{"id":30167,"date":"2019-10-31T21:33:58","date_gmt":"2019-10-31T18:33:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform\/"},"modified":"2019-10-31T21:33:58","modified_gmt":"2019-10-31T18:33:58","slug":"razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","title":{"rendered":"An\u00e1lise de erro cr\u00edtico no algoritmo de funcionamento da criptografia KIB SEARCHINFORM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O controle de todas as informa\u00e7\u00f5es que circulam na organiza\u00e7\u00e3o \u00e9 uma das principais tarefas na implementa\u00e7\u00e3o pr\u00e1tica dos documentos organizacionais e regulamentares (pol\u00edtica de seguran\u00e7a da informa\u00e7\u00e3o e outros documentos internos de n\u00edvel inferior) da organiza\u00e7\u00e3o.
\nOs sistemas de preven\u00e7\u00e3o de vazamentos de informa\u00e7\u00f5es confidenciais do sistema de informa\u00e7\u00e3o (Data Leak Prevention, DLP) s\u00e3o, em sua maioria, capazes de resolver esse problema.
\n<\/a><\/noindex>
\nNo mercado atual, existe uma variedade suficiente desses sistemas, como: SearchInform DLP, Infowatch Traffic Monitor DLP, Zecurion DLP, Symantec DLP e outros. Mas hoje este artigo ser\u00e1 sobre o produto da empresa LLC '\u0421\u0451\u0440\u0447\u0418\u043d\u0444\u043e\u0440\u043c'.<\/p>\n

O contorno de seguran\u00e7a da informa\u00e7\u00e3o SearchInform (\u041a\u0418\u0411 \u0421\u0451\u0440\u0447\u0438\u043d\u0444\u043e\u0440\u043c) \u00e9 um complexo de software s\u00e9rio e flex\u00edvel, que, por sua funcionalidade e vasta gama de ferramentas anal\u00edticas, cria uma concorr\u00eancia significativa para outras empresas neste setor. No entanto, como ocorre com todos os produtos, o \u041a\u0418\u0411 \u0421\u0451\u0440\u0447\u0438\u043d\u0444\u043e\u0440\u043c possui uma das desvantagens, que ser\u00e1 discutida agora.<\/p>\n

\"An\u00e1lise
\n
\nFigura 1 - Logotipo do \u041a\u0418\u0411 \u0421\u0451\u0440\u0447\u0438\u043d\u0444\u043e\u0440\u043c<\/i><\/p>\n

No \u041a\u0418\u0411 \u0421\u0451\u0440\u0447\u0438\u043d\u0444\u043e\u0440\u043c, uma das fontes de coleta de informa\u00e7\u00f5es \u00e9 o agente (Windows\/Linux). O agente para o sistema operacional Windows, assim como para o Linux, possui um sistema modular de coleta de informa\u00e7\u00f5es, que pode ser ativado ou desativado conforme necess\u00e1rio. Vamos considerar o m\u00f3dulo Device (controle de dispositivos externos, dispositivos de rede, processos, etc.). A vers\u00e3o demo deste produto pode ser obtida oficialmente pelo site do desenvolvedor (com toda a funcionalidade). As a\u00e7\u00f5es subsequentes ser\u00e3o realizadas com a chave de licen\u00e7a recebida - vers\u00e3o do programa EndPointController 5.51.0.9 (vers\u00e3o do agente 5.51.0.9).<\/p>\n

O principal problema neste m\u00f3dulo \u00e9 o algoritmo de criptografia das informa\u00e7\u00f5es em dispositivos remov\u00edveis externos. Vamos considerar o princ\u00edpio de funcionamento do algoritmo de criptografia no \u041a\u0418\u0411 \u0421\u0451\u0440\u0447\u0438\u043d\u0444\u043e\u0440\u043c.<\/p>\n

Instalamos o agente na esta\u00e7\u00e3o de trabalho e configuramos para o controle de dispositivos externos (m\u00f3dulo Device) na se\u00e7\u00e3o 'Ambiente de Rede' do EndPointController 5.51.0.9.<\/p>\n

\"An\u00e1lise
\nFigura 2 - Instala\u00e7\u00e3o e ativa\u00e7\u00e3o do m\u00f3dulo<\/i><\/p>\n

Configuramos a criptografia nas defini\u00e7\u00f5es do m\u00f3dulo Device na aba 'Criptografia': geramos a chave e ativamos a criptografia para todos os suportes (\u00e9 poss\u00edvel ativar a criptografia apenas para determinados suportes de informa\u00e7\u00e3o).<\/p>\n

\"An\u00e1lise
\nFigura 3 - Configura\u00e7\u00e3o da lista branca<\/i><\/p>\n

\"An\u00e1lise
\nFigura 4 \u2013 Configura\u00e7\u00e3o de criptografia<\/i><\/p>\n

Agora vamos analisar o algoritmo de criptografia de arquivos deste produto. Vamos copiar os arquivos \"Install.exe\" e \"Fundamentos do Direito.rtf\" da esta\u00e7\u00e3o de trabalho controlada \"WINOC\" para um dispositivo de armazenamento remov\u00edvel \"Disco Remov\u00edvel (E:)\". Como pode ser visto na figura 5, na pasta oculta \"System Volume Information\" foram criados os objetos \"Install.exe\" e \"Fundamentos do Direito.rtf\". Assim, podemos concluir que a pasta \"System Volume Information\" cont\u00e9m uma lista de objetos criptografados no dispositivo de armazenamento.<\/p>\n

\"An\u00e1lise
\nFigura 5 \u2013 pasta \"System Volume Information\"<\/i><\/p>\n

\"An\u00e1lise
\nFigura 6 \u2013 Pasta raiz do dispositivo de armazenamento<\/i><\/p>\n

Como \u00e9 sabido, existem tr\u00eas aspectos nos quais se baseia a seguran\u00e7a da informa\u00e7\u00e3o \u2013 integridade, disponibilidade e confidencialidade. Esses aspectos s\u00e3o comprometidos com o uso deste m\u00e9todo de criptografia, pois a informa\u00e7\u00e3o sist\u00eamica sobre se um objeto est\u00e1 criptografado ou n\u00e3o deve estar no pr\u00f3prio cabe\u00e7alho do objeto. <\/p>\n

Com a atual constru\u00e7\u00e3o do algoritmo, existem possibilidades de modifica\u00e7\u00e3o\/remover objetos da pasta \"System Volume Information\" no dispositivo de armazenamento, levando \u00e0 perda dos objetos criptografados originais, assim como a modifica\u00e7\u00e3o dos pr\u00f3prios objetos em esta\u00e7\u00f5es n\u00e3o controladas (por exemplo: renomea\u00e7\u00e3o do objeto \"Install.exe\" com o caminho de rede \"E:Install.exe\" em um computador sem agente, enquanto o arquivo informativo do produto KIB Searchinform na pasta \"System Volume Information\" \"Install.exe\" com o caminho de rede \"E:System Volume InformationInstall.exe\" permanece inalterado, j\u00e1 que n\u00e3o h\u00e1 um agente que altere as informa\u00e7\u00f5es auxiliares, e a abertura deste arquivo torna-se imposs\u00edvel).<\/p>\n

Vamos esperar que o desenvolvedor leve em considera\u00e7\u00e3o essa defici\u00eancia no funcionamento da fun\u00e7\u00e3o de criptografia de dispositivos de armazenamento no produto KIB Searchinform e altere seu algoritmo.
\n
Fonte: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0432\u0441\u0435\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 \u043f\u0440\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u043e-\u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u043d\u0438\u0436\u043d\u0438\u0445 \u0443\u0440\u043e\u0432\u043d\u0435\u0439) \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0421\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u0437 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (Data Leak Prevention, DLP) \u0432 \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u041d\u0430 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u0440\u044b\u043d\u043a\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0435\u0439 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a: […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30167","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47An\u00e1lise de erro cr\u00edtico no algoritmo de funcionamento da criptografia KIB SEARCHINFORM | ProHoster","description":"O controle de todas as informa\u00e7\u00f5es que circulam na organiza\u00e7\u00e3o \u00e9 uma das principais tarefas na implementa\u00e7\u00e3o pr\u00e1tica de documentos organizacionais de gest\u00e3o (pol\u00edtica de seguran\u00e7a da informa\u00e7\u00e3o e outros internos).","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u043e\u0440 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u041a\u0418\u0411 SEARCHINFORM | ProHoster","og:description":"\u041a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0432\u0441\u0435\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 \u043f\u0440\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u043e-\u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435.","og:url":"https:\/\/prohoster.info\/pt\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:33:58+00:00","article:modified_time":"2019-10-31T18:33:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30167","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 23:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:40:41","updated":"2026-01-20 23:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/30167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=30167"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/30167\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=30167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=30167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=30167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}