{"id":30167,"date":"2019-10-31T21:33:58","date_gmt":"2019-10-31T18:33:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform\/"},"modified":"2019-10-31T21:33:58","modified_gmt":"2019-10-31T18:33:58","slug":"razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","title":{"rendered":"Analysis of a critical error in the encryption algorithm of the KIB SEARCHINFORM.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Controlling all information circulating within the organization is one of the main tasks in the practical implementation of organizational and administrative documents (information security policy and other internal lower-level documents) of the organization.
\nData Leak Prevention (DLP) systems are largely capable of addressing this problem.
\n<\/a><\/noindex>
\nThere are enough types of these systems on the modern market, such as SearchInform DLP, Infowatch Traffic Monitor DLP, Zecurion DLP, Symantec DLP, and others. However, today's article will focus on the product of SearchInform LLC.<\/p>\n

The SearchInform Information Security Framework (KIB SearchInform) is a serious and flexibly configurable software complex that, due to its functionality and extensive analytical tools, creates significant competition for other companies in this field. However, like all products, KIB SearchInform has a drawback, which will be discussed now.<\/p>\n

\"Analysis
\n
\nFigure 1 \u2013 KIB SearchInform Logo<\/i><\/p>\n

In KIB SearchInform, one of the sources of information gathering is the agent (Windows\/Linux). The agent for Windows, just like for Linux, has a modular information-gathering system, where modules can be turned on or off as needed. We will examine the Device module (control of external devices, network devices, processes, etc.). A demo version of this product can be obtained officially through the developer's website (with full functionality). Further actions will be carried out using the obtained license key \u2014 EndPointController version 5.51.0.9 (agent version 5.51.0.9).<\/p>\n

The main problem with this module is the encryption algorithm for information on external removable devices. Let\u2019s consider how the encryption algorithm works in KIB SearchInform.<\/p>\n

We install the agent on the workstation and set up control of external devices (Device module) in the 'Network Environment' section of EndPointController 5.51.0.9.<\/p>\n

\"Analysis
\nFigure 2 \u2013 Installation and activation of the module<\/i><\/p>\n

We configure encryption in the Device module settings under the 'Encryption' tab: we generate a key and enable encryption for all media (encryption can optionally be enabled only for specific information carriers).<\/p>\n

\"Analysis
\nFigure 3 \u2013 Whitelist configuration<\/i><\/p>\n

\"Analysis
\nFigure 4 \u2013 Encryption Configuration<\/i><\/p>\n

Now we proceed to analyze the file encryption algorithm using this product. We will copy the files \"Install.exe\" and \"Fundamentals of Law.rtf\" from the controlled workstation \"WINOC\" to an external removable storage device \"Removable Disk (E:)\". As shown in Figure 5, in the hidden folder \"System Volume Information\", the objects \"Install.exe\" and \"Fundamentals of Law.rtf\" have been created. Thus, we can conclude that the folder \"System Volume Information\" contains a list of encrypted objects on the removable storage.<\/p>\n

\"Analysis
\nFigure 5 \u2013 the folder \"System Volume Information\"<\/i><\/p>\n

\"Analysis
\nFigure 6 \u2013 Root folder of the information removable storage<\/i><\/p>\n

As is known, there are three aspects upon which information security is built \u2013 integrity, availability, and confidentiality. These aspects are compromised with the use of this encryption approach, as the system information indicating whether an object is encrypted must reside within the object's header. <\/p>\n

With the current algorithm design, there is a possibility of random modification\/deletion of the objects in the folder \"System Volume Information\" on the removable storage, leading to the loss of the original encrypted objects, as well as modification of the objects themselves on uncontrolled workstations (for example, renaming the object \"Install.exe\" with the network path \"E:Install.exe\" on a computer without an agent, while the informational file of the KIB Searchinform product in the folder \"System Volume Information\" \"Install.exe\" with the network path \"E:System Volume InformationInstall.exe\" remains unchanged since there is no agent to modify the metadata, making the opening of this file impossible).<\/p>\n

We hope that the developer will take note of this flaw in the encryption functionality for removable information storage in the KIB Searchinform product and revise its algorithm.
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0432\u0441\u0435\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 \u043f\u0440\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u043e-\u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u043d\u0438\u0436\u043d\u0438\u0445 \u0443\u0440\u043e\u0432\u043d\u0435\u0439) \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0421\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u0437 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (Data Leak Prevention, DLP) \u0432 \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u041d\u0430 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u0440\u044b\u043d\u043a\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0435\u0439 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a: […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30167","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Analysis of a critical error in the encryption algorithm of KIB SEARCHINFORM | ProHoster","description":"Monitoring all information circulating within the organization is one of the main tasks in the practical implementation of organizational and administrative documents (information security policy and other internal documents).","canonical_url":"https:\/\/prohoster.info\/en\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u043e\u0440 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u041a\u0418\u0411 SEARCHINFORM | ProHoster","og:description":"\u041a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0432\u0441\u0435\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 \u043f\u0440\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u043e-\u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435.","og:url":"https:\/\/prohoster.info\/en\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:33:58+00:00","article:modified_time":"2019-10-31T18:33:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30167","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 23:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:40:41","updated":"2026-01-20 23:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/30167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=30167"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/30167\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=30167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=30167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=30167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}