{"id":30310,"date":"2019-10-31T21:34:48","date_gmt":"2019-10-31T18:34:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ya-proskaniroval-ukrainu\/"},"modified":"2019-10-31T21:34:48","modified_gmt":"2019-10-31T18:34:48","slug":"ya-proskaniroval-ukrainu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/no\/blog\/ya-proskaniroval-ukrainu","title":{"rendered":"Jeg skannet Ukraina","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I februar publiserte den \u00f8sterrikske Christian Haschek en interessant artikkel p\u00e5 bloggen sin med tittelen \u00abJeg skannet hele \u00d8sterrike\u00bb<\/a><\/noindex>. Selvf\u00f8lgelig ble jeg nysgjerrig p\u00e5 hva som ville skje om jeg gjentok denne forskningen, men med Ukraina. Flere ukers d\u00f8gnoverv\u00e5kning av informasjon, enda et par dager for \u00e5 skrive artikkelen, og i l\u00f8pet av denne forskningen samtaler med ulike medlemmer av samfunnet v\u00e5rt, for \u00e5 avklare og l\u00e6re mer. Jeg ber om at du leser videre\u2026
\n<\/a><\/noindex><\/p>\n

TL;DR<\/h2>\n

\nIngen spesielle midler ble brukt for \u00e5 samle informasjon (selv om flere personer anbefalte \u00e5 bruke OpenVAS for \u00e5 gj\u00f8re forskningen mer grundig og informativ). N\u00e5r det gjelder IP-sikkerheten som tilh\u00f8rer Ukraina (mer om hvordan dette ble bestemt nedenfor), synes jeg situasjonen er ganske d\u00e5rlig (og helt klart verre enn i \u00d8sterrike). Ingen fors\u00f8k p\u00e5 \u00e5 bruke de s\u00e5rbare serverne som ble oppdaget er gjort eller planlagt.<\/p>\n

F\u00f8rst og fremst: hvordan kan man f\u00e5 tak i alle IP-adresser som tilh\u00f8rer et bestemt land?<\/h2>\n

\nDet er faktisk veldig enkelt. IP-adresser genereres ikke av landet selv, men tildeles det. Derfor finnes det en liste (og den er offentlig) over alle land og alle IP-er som tilh\u00f8rer dem.<\/p>\n

Hvem som helst kan laste den ned<\/a><\/noindex>, og deretter filtrere det med grep Ukraine IP2LOCATION-LITE-DB1.CSV> ukraine.csv<\/p>\n

Et enkelt skript laget av Christian<\/a><\/noindex>lar deg konvertere listen til et mer brukbart format.<\/p>\n

Ukraina har nesten like mange IPv4-adresser som \u00d8sterrike, mer enn 11 millioner. N\u00f8yaktig 11 640 409 (til sammenligning i \u00d8sterrike \u2014 11 170 487).<\/p>\n

Hvis du ikke vil leke med IP-adresser selv (og det b\u00f8r du ikke!), kan du bruke tjenesten Shodan.io<\/a><\/noindex>.<\/p>\n

Finnes det ubeskyttede Windows-maskiner i Ukraina som har direkte tilgang til internett?<\/h2>\n

\nSelvf\u00f8lgelig vil ingen bevisste ukrainere \u00e5pne slik tilgang til sine datamaskiner. Eller vil de?<\/p>\n

masscan -p445 --rate 300 -iL ukraine.ips -oG ukraine.445.scan && cat ukraine.445.scan | wc -l<\/code><\/pre>\n
\n5669 Windows-maskiner med direkte tilgang til nettverket ble funnet (i \u00d8sterrike var det bare 1273, men det er ogs\u00e5 mye).<\/p>\n
Oops. Are there any that could be attacked using the ETHERNALBLUE exploits, known since 2017? There were none of these machines in Austria, and I hoped there wouldn't be any found in Ukraine either. Unfortunately, that's useless. A total of 198 IP addresses were discovered that haven't closed this 'hole' on their end.<\/p>\n
DNS, DDoS, and the depth of the rabbit hole<\/h2>\n
\nEnough about Windows. Let's see what we have with DNS servers that are open resolvers and can be used for DDoS attacks.<\/p>\n
It works something like this. The attacker sends a small DNS request, and the vulnerable server responds to the victim with a packet that is 100 times larger. Boom! Corporate networks can go down pretty quickly from such a data volume, and the bandwidth needed for the attack can be provided by a modern smartphone. And such attacks have been not uncommon<\/a><\/noindex> even on GitHub.<\/p>\n
Let's see if there are any such servers in Ukraine.<\/p>\n
masscan -pU 53 -iL ukraine.ips -oG ukraine.53.scan && cat ukraine.53.scan | wc -l<\/code><\/pre>\n
\nThe first step is to find those that have an open port 53. As a result, we have a list of 58,730 IP addresses, but that doesn't mean they can all be used for DDoS attacks. The second requirement is that they must be open resolvers.<\/p>\n
For this, you can use the simple command dig to see that we can \"dig\" dig + short test.openresolver.com TXT @ip.of.dns.server. If the server responded open-resolver-detected, it can be considered a potential target for attack. Open resolvers make up about 25%, comparable to Austria. In terms of total numbers, this is around 0.02% of all Ukrainian IPs.<\/p>\n
What else can be found in Ukraine?<\/h2>\n
\nI'm glad you asked. It's easier (and most interesting for me personally) to look for IPs with an open port 80 and see what's 'running' on them.<\/p>\n
web servers<\/h3>\n
\n260,849 Ukrainian IPs respond on port 80 (http). 125,444 addresses gave a positive response (200 status) to a simple GET request that your browser can send. The rest returned various errors. Interestingly, 853 servers returned a 500 status, while the rarest statuses were 407 (proxy authorization required) and the absolutely non-standard 602 (IP not in the 'whitelist') with one response each.<\/p>\n
Apache is absolutely dominant\u2014114,544 servers are using it. The oldest version I found in Ukraine is 1.3.29, released on October 29, 2003 (!!!). Nginx comes in second with 61,659 servers.<\/p>\n
11 servere bruker WinCE, som ble lansert i 1996, og ble sist oppdatert i 2013 (i \u00d8sterrike er det bare 4).<\/p>\n
Protokollen HTTP\/2 bruker 5 144 servere, HTTP\/1.1 \u2014 256 836, HTTP\/1 \u2014 13 491.<\/p>\n
Skrivere\u2026 fordi\u2026 hvorfor ikke?<\/h3>\n
\n2 HP, 5 Epson og 4 Canon som er tilgjengelige over nettverket, noen av dem uten autentisering.<\/p>\n
\"Jeg
\n <\/p>\n
webkameraer<\/h3>\n
\nDet er ikke noen overraskelse at det finnes VELDIG mange webkameraer i Ukraina som str\u00f8mmer til internett, samlet p\u00e5 forskjellige ressurser. Minst 75 kameraer str\u00f8mmer selv til internett uten noen som helst beskyttelse. Du kan se p\u00e5 dem her<\/a><\/noindex>.<\/p>\n
\"Jeg
\n <\/p>\n
Hva skjer videre?<\/h2>\n
\nUkraina er et lite land, akkurat som \u00d8sterrike, men har de samme problemene som store land innen IT. Vi m\u00e5 utvikle en bedre forst\u00e5else av hva som er trygt og hva som er farlig, og produsentene av utstyret m\u00e5 tilby en sikker standardkonfigurasjon for utstyret sitt.<\/p>\n
I tillegg samler jeg partnerbedrifter (bli partner<\/a><\/noindex>), som kan hjelpe deg med \u00e5 sikre din egen IT-infrastruktur. Jeg planlegger \u00e5 ta et sikkerhetsoversyn av ukrainske nettsteder som neste steg. F\u00f8lg med!
\n
Kilde: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e \u0410\u0432\u0441\u0442\u0440\u0438\u044e\u00bb. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043c\u043d\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u044d\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u0443\u0436\u0435 \u0441 \u0423\u043a\u0440\u0430\u0438\u043d\u043e\u0439. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043a\u0440\u0443\u0433\u043b\u043e\u0441\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0435\u0449\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0444\u043e\u0440\u043c\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e, \u0430 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0441\u0435\u0434\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30310","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Jeg skannet Ukraina | ProHoster","description":"I februar publiserte \u00f8sterrikeren Christian Haschek en interessant artikkel i bloggen sin med tittelen \u00abJeg skannet hele.","canonical_url":"https:\/\/prohoster.info\/no\/blog\/ya-proskaniroval-ukrainu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0423\u043a\u0440\u0430\u0438\u043d\u0443 | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e.","og:url":"https:\/\/prohoster.info\/no\/blog\/ya-proskaniroval-ukrainu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:48+00:00","article:modified_time":"2019-10-31T18:34:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30310","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/30310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=30310"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/30310\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=30310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=30310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=30310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}