In February, the Austrian Christian Haschek published an interesting article on his blog titled . Naturally, I was curious about what would happen if I repeated this research, but focusing on Ukraine instead. Several weeks of round-the-clock data collection, a couple more days to compose the article, and during this research, conversations with various representatives of our community to clarify points and gain further insights. Please read on…
TL;DR
No special tools were used for data collection (although a few people suggested using OpenVAS to make the research more thorough and informative). In my opinion, the situation concerning IP addresses related to Ukraine (more on how they were determined below) is quite poor (and definitely worse than what’s happening in Austria). No attempts have been made, nor are planned, to exploit the discovered vulnerable servers.
First of all: how can one obtain all the IP addresses that belong to a particular country?
It's actually quite simple. IP addresses are not generated by the country itself; they are allocated to it. Therefore, there exists a list (which is public) of all countries and the IPs that belong to them.
Anyone can , and then filter it using grep Ukraine IP2LOCATION-LITE-DB1.CSV> ukraine.csv
allows for converting the list into a more usable format.
Ukraine possesses almost as many IPv4 addresses as Austria, more than 11 million—11,640,409 to be exact (for comparison, Austria has 11,170,487).
If you don't want to play with IP addresses yourself (and you shouldn't!), you can use the service .
Are there unpatched Windows machines in Ukraine with direct access to the internet?
Of course, no conscious Ukrainian would open such access to their computers. Or would they?
masscan -p445 --rate 300 -iL ukraine.ips -oG ukraine.445.scan && cat ukraine.445.scan | wc -l5,669 Windows machines with direct network access were found (in Austria, there are only 1,273, but that's still a lot).
Oops. Are there any among them that could be attacked using the ETERNALBLUE exploits known since 2017? There were none of such machines in Austria, and I hoped there wouldn't be any found in Ukraine either. Unfortunately, it's useless. A total of 198 IP addresses have been found that did not close this 'hole' in their systems.
DNS, DDoS, and the rabbit hole depth
Enough about Windows. Let's see what we have with DNS servers that are open resolvers and can be used for a DDoS attack.
It works roughly like this. The attacker sends a small DNS request, and the vulnerable server responds to the victim with a packet that is 100 times larger. Boom! Corporate networks can quickly crash under such a data load, and a modern smartphone can provide the bandwidth needed for the attack. Such attacks have occurred even on GitHub.
Let's see if there are any such servers in Ukraine.
masscan -pU 53 -iL ukraine.ips -oG ukraine.53.scan && cat ukraine.53.scan | wc -lThe first step is to find those that have an open port 53. As a result, we have a list of 58,730 IP addresses, but that doesn't mean they can all be used for a DDoS attack. The second requirement must be met, namely, they need to be open resolvers.
For this, a simple dig command can be used to see what we can 'dig up': dig +short test.openresolver.com TXT @ip.of.dns.server. If the server responds with 'open-resolver-detected', it can be considered a potential attack target. Open resolvers constitute about 25%, which is comparable to Austria. In terms of the total number, this is about 0.02% of all Ukrainian IPs.
What else can be found in Ukraine?
Glad you asked. It’s easier (and personally, the most interesting for me) to look at IPs with an open port 80 and see what is 'running' on them.
web servers
260,849 Ukrainian IPs respond on port 80 (http). 125,444 addresses positively responded (200 status) to a simple GET request that your browser could send. The rest returned various errors. Interestingly, 853 servers returned a 500 status, while the rarest statuses were 407 (proxy authorization request) and the absolutely non-standard 602 (IP not in 'whitelist') with one response each.
Apache is absolutely dominant — 114,544 servers use it. The oldest version I found in Ukraine is 1.3.29, released on October 29, 2003 (!!!). Nginx is in second place with 61,659 servers.
11 servers run WinCE, which was released in 1996 and had its last patch in 2013 (there are only 4 of them in Austria).
The HTTP/2 protocol uses 5,144 servers, HTTP/1.1 — 256,836, and HTTP/1 — 13,491.
Printers... because... why not?
2 HP, 5 Epson, and 4 Canon printers are available online, some without any authentication.
webcams
It's no secret that Ukraine has A LOT of webcams streaming to the internet, collected from various resources. At least 75 cameras stream online without any protection. You can view them .
What's next?
Ukraine is a small country, like Austria, but faces the same IT challenges as larger nations. We need to develop a better understanding of what is safe and what is risky, and manufacturers must provide secure baseline configurations for their equipment.
Additionally, I am gathering partner companies () that can help you ensure the security of your IT infrastructure. The next step is to review the security of Ukrainian websites. Stay tuned!
Source: habr.com
