{"id":30167,"date":"2019-10-31T21:33:58","date_gmt":"2019-10-31T18:33:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform\/"},"modified":"2019-10-31T21:33:58","modified_gmt":"2019-10-31T18:33:58","slug":"razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","title":{"rendered":"Analyse af en kritisk fejl i algoritmen for kryptering af KIB SEARCHINFORM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kontrol af al information, der cirkulerer i organisationen, er en af de vigtigste opgaver ved praktisk implementering af organisatoriske ledelsesdokumenter (politik for informationssikkerhed og andre interne dokumenter p\u00e5 lavere niveau) i organisationen.
\nSystemer til forebyggelse af l\u00e6kage af fortrolig information fra informationssystemet (Data Leak Prevention, DLP) er i vid udstr\u00e6kning i stand til at l\u00f8se dette problem.
\n<\/a><\/noindex>
\nP\u00e5 det moderne marked er der mange variationer af disse systemer, s\u00e5som: SearchInform DLP, Infowatch Traffic Monitor DLP, Zecurion DLP, Symantec DLP og andre. Men i dag vil denne artikel handle om produktet fra selskabet LLC \"SearchInform\".<\/p>\n

Informational Security Framework SearchInform (KIB SearchInform) er et seri\u00f8st og fleksibelt softwarekompleks, der med sin funktionalitet og omfattende analytiske v\u00e6rkt\u00f8jer skaber alvorlig konkurrence til andre virksomheder i denne branche. Men ligesom alle produkter har KIB SearchInform en af de ulemper, som vi nu vil dr\u00f8fte.<\/p>\n

\"Analyse
\n
\nFigur 1 \u2013 KIB SearchInform logo<\/i><\/p>\n

I KIB SearchInform er en af kilderne til informationsindsamling agenten (Windows\/Linux). Agenten til Windows-operativsystemet, ligesom til Linux-operativsystemet, har et modul\u00e6rt system til informationsindsamling, hvor modulerne kan aktiveres eller deaktiveres efter behov. Vi vil se p\u00e5 modulet Device (kontrol af eksterne enheder, netv\u00e6rksenheder, processer osv.). En demo-version af dette produkt kan officielt hentes fra udviklerens hjemmeside (med fuld funktionalitet). De n\u00e6ste trin vil blive udf\u00f8rt ved hj\u00e6lp af den modtagne licensn\u00f8gle \u2014 versionen af programmet EndPointController 5.51.0.9 (agentversion 5.51.0.9).<\/p>\n

Det st\u00f8rste problem med arbejdet i dette modul er algoritmen til kryptering af information p\u00e5 eksterne flytbare enheder. Lad os se p\u00e5, hvordan krypteringsalgoritmen fungerer i KIB SearchInform.<\/p>\n

Vi installerer agenten p\u00e5 arbejdsstationen og indstiller arbejds- kontrol af eksterne enheder (modul Device) i sektionen 'Netv\u00e6rk' i EndPointController 5.51.0.9.<\/p>\n

\"Analyse
\nFigur 2 \u2013 Installation og aktivering af modulet<\/i><\/p>\n

Vi udf\u00f8rer krypteringskonfigurationen i indstillingerne for modulet Device under fanen 'Kryptering': genererer en n\u00f8gle og aktiverer kryptering for alle medier (det er muligt at aktivere kryptering kun for bestemte informationsmedier).<\/p>\n

\"Analyse
\nFigur 3 \u2013 Indstilling af hvid liste<\/i><\/p>\n

\"Analyse
\nFigur 4 \u2013 Konfiguration af kryptering<\/i><\/p>\n

Lad os nu se n\u00e6rmere p\u00e5 krypteringsalgoritmen, der anvendes af dette produkt. Vi kopierer filerne \u00abInstall.exe\u00bb og \u00abGrundl\u00e6ggende rettigheder.rtf\u00bb fra den kontrollerede arbejdsstation \u00abWINOC\u00bb til det eksterne b\u00e6rbare drev \u00abB\u00e6rbar disk (E:)\u00bb. Som det ses i figur 5, blev der oprettet objekter \u00abInstall.exe\u00bb og \u00abGrundl\u00e6ggende rettigheder.rtf\u00bb i den skjulte mappe \u00abSystem Volume Information\u00bb. Dermed kan det konkluderes, at mappen \u00abSystem Volume Information\u00bb indeholder en liste over de krypterede objekter p\u00e5 det b\u00e6rbare drev.<\/p>\n

\"Analyse
\nFigur 5 \u2013 Mappen \u00abSystem Volume Information\u00bb<\/i><\/p>\n

\"Analyse
\nFigur 6 \u2013 Rodmappen p\u00e5 det b\u00e6rbare informationslager<\/i><\/p>\n

Som kendt er der tre aspekter, som bygger p\u00e5 informationssikkerhed \u2013 integritet, tilg\u00e6ngelighed og fortrolighed. Disse aspekter undermineres ved brug af denne krypteringsmetode, da systeminformation om et objekts kryptering eller ej skal findes i selve objektets header. <\/p>\n

Med den nuv\u00e6rende opbygning af algoritmen er der muligheder for tilf\u00e6ldig \u00e6ndring\/sletning af objekter i mappen \u00abSystem Volume Information\u00bb p\u00e5 det b\u00e6rbare drev, hvilket kan f\u00f8re til tab af de oprindelige krypterede objekter, samt \u00e6ndring af selve objekterne p\u00e5 ukontrollerede stationer (f.eks. omd\u00f8be objekter \u00abInstall.exe\u00bb med netv\u00e6rksstien \u00abE:Install.exe\u00bb p\u00e5 en computer uden agent, mens informationsfilen fra softwareproduktet KIB S\u00f8rchinform i mappen \u00abSystem Volume Information\u00bb \u00abInstall.exe\u00bb med netv\u00e6rksstien \u00abE:System Volume InformationInstall.exe\u00bb forbliver u\u00e6ndret, da der ikke er nogen agent til at \u00e6ndre metadataene, hvilket g\u00f8r \u00e5bning af denne fil umulig).<\/p>\n

Lad os h\u00e5be, at udvikleren tager denne mangel i krypteringsfunktionen for b\u00e6rbare informationslagermedier i produktet KIB S\u00f8rchinform i betragtning og \u00e6ndrer algoritmen.
\n
Kilde: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0432\u0441\u0435\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 \u043f\u0440\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u043e-\u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u043d\u0438\u0436\u043d\u0438\u0445 \u0443\u0440\u043e\u0432\u043d\u0435\u0439) \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0421\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u0437 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (Data Leak Prevention, DLP) \u0432 \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u041d\u0430 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u0440\u044b\u043d\u043a\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0435\u0439 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a: […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30167","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Analyse af den kritiske fejl i krypteringsalgoritmen for KIB SEARCHINFORM | ProHoster","description":"Kontrol af al information, der cirkulerer i organisationen, er en af de vigtigste opgaver ved praktisk implementering af organisationens styringsdokumenter (politikken for informationssikkerhed og andre interne dokumenter).","canonical_url":"https:\/\/prohoster.info\/da\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u043e\u0440 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u041a\u0418\u0411 SEARCHINFORM | ProHoster","og:description":"\u041a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0432\u0441\u0435\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 \u043f\u0440\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u043e-\u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435.","og:url":"https:\/\/prohoster.info\/da\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:33:58+00:00","article:modified_time":"2019-10-31T18:33:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30167","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 23:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:40:41","updated":"2026-01-20 23:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/30167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=30167"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/30167\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=30167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=30167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=30167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}