u00e1 o webovou slu\u017ebu, m\u016f\u017ee b\u00fdt nasazena kdekoli \u2013 na perimetru, v cloudu nebo u poskytovatele MSSP. <\/li>\n<li>TrapX Appliance (TSA) \u2013 virtu\u00e1ln\u00ed server, ke kter\u00e9mu p\u0159ipojujeme skrze trunk port ty pods\u00edt\u011b, kter\u00e9 chceme zahrnout do monitorov\u00e1n\u00ed. Zde \u201ebydl\u00ed\u201c tak\u00e9 v\u0161echny na\u0161e s\u00ed\u0165ov\u00e9 senzory.\n<p>V na\u0161\u00ed laborato\u0159i je nasazen jeden TSA (mwsapp1), ale ve skute\u010dnosti jich m\u016f\u017ee b\u00fdt mnoho. To m\u016f\u017ee b\u00fdt nezbytn\u00e9 ve velk\u00fdch s\u00edt\u00edch, kde mezi segmenty nen\u00ed L2 konektivita (typick\u00fd p\u0159\u00edklad \u2013 \u201eHolding a dce\u0159in\u00e9 spole\u010dnosti\u201c \u010di \u201eHlavn\u00ed kancel\u00e1\u0159 banky a pobo\u010dky\u201c) nebo pokud v s\u00edti existuj\u00ed izolovan\u00e9 segmenty, nap\u0159\u00edklad ASUTP. V ka\u017ed\u00e9 takov\u00e9 pobo\u010dce\/segmentu lze nasadit sv\u016fj TSA a p\u0159ipojit ho k jednotn\u00e9mu TSOC, na kter\u00e9m bude ve\u0161ker\u00e1 informace centr\u00e1ln\u011b zpracov\u00e1v\u00e1na. Takov\u00e1 architektura umo\u017e\u0148uje budovat distribuovan\u00e9 monitorovac\u00ed syst\u00e9my bez nutnosti radik\u00e1ln\u00ed p\u0159estavby s\u00edt\u011b nebo naru\u0161en\u00ed st\u00e1vaj\u00edc\u00ed segmentace.<\/p>\n<p>Tak\u00e9 na TSA m\u016f\u017eeme p\u0159iv\u00e9st kopii odchoz\u00edho provozu p\u0159es TAP\/SPAN. V p\u0159\u00edpad\u011b detekce spojen\u00ed s zn\u00e1m\u00fdmi botnety, \u0159\u00eddic\u00edmi servery, TOR relacemi tak\u00e9 obdr\u017e\u00edme v\u00fdsledek na konzoli. O to se star\u00e1 Network Intelligence Sensor (NIS). V na\u0161em prost\u0159ed\u00ed je tato funkce realizov\u00e1na na firewallu, a proto jsme ji zde nepou\u017e\u00edvali. <\/li>\n<li>Aplika\u010dn\u00ed pasti (pln\u00e9 OS) \u2013 tradi\u010dn\u00ed honeypoty zalo\u017een\u00e9 na serverech Windows. Nen\u00ed jich t\u0159eba mnoho, nebo\u0165 hlavn\u00edm \u00fakolem t\u011bchto server\u016f je poskytnout IT slu\u017eby dal\u0161\u00edmu \u00farovni senzor\u016f nebo odhalovat \u00fatoky na obchodn\u00ed aplikace, kter\u00e9 mohou b\u00fdt nasazeny v prost\u0159ed\u00ed Windows. V na\u0161\u00ed laborato\u0159i m\u00e1me nainstalov\u00e1n jeden takov\u00fd server (FOS01)\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/8de44215efff4a49f3b773da10185a73.png\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li>Emulovan\u00e9 pasti \u2013 hlavn\u00ed sou\u010d\u00e1st \u0159e\u0161en\u00ed, kter\u00e1 n\u00e1m umo\u017e\u0148uje pomoc\u00ed jedin\u00e9 virtu\u00e1ln\u00ed stroje vytvo\u0159it velmi hust\u00e9 \u201eminov\u00e9\u201c pole pro \u00fato\u010dn\u00edky a saturaci s\u00edt\u011b podniku, v\u0161echny jeho VLANy, na\u0161imi senzory. \u00dato\u010dn\u00edk vid\u00ed takov\u00fd senzor, nebo phant\u00f3mov\u00fd host, jako skute\u010dn\u00fd po\u010d\u00edta\u010d se syst\u00e9mem Windows, Linux server nebo jin\u00e9 za\u0159\u00edzen\u00ed, kter\u00e9 mu rozhodujeme uk\u00e1zat.\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/306c21046c5baadd591b66cdfe153ec2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPro u\u017eitek a zv\u00eddavost jsme nasadili \u201eka\u017ed\u00e9 potvo\u0159e p\u00e1r\u201c \u2013 po\u010d\u00edta\u010de se syst\u00e9mem Windows a servery r\u016fzn\u00fdch verz\u00ed, Linux servery, bankomat s Windows embedded, SWIFT Web Access, s\u00ed\u0165ov\u00e1 tisk\u00e1rna, Cisco switch, IP kamera Axis, MacBook, PLC za\u0159\u00edzen\u00ed a dokonce chytrou \u017e\u00e1rovku. Celkem \u2013 13 host\u016f. Obecn\u011b v\u00fdrobce doporu\u010duje nasazovat takov\u00e9 senzory v po\u010dtu minim\u00e1ln\u011b 10 % od skute\u010dn\u00e9ho po\u010dtu host\u016f. Horn\u00ed limit je dostupn\u00fd adresn\u00ed prostor. <\/p>\n<p>Velmi d\u016fle\u017eit\u00fdm bodem je to, \u017ee ka\u017ed\u00fd takov\u00fd host nen\u00ed plnohodnotn\u00e1 virtu\u00e1ln\u00ed stroj, kter\u00fd vy\u017eaduje zdroje a licence. Je to \u201efinta\u201c, emulace, jeden proces na TSA, kter\u00fd m\u00e1 soubor parametr\u016f a IP adresu. Proto m\u016f\u017eeme pomoc\u00ed i jednoho TSA saturac\u00ed s\u00edt\u011b stovkami takov\u00fdch phant\u00f3mov\u00fdch host\u016f, kter\u00e9 budou fungovat jako senzory v syst\u00e9mu zabezpe\u010den\u00ed. Pr\u00e1v\u011b tato technologie umo\u017e\u0148uje ekonomicky efektivn\u011b \u0161k\u00e1lovat koncept \u201ehoneypot\u016f\u201c v m\u011b\u0159\u00edtku jak\u00e9hokoli velk\u00e9ho distribuovan\u00e9ho podniku. <\/p>\n<p>Tyto hosty jsou z pohledu \u00fato\u010dn\u00edka atraktivn\u00ed, proto\u017ee obsahuj\u00ed zranitelnosti a vypadaj\u00ed jako relativn\u011b snadn\u00e9 c\u00edle. \u00dato\u010dn\u00edk vid\u00ed slu\u017eby na t\u011bchto hostech a m\u016f\u017ee s nimi interagovat, \u00fato\u010dit na n\u011b pomoc\u00ed standardn\u00edch n\u00e1stroj\u016f a protokol\u016f (smb\/wmi\/ssh\/telnet\/web\/dnp\/bonjour\/Modbus atd.). Ale nelze tyto hosty pou\u017e\u00edt pro rozvoj \u00fatoku a spu\u0161t\u011bn\u00ed sv\u00e9ho k\u00f3du.\n<\/li>\n<li>Kombinace t\u011bchto dvou technologi\u00ed (FullOS a emulovan\u00fdch past\u00ed) umo\u017e\u0148uje dos\u00e1hnout vysok\u00e9 statistick\u00e9 pravd\u011bpodobnosti, \u017ee \u00fato\u010dn\u00edk se d\u0159\u00edve nebo pozd\u011bji setk\u00e1 s n\u011bjak\u00fdm prvkem na\u0161\u00ed sign\u00e1ln\u00ed s\u00edt\u011b. Jak v\u0161ak zajistit, aby tato pravd\u011bpodobnost byla bl\u00edzk\u00e1 100%?\n<p>Do akce vstupuj\u00ed takzvan\u00e9 tokeny (Deception tokens). D\u00edky nim m\u016f\u017eeme zapojit do na\u0161eho distribuovan\u00e9ho IDS v\u0161echny dostupn\u00e9 po\u010d\u00edta\u010de a servery podniku. Tokeny jsou um\u00edst\u011bny na skute\u010dn\u00fdch po\u010d\u00edta\u010d\u00edch u\u017eivatel\u016f. Je d\u016fle\u017eit\u00e9 pochopit, \u017ee tokeny nejsou agenty, kte\u0159\u00ed by spot\u0159ebov\u00e1vali zdroje a mohli vyvol\u00e1vat konflikty. Tokeny jsou pasivn\u00ed informa\u010dn\u00ed prvky, jak\u00e9si \u201edrobe\u010dky\u201c pro \u00fato\u010dn\u00edka, kter\u00e9 ho vedou do pasti. Nap\u0159\u00edklad p\u0159ipojen\u00e9 s\u00ed\u0165ov\u00e9 disky, z\u00e1lo\u017eky na fale\u0161n\u00e9 webov\u00e9 administrace v prohl\u00ed\u017ee\u010di a ulo\u017een\u00e1 hesla k nim, ulo\u017een\u00e9 ssh\/rdp\/winscp relace, na\u0161e past\u00ed s koment\u00e1\u0159i v souborech hosts, ulo\u017een\u00e1 hesla v pam\u011bti, p\u0159ihla\u0161ovac\u00ed \u00fadaje neexistuj\u00edc\u00edch u\u017eivatel\u016f, kancel\u00e1\u0159sk\u00e9 soubory, jejich\u017e otev\u0159en\u00ed vyvol\u00e1 spu\u0161t\u011bn\u00ed syst\u00e9mu, a mnoho dal\u0161\u00edho. Takto umis\u0165ujeme \u00fato\u010dn\u00edka do zkreslen\u00e9ho prost\u0159ed\u00ed, nasycen\u00e9ho t\u011bmi vektory \u00fatok\u016f, kter\u00e9 pro n\u00e1s ve skute\u010dnosti nep\u0159edstavuj\u00ed hrozbu, ale naopak. A on nem\u00e1 mo\u017enost ur\u010dit, kter\u00e1 informace je pravdiv\u00e1 a kter\u00e1 fale\u0161n\u00e1. Tak\u017ee nejen \u017ee zaji\u0161\u0165ujeme rychl\u00e9 rozpozn\u00e1n\u00ed \u00fatoku, ale tak\u00e9 zna\u010dn\u011b zpomalujeme jeho pr\u016fb\u011bh. <\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/812409dca0c8bc991c7e9812f16d77cf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>P\u0159\u00edklad vytvo\u0159en\u00ed s\u00ed\u0165ov\u00e9 pasti a nastaven\u00ed token\u016f. P\u0159\u00e1telsk\u00e9 rozhran\u00ed a \u017e\u00e1dn\u00e9 ru\u010dn\u00ed \u00fapravy konfigurac\u00ed, skript\u016f atd.<\/i><\/p>\n<p>V na\u0161em prost\u0159ed\u00ed jsme nakonfigurovali a um\u00edstili \u0159adu takov\u00fdch token\u016f na FOS01 s Windows Server 2012R2 a testov\u00e9m po\u010d\u00edta\u010di s Windows 7. Na t\u011bchto stroj\u00edch je spu\u0161t\u011bno RDP a ob\u010das je \u201evystavujeme\u201c v DMZ, kde jsou tak\u00e9 um\u00edst\u011bny na\u0161e senzory (emulovan\u00e9 pasti). Tak z\u00edsk\u00e1v\u00e1me st\u00e1l\u00fd tok incident\u016f, tak \u0159\u00edkaj\u00edc, p\u0159irozen\u011b. <\/p>\n<p>Tak\u017ee, stru\u010dn\u00e1 statistika za rok:<\/p>\n<p>56 208 \u2013 incident\u016f bylo zaznamen\u00e1no,<br \/>\n2 912 \u2013 hostitel\u016f zdroj\u016f \u00fatok\u016f bylo objeveno. <\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/0b2404084a997ba5fe4ad33303501612.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Interaktivn\u00ed, klikac\u00ed mapa \u00fatok\u016f<\/i><\/p>\n<p>\u0158e\u0161en\u00ed nezpracov\u00e1v\u00e1 \u017e\u00e1dn\u00e9 mega-logy nebo ud\u00e1losti, kter\u00e9 by vy\u017eadovaly dlouh\u00e9 vy\u0161et\u0159ov\u00e1n\u00ed. M\u00edsto toho samo klasifikuje ud\u00e1losti podle typ\u016f a umo\u017e\u0148uje t\u00fdmu IT bezpe\u010dnosti soust\u0159edit se p\u0159edev\u0161\u00edm na nejnebezpe\u010dn\u011bj\u0161\u00ed situace \u2013 kdy\u017e \u00fato\u010dn\u00edk se sna\u017e\u00ed zvednout \u0159\u00edd\u00edc\u00ed sezen\u00ed (interaction) nebo kdy\u017e se v na\u0161em provozu objevuj\u00ed bin\u00e1rn\u00ed payloady (infection). <\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/d0ad109bae7dc0fb80182d43be713d4e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u0161echny informace o ud\u00e1lostech jsou \u010diteln\u00e9 a podle m\u00e9ho n\u00e1zoru jsou prezentov\u00e1ny zp\u016fsobem, kter\u00fd je snadno pochopiteln\u00fd i pro u\u017eivatele s z\u00e1kladn\u00edmi znalostmi v oblasti IT bezpe\u010dnosti. <\/p>\n<p>V\u011bt\u0161ina zaznamenan\u00fdch incident\u016f jsou pokusy o skenov\u00e1n\u00ed na\u0161ich hostitel\u016f nebo jednotliv\u00fdch spojen\u00ed. <\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/ea87b3592b2d3727815050b9fd1f708e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNebo pokusy o prolomen\u00ed hesel pro RDP.<\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/645b5984d1ffaf31758fb23e9a23c9eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAle objevily se i zaj\u00edmav\u011bj\u0161\u00ed p\u0159\u00edpady, zejm\u00e9na kdy\u017e se \u00fato\u010dn\u00edk\u016fm \"poda\u0159ilo\" uh\u00e1dnout heslo pro RDP a z\u00edskat p\u0159\u00edstup do m\u00edstn\u00ed s\u00edt\u011b. <\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/3cde5beadaa306d32c382f66bd67ec33.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00dato\u010dn\u00edk se pokou\u0161\u00ed prov\u00e9st k\u00f3d pomoc\u00ed psexec.<\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/1356ef44f3581b37c3163ce454fecf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00dato\u010dn\u00edk na\u0161el ulo\u017eenou relaci, kter\u00e1 ho navedla do pasti v podob\u011b Linux serveru. Ihned po p\u0159ipojen\u00ed pomoc\u00ed p\u0159edem p\u0159ipraven\u00e9 sady p\u0159\u00edkaz\u016f se pokusil zni\u010dit v\u0161echny souborov\u00e9 protokoly a p\u0159\u00edslu\u0161n\u00e9 syst\u00e9mov\u00e9 prom\u011bnn\u00e9.<\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/6d8994cd3bb2268e45540e5bbcdc74a4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00dato\u010dn\u00edk se pokou\u0161\u00ed prov\u00e9st SQL injekci na pasti, kter\u00e1 imituje SWIFT Web Access.<\/p>\n<p>Krom\u011b takov\u00fdch \"p\u0159irozen\u00fdch\" \u00fatok\u016f jsme prov\u00e1d\u011bli i n\u011bkolik vlastn\u00edch test\u016f. Jedn\u00edm z nejv\u00fdznamn\u011bj\u0161\u00edch je testov\u00e1n\u00ed doby detekce s\u00ed\u0165ov\u00e9ho \u010derva v s\u00edti. K tomu jsme pou\u017eili n\u00e1stroj od GuardiCore, kter\u00fd se naz\u00fdv\u00e1 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.guardicore.com\/infectionmonkey\/\">Infection Monkey<\/a><\/noindex>. Je to s\u00ed\u0165ov\u00fd \u010derv, kter\u00fd dok\u00e1\u017ee kompromitovat Windows a Linux, ale bez n\u011bjak\u00e9ho \"u\u017eite\u010dn\u00e9ho\" zat\u00ed\u017een\u00ed. <br \/>\nNasadili jsme m\u00edstn\u00ed opera\u010dn\u00ed centrum, na jednom z po\u010d\u00edta\u010d\u016f jsme spustili prvn\u00ed instanci \u010derva a dostali prvn\u00ed upozorn\u011bn\u00ed na konzoli TrapX za m\u00e9n\u011b ne\u017e jednu a p\u016fl minuty. TTD 90 sekund oproti pr\u016fm\u011brn\u011b 106 dn\u016fm\u2026 <\/p>\n<p>D\u00edky mo\u017enosti integrace s jin\u00fdmi typy \u0159e\u0161en\u00ed m\u016f\u017eeme p\u0159ej\u00edt od rychl\u00e9ho detekov\u00e1n\u00ed hrozeb k automatick\u00e9mu reagov\u00e1n\u00ed na n\u011b. <\/p>\n<p>Nap\u0159\u00edklad integrace se syst\u00e9my NAC (Network Access Control) nebo s CarbonBlack umo\u017en\u00ed automaticky odpojit kompromitovan\u00e9 PC od s\u00edt\u011b. <\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/4364d6374b57e5741e33f8981b4cb0ad.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIntegrace se sandboxy umo\u017e\u0148uje automaticky p\u0159ed\u00e1vat k anal\u00fdze soubory zapojen\u00e9 do \u00fatoku. <\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/c66b8051d0dbd31c1215329d1b55930b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Integrace s McAfee<\/h3>\n<p>\nK \u0159e\u0161en\u00ed pat\u0159\u00ed i vestav\u011bn\u00fd syst\u00e9m korelace ud\u00e1lost\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/d4030212690f3ee1f1a641c49bc90960.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAle jeho mo\u017enosti n\u00e1s neuspokojily, tak\u017ee jsme ho integrovali s HP ArcSight.<\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/f08d607c5b4abf8dc354f65ed2591ebc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSe zji\u0161t\u011bn\u00fdmi hrozbami n\u00e1m pom\u00e1h\u00e1 vestav\u011bn\u00fd syst\u00e9m ticketingu na principu \"v\u0161ichni pro jednoho\".<\/p>\n<p><img decoding=\"async\" alt=\"D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \u201ena \u017eivce\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/0e78fa59b2f2b114fa9bdf572f37ea96.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nProto\u017ee \u0159e\u0161en\u00ed bylo od po\u010d\u00e1tku navr\u017eeno pro pot\u0159eby st\u00e1tn\u00edch org\u00e1n\u016f a velk\u00fdch korpor\u00e1tn\u00edch segment\u016f, je samoz\u0159ejm\u00e9, \u017ee zde byla implementov\u00e1na role p\u0159\u00edstupov\u00e9ho modelu, integrace s AD, pokro\u010dil\u00fd syst\u00e9m report\u016f a trigger\u016f (ud\u00e1lostn\u00ed notifikace) a orchestraci pro velk\u00e9 holdingov\u00e9 struktury nebo MSSP poskytovatele. <\/p>\n<h3>Nam\u00edsto shrnut\u00ed<\/h3>\n<p>\nPokud existuje takov\u00fd syst\u00e9m monitorov\u00e1n\u00ed, kter\u00fd n\u00e1m, obrazn\u011b \u0159e\u010deno, kryje z\u00e1da, pak s kompromitac\u00ed perimetru to teprve za\u010d\u00edn\u00e1. Nejv\u00edc d\u016fle\u017eit\u00e9 je, \u017ee se objevuje re\u00e1ln\u00e1 mo\u017enost bojovat s incidenty kybernetick\u00e9 bezpe\u010dnosti, nikoli jen \u0159e\u0161it jejich n\u00e1sledky.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/softline\/blog\/413893\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G. Brester sebres) \u041a\u043e\u043b\u043b\u0435\u0433\u0438, \u0446\u0435\u043b\u044c\u044e \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0433\u043e\u0434\u0438\u0447\u043d\u043e\u0439 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 IDS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Deception-\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439. \u0427\u0442\u043e\u0431\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u0441\u0447\u0438\u0442\u0430\u044e \u043d\u0443\u0436\u043d\u044b\u043c \u043d\u0430\u0447\u0430\u0442\u044c \u0441 \u043f\u0440\u0435\u0434\u043f\u043e\u0441\u044b\u043b\u043e\u043a. \u0418\u0442\u0430\u043a, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0442\u0438\u043a\u0430: \u041d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u2013 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0432\u0438\u0434 \u0430\u0442\u0430\u043a, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432 \u043e\u0431\u0449\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0433\u0440\u043e\u0437 \u0438\u0445 \u0443\u0434\u0435\u043b\u044c\u043d\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0414\u044b\u0440\u0430 \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2013 2, \u0438\u043b\u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u044c APT \u00ab\u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T17:42:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T17:42:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47D\u00edra jako n\u00e1stroj bezpe\u010dnosti \u2013 2, nebo jak chytit APT \"na \u017eivce\" | ProHoster","description":"(za n\u00e1pad na titulek d\u011bkujeme Sergey G.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u044b\u0440\u0430 \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2013 2, \u0438\u043b\u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u044c APT \u00ab\u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb | ProHoster","og:description":"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T17:42:33+00:00","article:modified_time":"2020-10-09T17:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:47:24","updated":"2022-10-03 07:10:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/96242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=96242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/96242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/96243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=96242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=96242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=96242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}