{"id":30310,"date":"2019-10-31T21:34:48","date_gmt":"2019-10-31T18:34:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ya-proskaniroval-ukrainu\/"},"modified":"2019-10-31T21:34:48","modified_gmt":"2019-10-31T18:34:48","slug":"ya-proskaniroval-ukrainu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/ya-proskaniroval-ukrainu","title":{"rendered":"Skaneerisin Ukrainat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Veebruaris avaldas austraallane Christian Haschek oma blogis huvitava artikli pealkirjaga \u201eMa skaneerisin kogu Austria\u201c<\/a><\/noindex>. Loomulikult tekkis mul huvi, mida juhtuks, kui korrata seda uuringut, aga juba Ukrainaga. M\u00f5ned n\u00e4dalad \u00f6\u00f6p\u00e4evaringset teabe kogumist, veel paar p\u00e4eva artikli vormistamiseks ning selle uuringu k\u00e4igus vestlused erinevate meie \u00fchiskonna esindajatega, et selgitada ja rohkem teada saada. Palun lugege edasi...
\n<\/a><\/noindex><\/p>\n

TL;DR<\/h2>\n

\nTeabe kogumisel ei kasutatud mingeid spetsiaalseid vahendeid (kuigi m\u00f5ned soovitasid kasutada sama OpenVAS-i, et uuringut p\u00f5hjalikumaks ja informatiivsemaks teha). IP-de turvalisuse osas, mis kuuluvad Ukrainale (allpool kuidas neid m\u00e4\u00e4ratleti), on olukord, minu arvates, \u00fcsna halb (ja kindlasti halvem kui see, mis toimub Austrias). \u00dckski katse avastatud haavatavate serverite kasutamiseks ei ole tehtud ega plaanitud.<\/p>\n

Esiteks: kuidas saab saada k\u00f5iki IP-aadresse, mis kuuluvad teatud riiki?<\/h2>\n

\nSee on t\u00f5epoolest v\u00e4ga lihtne. IP-aadresse ei genereeri riik ise, vaid need antakse sellele v\u00e4lja. Seet\u00f5ttu on olemas loetelu (ja see on avalik) k\u00f5igist riikidest ja k\u00f5igist IP-dest, mis neile kuuluvad.<\/p>\n

Iga\u00fcks saab selle alla laadida<\/a><\/noindex>, seej\u00e4rel filtreerida grepi abil Ukraine IP2LOCATION-LITE-DB1.CSV > ukraine.csv<\/p>\n

Lihtne skript, mille l\u00f5i Kristian<\/a><\/noindex>, muudab loendi rohkem kasutatavaks.<\/p>\n

Ukrainale kuulub peaaegu sama palju IPv4-aadresse kui Austraaliale, \u00fcle 11 miljoni. T\u00e4pselt 11 640 409 (v\u00f5rdluseks Austrias \u2014 11 170 487).<\/p>\n

Kui te ei soovi IP-aadressidega iseseisvalt m\u00e4ngida (ja seda ei tasu teha!), siis v\u00f5ib kasutada teenust Shodan.io<\/a><\/noindex>.<\/p>\n

Kas Ukrainas on patche'imata Windowsi masinaid, millel on otsene interneti\u00fchendus?<\/h2>\n

\nKuna \u00fckski teadlik ukrainlane ei avaks sellist juurdep\u00e4\u00e4su oma arvutitele. V\u00f5i siiski?<\/p>\n

masscan -p445 --rate 300 -iL ukraine.ips -oG ukraine.445.scan && cat ukraine.445.scan | wc -l<\/code><\/pre>\n
\nLeiti 5669 Windowsi masinat, millel on otsene ligip\u00e4\u00e4s v\u00f5rku (Austrias on neid vaid 1273, aga see on ka palju).<\/p>\n
Oi. Kas nende hulgas on selliseid, mida saaks r\u00fcnnata ETHERNALBLUE exploit'idega, mis on tuntud alates 2017. aastast? Austrias ei olnud \u00fchtegi sellist masinat ja lootsin, et ka Ukrainas ei leita neid. Kahjuks on see asjatu. Leitud on 198 IP-aadressi, mis ei ole selle 'augu' eest hoolitsenud.<\/p>\n
DNS, DDoS ja k\u00fc\u00fclikuaugu s\u00fcgavus<\/h2>\n
\nJ\u00e4tame Windowsi k\u00f5rvale. Vaadakem, kuidas on lood DNS-serveritega, mis on avatud resolver'id ja mida saab kasutada DDoS r\u00fcnnakuks.<\/p>\n
See t\u00f6\u00f6tab umbes nii. R\u00fcndaja saadab v\u00e4ikese DNS-p\u00e4ringu ning haavatav server vastab ohvrile paketiga, mis on 100 korda suurem. Pauk! Ettev\u00f5tte v\u00f5rgud v\u00f5ivad sellise andmehulga t\u00f5ttu \u00fcsna kiiresti kokku kukkuda ja r\u00fcnnakuks on vajalik ribalaius, mida suudab pakkuda kaasaegne nutitelefon. Sellised r\u00fcnnakud ei olnud haruldased<\/a><\/noindex> isegi GitHubis.<\/p>\n
Vaadakem, kas Ukrainas on selliseid servereid.<\/p>\n
masscan -pU 53 -iL ukraine.ips -oG ukraine.53.scan && cat ukraine.53.scan | wc -l<\/code><\/pre>\n
\nEsimene samm on leida need, millel on avatud 53. port. Selle tulemusena saame nimekirja 58 730 IP-aadressist, kuid see ei t\u00e4henda veel, et neid v\u00f5iks kasutada DDoS-r\u00fcnnakuks. Peame t\u00e4itma teise n\u00f5ude, nimelt peavad nad olema avatud resolver'id.<\/p>\n
Selle jaoks v\u00f5ib kasutada lihtsat k\u00e4sku dig ja n\u00e4ha, et saame \"kaevata\" dig + short test.openresolver.com TXT @ip.of.dns.server. Kui server vastab open-resolver-detected, v\u00f5ib seda pidada potentsiaalseks r\u00fcnnakuobjektiks. Avatud resolverd on umbes 25%, mis on v\u00f5rreldav Austriaga. \u00dcldise arvu vaates on see umbes 0,02% k\u00f5igist Ukraina IP-dest.<\/p>\n
Mida veel on Ukrainas v\u00f5imalik leida?<\/h2>\n
\nMul on hea meel, et te k\u00fcsisite. Lihtsam (ja minu jaoks isiklikult k\u00f5ige huvitavam) on vaadata IP-sid, millel on avatud 80. port ja mida seal \"jookseb\".<\/p>\n
veebiserverid<\/h3>\n
\n260 849 Ukraina IP-d vastab 80 pordile (http). 125 444 aadressi vastas positiivselt (200 staatus) lihtsale GET-p\u00e4ringule, mida teie brauser saata v\u00f5ib. \u00dclej\u00e4\u00e4nud andsid erinevaid vigu. Huvitav on, et 853 serverit andis 500 staatuse, haruldased staatused olid 407 (p\u00e4ring proxy-autentimise jaoks) ja t\u00e4iesti ebatavaline 602 (IP ei ole \u201evalges nimekirjas\u201d) \u00fche vastusega.<\/p>\n
Apache valitseb t\u00e4ielikult \u2014 114 544 serverit kasutavad just teda. K\u00f5ige vanem versioon, mille ma Ukrainas leidnud olen, on 1.3.29, mis ilmus 29. oktoobril 2003 (!!!). nginx on teisel kohal 61 659 serveriga.<\/p>\n
11 serverit kasutab WinCE-d, mis ilmus 1996. aastal, ja millele pandi viimased plaastrid 2013. aastal (Austria puhul on neid ainult 4).<\/p>\n
Protokoll HTTP\/2 kasutab 5 144 serverit, HTTP\/1.1 \u2014 256 836, HTTP\/1 \u2014 13 491.<\/p>\n
Printerid\u2026 sest\u2026 miks mitte?<\/h3>\n
\n2 HP, 5 Epson ja 4 Canon, mis on v\u00f5rgus saadaval, m\u00f5ned neist ilma igasuguse autentimiseta.<\/p>\n
\"Skaneerisin
\n <\/p>\n
veebikaamerad<\/h3>\n
\nSee ei ole uudis, et Ukrainas on \u00c4\u00c4RMISELT palju veebikaameraid, mis edastavad iseennast internetti, kogutud erinevatesse ressurssidesse. V\u00e4hemalt 75 kaamerat edastavad ennast internetti ilma igasuguse kaitseta. Neid saab vaadata. siit<\/a><\/noindex>.<\/p>\n
\"Skaneerisin
\n <\/p>\n
Mis edasi?<\/h2>\n
\nUkraina on v\u00e4ike riik, nagu Austria, kuid tal on samad probleemid IT valdkonnas nagu suurte riikide puhul. Me peame v\u00e4lja t\u00f6\u00f6tama parema arusaama sellest, mis on turvaline ja mis ohtlik, ning seadme tootjad peavad pakkuma oma seadmetele turvalist algkonfiguratsiooni.<\/p>\n
Lisaks kogun koost\u00f6\u00f6partnereid (ole partneriks<\/a><\/noindex>), kes saavad aidata teil tagada oma IT-infrastruktuuri kaitset. J\u00e4rgmine samm on plaanis teha \u00fclevaade Ukraina veebisaitide turvalisusest. \u00c4rge l\u00fclitage kanalit v\u00e4lja!
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e \u0410\u0432\u0441\u0442\u0440\u0438\u044e\u00bb. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043c\u043d\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u044d\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u0443\u0436\u0435 \u0441 \u0423\u043a\u0440\u0430\u0438\u043d\u043e\u0439. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043a\u0440\u0443\u0433\u043b\u043e\u0441\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0435\u0449\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0444\u043e\u0440\u043c\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e, \u0430 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0441\u0435\u0434\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30310","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Skaneerisin Ukrainat | ProHoster","description":"Veebruaris avaldas austerlane Christian Haschek oma blogis huvitava artikli pealkirjaga \"Skaneerisin kogu Austriat\". Muidugi tekkis mul huvi, mis juhtub, kui korrata seda uuringut, kuid n\u00fc\u00fcd Ukrainaga. Mitme n\u00e4dala \u00f6\u00f6p\u00e4evaringne teabe kogumine, veel paar p\u00e4eva artikli vormistamiseks ning selle uurimise k\u00e4igus arutelud erinevate meie kogukonna esindajatega,","canonical_url":"https:\/\/prohoster.info\/et\/blog\/ya-proskaniroval-ukrainu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0423\u043a\u0440\u0430\u0438\u043d\u0443 | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e \u0410\u0432\u0441\u0442\u0440\u0438\u044e\u00bb. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043c\u043d\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u044d\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u0443\u0436\u0435 \u0441 \u0423\u043a\u0440\u0430\u0438\u043d\u043e\u0439. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043a\u0440\u0443\u0433\u043b\u043e\u0441\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0435\u0449\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0444\u043e\u0440\u043c\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e, \u0430 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0441\u0435\u0434\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430,","og:url":"https:\/\/prohoster.info\/et\/blog\/ya-proskaniroval-ukrainu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:48+00:00","article:modified_time":"2019-10-31T18:34:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30310","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/30310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=30310"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/30310\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=30310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=30310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=30310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}