{"id":30310,"date":"2019-10-31T21:34:48","date_gmt":"2019-10-31T18:34:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ya-proskaniroval-ukrainu\/"},"modified":"2019-10-31T21:34:48","modified_gmt":"2019-10-31T18:34:48","slug":"ya-proskaniroval-ukrainu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/ya-proskaniroval-ukrainu","title":{"rendered":"Am scanat Ucraina","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen februarie, austriacul Christian Haschek a publicat pe blogul s\u0103u un articol interesant intitulat \u201eAm scanat \u00eentreaga Austria\u201d<\/a><\/noindex>. Fire\u0219te, am fost curios ce s-ar \u00eent\u00e2mpla dac\u0103 a\u0219 repeta aceast\u0103 cercetare, dar de data aceasta cu Ucraina. C\u00e2teva s\u0103pt\u0103m\u00e2ni de colectare a informa\u021biilor non-stop, \u00eenc\u0103 c\u00e2teva zile pentru a redacta articolul, \u0219i pe parcursul acestei cercet\u0103ri discu\u021bii cu diferi\u021bi reprezentan\u021bi ai societ\u0103\u021bii noastre pentru a clarifica sau a afla mai multe. V\u0103 invit s\u0103 citi\u021bi mai departe...
\n<\/a><\/noindex><\/p>\n

TL;DR<\/h2>\n

\nPentru colectarea informa\u021biilor nu s-a folosit nicio unealt\u0103 special\u0103 (de\u0219i c\u00e2\u021biva oameni au sugerat utilizarea aceluia\u0219i OpenVAS pentru a face cercetarea mai temeinic\u0103 \u0219i informativ\u0103). Situa\u021bia cu securitatea IP-urilor care apar\u021bin Ucrainei (mai jos despre cum am determinat aceasta) este, \u00een opinia mea, destul de proast\u0103 (\u0219i cu siguran\u021b\u0103 mai rea dec\u00e2t ceea ce se \u00eent\u00e2mpl\u0103 \u00een Austria). Nu s-au f\u0103cut \u0219i nu sunt planificate tentative de a exploata serverele vulnerabile descoperite.<\/p>\n

\u00cen primul r\u00e2nd: cum po\u021bi ob\u021bine toate adresele IP care apar\u021bin unei anumite \u021b\u0103ri?<\/h2>\n

\nEste, de fapt, foarte simplu. Adresele IP nu sunt generate de \u021bar\u0103, ci alocate acesteia. Prin urmare, exist\u0103 o list\u0103 (\u0219i este public\u0103) cu toate \u021b\u0103rile \u0219i cu toate IP-urile care le apar\u021bin.<\/p>\n

Oricine poate s\u0103 le descarce<\/a><\/noindex>, \u0219i apoi s\u0103 le filtreze grep Ukraine IP2LOCATION-LITE-DB1.CSV> ukraine.csv<\/p>\n

Un script simplu, creat de Christian<\/a><\/noindex>, permite transformarea listei \u00eentr-o form\u0103 mai utilizabil\u0103.<\/p>\n

Ucraina de\u021bine aproape la fel de multe adrese IPv4 ca \u0219i Austria, mai mult de 11 milioane. 11 640 409, ca s\u0103 fiu exact (spre compara\u021bie, \u00een Austria \u2014 11 170 487).<\/p>\n

Dac\u0103 nu dori\u021bi s\u0103 v\u0103 juca\u021bi cu adresele IP singuri (\u0219i nu ar trebui s\u0103 o face\u021bi!), pute\u021bi folosi serviciul Shodan.io<\/a><\/noindex>.<\/p>\n

Exist\u0103 ma\u0219ini Windows nep\u0103trate \u00een Ucraina, care au acces direct la internet?<\/h2>\n

\nDesigur, niciun ukrainean con\u0219tient nu va deschide un astfel de acces pentru computerele sale. Sau o va face?<\/p>\n

masscan -p445 --rate 300 -iL ukraine.ips -oG ukraine.445.scan && cat ukraine.445.scan | wc -l<\/code><\/pre>\n
\n5669 de ma\u0219ini Windows cu acces direct la re\u021bea au fost g\u0103site (\u00een Austria sunt doar 1273, dar \u0219i acestea sunt multe).<\/p>\n
Ups. Are there any among them that could be attacked using the ETHERNALBLUE exploits, which have been known since 2017? There were no such machines in Austria, and I hoped that none would be found in Ukraine either. Unfortunately, it's useless. 198 IP addresses have been found that didn't close this 'hole' at their end.<\/p>\n
DNS, DDoS \u0219i ad\u00e2ncimea iepura\u0219ului<\/h2>\n
\nS\u0103 vorbim mai pu\u021bin despre Windows. S\u0103 vedem ce avem cu serverele DNS, care sunt open-resolvers \u0219i pot fi utilizate pentru atacuri DDoS.<\/p>\n
Func\u021bioneaz\u0103 cam a\u0219a. Atacatorul trimite o cerere mic\u0103 DNS, iar serverul vulnerabil r\u0103spunde victimei cu un pachet care este de 100 de ori mai mare. Boom! Re\u021belele corporative pot c\u0103dea destul de repede sub un astfel de volum de date, \u0219i pentru atac este nevoie de l\u0103\u021bimea de band\u0103 pe care o poate oferi un smartphone modern. \u0218i astfel de atacuri au fost nu raritate<\/a><\/noindex> chiar pe GitHub.<\/p>\n
S\u0103 vedem dac\u0103 exist\u0103 astfel de servere \u00een Ucraina.<\/p>\n
masscan -pU 53 -iL ukraine.ips -oG ukraine.53.scan && cat ukraine.53.scan | wc -l<\/code><\/pre>\n
\nPrimul pas este s\u0103 g\u0103sim cele care au portul 53 deschis. Ca rezultat avem o list\u0103 de 58.730 de IP-uri, dar asta nu \u00eenseamn\u0103 c\u0103 toate pot fi folosite pentru atacuri DDoS. Trebuie s\u0103 mai \u00eendeplineasc\u0103 \u0219i cealalt\u0103 cerin\u021b\u0103, adic\u0103 s\u0103 fie open-resolver.<\/p>\n
Pentru aceasta, se poate folosi comanda simpl\u0103 dig \u0219i putem vedea c\u0103 putem \"s\u0103 s\u0103p\u0103m\" dig + short test.openresolver.com TXT @ip.of.dns.server. Dac\u0103 serverul a r\u0103spuns open-resolver-detected, atunci poate fi considerat un poten\u021bial obiect de atac. Open resolver-urile reprezint\u0103 aproximativ 25%, ceea ce este comparabil cu Austria. Din punct de vedere al num\u0103rului total, aceasta reprezint\u0103 aproximativ 0,02% din toate IP-urile ucrainene.<\/p>\n
Ce altceva mai putem g\u0103si \u00een Ucraina?<\/h2>\n
\nM\u0103 bucur c\u0103 ai \u00eentrebat. Cel mai simplu (\u0219i cel mai interesant pentru mine personal) este s\u0103 ne uit\u0103m la IP-urile cu portul 80 deschis \u0219i ce ruleaz\u0103 pe ele.<\/p>\n
servere web<\/h3>\n
\n260.849 de IP-uri ucrainene r\u0103spund la portul 80 (http). 125.444 de adrese au r\u0103spuns pozitiv (status 200) la o cerere GET simpl\u0103, care ar putea fi trimis\u0103 de browserul t\u0103u. Celelalte au dat diverse erori. Interesant este c\u0103 853 de servere au dat status 500, iar cele mai rare statuse au fost 407 (cerere de autorizare proxy) \u0219i complet neobi\u0219nuitul 602 (IP nu \u00een 'lista alb\u0103') cu fiecare c\u00e2te o r\u0103spuns.<\/p>\n
Apache domin\u0103 absolut \u2014 114.544 de servere \u00eel folosesc. Cea mai veche versiune pe care am g\u0103sit-o \u00een Ucraina este 1.3.29, care a fost lansat\u0103 pe 29 octombrie 2003 (!!!). nginx se afl\u0103 pe locul doi cu 61.659 de servere.<\/p>\n
11 servere utilizeaz\u0103 WinCE, care a fost lansat\u0103 \u00een 1996 \u0219i a fost actualizat\u0103 pentru ultima dat\u0103 \u00een 2013 (\u00een Austria sunt doar 4).<\/p>\n
Protocul HTTP\/2 utilizeaz\u0103 5.144 de servere, HTTP\/1.1 \u2014 256.836, HTTP\/1 \u2014 13.491.<\/p>\n
Imprimante\u2026 pentru c\u0103\u2026 de ce nu?<\/h3>\n
\n2 HP, 5 Epson \u0219i 4 Canon, care sunt accesibile din re\u021bea, unele dintre ele f\u0103r\u0103 nicio autoriza\u021bie.<\/p>\n
\"Am
\n <\/p>\n
camere web<\/h3>\n
\nNu este o noutate c\u0103 \u00een Ucraina exist\u0103 EXTREM DE multe camere web care se transmit pe internet, adunate pe diferite resurse. Cel pu\u021bin 75 de camere se transmit pe internet f\u0103r\u0103 nicio protec\u021bie. Le pute\u021bi viziona aici<\/a><\/noindex>.<\/p>\n
\"Am
\n <\/p>\n
Ce urmeaz\u0103?<\/h2>\n
\nUcraina este o \u021bar\u0103 mic\u0103, la fel ca Austria, dar are acelea\u0219i probleme ca \u021b\u0103rile mari \u00een domeniul IT. Trebuie s\u0103 dezvolt\u0103m o \u00een\u021belegere mai bun\u0103 a ceea ce este sigur \u0219i ceea ce este periculos, iar produc\u0103torii de echipamente trebuie s\u0103 ofere o configura\u021bie ini\u021bial\u0103 sigur\u0103 a echipamentelor lor.<\/p>\n
\u00cen plus, adun parteneri (devino partener<\/a><\/noindex>) care te pot ajuta s\u0103 asiguri integritatea infrastructurii tale IT. Pasul urm\u0103tor pe care \u00eel planific este s\u0103 fac o revizuire a securit\u0103\u021bii site-urilor ucrainene. Nu schimba\u021bi canalul!
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e \u0410\u0432\u0441\u0442\u0440\u0438\u044e\u00bb. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043c\u043d\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u044d\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u0443\u0436\u0435 \u0441 \u0423\u043a\u0440\u0430\u0438\u043d\u043e\u0439. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043a\u0440\u0443\u0433\u043b\u043e\u0441\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0435\u0449\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0444\u043e\u0440\u043c\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e, \u0430 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0441\u0435\u0434\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30310","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Am scansionat Ucraina | ProHoster","description":"\u00cen februarie, austriacul Christian Haschek a publicat pe blogul s\u0103u un articol interesant intitulat \u201eAm scansionat \u00eentreaga.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/ya-proskaniroval-ukrainu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0423\u043a\u0440\u0430\u0438\u043d\u0443 | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/ya-proskaniroval-ukrainu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:48+00:00","article:modified_time":"2019-10-31T18:34:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30310","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/30310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=30310"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/30310\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=30310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=30310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=30310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}