{"id":55778,"date":"2020-01-28T00:00:00","date_gmt":"2020-01-27T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/kompaniya-po-zashhite-ot-ddos-sama-zapuskala-ddos-ataki-priznal-eyo-osnovatel"},"modified":"2020-02-18T14:03:55","modified_gmt":"2020-02-18T11:03:55","slug":"kompaniya-po-zashhite-ot-ddos-sama-zapuskala-ddos-ataki-priznal-eyo-osnovatel","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kompaniya-po-zashhite-ot-ddos-sama-zapuskala-ddos-ataki-priznal-eyo-osnovatel","title":{"rendered":"Compania de protec\u021bie DDoS a recunoscut c\u0103 a ini\u021biat atacuri DDoS, a declarat fondatorul ei","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Compania
\nP\u00e2n\u0103 \u00een 2016, vDos a devenit cel mai popular serviciu din lume pentru comanda atacurilor DDoS.<\/i><\/p>\n

Dac\u0103 credem teoriile conspira\u021biei, companiile antivirus r\u0103sp\u00e2ndesc singure viru\u0219i, iar serviciile de protec\u021bie DDoS ini\u021biaz\u0103 aceste atacuri. Desigur, acestea sunt inven\u021bii... sau nu?<\/p>\n

Pe 16 ianuarie 2020, Curtea Federal\u0103 din New Jersey a declarat vinovat<\/a><\/noindex> pe Tucker Preston, \u00een v\u00e2rst\u0103 de 22 de ani, locuitor al ora\u0219ului Macon, Georgia, pentru unul dintre capetele de acuzare, \u0219i anume \"deteriorarea calculatoarelor protejate prin transmiterea unui program, cod sau comand\u0103.\" Tucker este cofondator al companiei BackConnect Security LLC, care oferea protec\u021bie \u00eempotriva atacurilor DDoS. T\u00e2n\u0103rul antreprenor nu a reu\u0219it s\u0103 reziste tenta\u021biei de a se r\u0103zbuna pe clien\u021bii necooperan\u021bi.
\n<\/a><\/noindex>
\nPovestea trist\u0103 a lui Tucker Preston a \u00eenceput \u00een 2014, c\u00e2nd un hacker adolescent, \u00eempreun\u0103 cu prietenul s\u0103u Marshall Webb, a fondat compania BackConnect Security LLC, care ulterior s-a desprins \u00een BackConnect, Inc. \u00cen septembrie 2016, aceast\u0103 firm\u0103 a fost implicat\u0103<\/a><\/noindex> \u00een timpul opera\u021biunii de \u00eenchidere a serviciului vDos, care la acea vreme era considerat cel mai popular serviciu din lume pentru comanda atacurilor DDoS. Compania BackConnect a fost aparent supus\u0103 unei atac prin intermediul vDos - \u0219i a desf\u0103\u0219urat un \"contraatac\" neobi\u0219nuit, captur\u00e2nd 255 de adrese IP ale inamicului prin interceptarea BGP<\/a><\/noindex> (BGP hijacking). Realizarea unui astfel de atac pentru a-\u0219i proteja interesele a st\u00e2rnit p\u0103reri controversate \u00een comunitatea securit\u0103\u021bii informa\u021biilor. Mul\u021bi au considerat c\u0103 BackConnect a dep\u0103\u0219it limitele acceptabile.<\/p>\n

Interceptarea BGP simpl\u0103 se face prin anun\u021barea unui prefix str\u0103in ca fiind al s\u0103u. Uplink-urile\/peer-urile \u00eel accept\u0103 \u0219i acesta \u00eencepe s\u0103 se r\u0103sp\u00e2ndeasc\u0103 prin re\u021bea. De exemplu, \u00een 2017, din cauza unei defec\u021biuni a software-ului, \"Rostelecom\" (AS12389) a \u00eenceput s\u0103 anun\u021be prefixele<\/a><\/noindex> Mastercard (AS26380), Visa \u0219i alte organiza\u021bii financiare. Aproximativ la fel a ac\u021bionat compania BackConnect c\u00e2nd a expropriat adresele IP de la providerul de hosting bulgar Verdina.net.<\/p>\n

Directorul executiv al BackConnect, Bryant Townsend, ulterior s-a justificat<\/a><\/noindex> \u00een newsletterul NANOG pentru operatorii de re\u021bea. El a spus c\u0103 decizia de a ataca spa\u021biul de adresare al inamicului nu a fost u\u0219oar\u0103, dar sunt preg\u0103ti\u021bi s\u0103 \u00ee\u0219i asume responsabilitatea pentru ac\u021biunile lor: \u201eDe\u0219i am avut ocazia s\u0103 ne ascundem faptele, am sim\u021bit c\u0103 ar fi gre\u0219it. Am petrecut mult timp g\u00e2ndindu-m\u0103 la aceast\u0103 decizie \u0219i la modul \u00een care aceasta ar putea afecta negativ compania \u0219i pe mine \u00een ochii unor oameni, dar \u00een cele din urm\u0103 am sus\u021binut-o\u201d.<\/p>\n

Dup\u0103 cum s-a dovedit, BackConnect nu este la prima utilizare a intercept\u0103rii BGP, iar compania are o istorie \u00eentunecat\u0103. De\u0219i trebuie specificat c\u0103 interceptarea BGP nu este \u00eentotdeauna utilizat\u0103 \u00een scopuri r\u0103u inten\u021bionate. Brian Krebs scrie<\/a><\/noindex>, a declarat c\u0103 el \u00eensu\u0219i folose\u0219te serviciile companiei Prolexic Communications (acum parte a Akamai Technologies) pentru a se proteja de atacurile DDoS. Aceasta a fost cea care a inventat modul de utilizare a intercept\u0103rii BGP pentru a se proteja de atacurile DDoS.<\/p>\n

Dac\u0103 victima unui atac DDoS se adreseaz\u0103 Prolexic pentru ajutor, aceasta redirec\u021bioneaz\u0103 adresele IP ale clientului c\u0103tre sine, ceea ce \u00eei permite s\u0103 analizeze \u0219i s\u0103 filtreze traficul de intrare.<\/p>\n

Av\u00e2nd \u00een vedere c\u0103 BackConnect oferea servicii de protec\u021bie \u00eempotriva DDoS, a fost efectuat\u0103 o analiz\u0103 a intercept\u0103rilor BGP care pot fi considerate legitime \u00een interesul clien\u021bilor s\u0103i, \u0219i care par suspecte. Se iau \u00een considerare durata captur\u0103rii adreselor externe, c\u00e2t de mult a fost anun\u021bat prefixul str\u0103in ca fiind al s\u0103u, dac\u0103 exist\u0103 un acord confirmat cu clientul etc. Din tabel se observ\u0103 c\u0103 unele ac\u021biuni ale BackConnect par foarte suspecte.<\/p>\n

\"Compania<\/a><\/noindex><\/p>\n

Se pare c\u0103 cineva dintre cei afecta\u021bi a dat \u00een judecat\u0103 BackConnect. \u00cen declara\u021biile de recunoa\u0219tere ale lui Preston (pdf)<\/a><\/noindex> nu este specificat numele companiei pe care instan\u021ba l-a recunoscut ca victim\u0103. Victima este denumit\u0103 \u00een document Victim 1<\/i>.<\/p>\n

Dup\u0103 cum s-a men\u021bionat mai sus, investiga\u021bia activit\u0103\u021bii BackConnect a \u00eenceput dup\u0103 hackingul serviciului vDos. Atunci au fost dezv\u0103luite numele<\/a><\/noindex> administratorilor serviciului, precum \u0219i baza de date vDos, inclusiv utilizatorii s\u0103i \u00eenregistra\u021bi \u0219i \u00eenregistr\u0103rile clien\u021bilor care au pl\u0103tit vDos pentru a efectua atacuri DDoS.<\/p>\n

Aceste \u00eenregistr\u0103ri au ar\u0103tat c\u0103 unul dintre conturile de pe site-ul vDos era deschis pe adrese de e-mail asociate cu un domeniu care este \u00eenregistrat pe numele lui Tucker Preston. Acest cont a ini\u021biat atacuri asupra unui num\u0103r mare de \u021binte, incluz\u00e2nd numeroase atacuri asupra re\u021belelor de\u021binute de Funda Software-ului Liber<\/a><\/noindex> (FSF).<\/p>\n

\u00cen 2016, un fost administrator de sistem al FSF a declarat c\u0103 organiza\u021bia non-profit a luat \u00een considerare, la un moment dat, colaborarea cu BackConnect, iar atacurile au \u00eenceput aproape imediat dup\u0103 ce FSF a anun\u021bat c\u0103 va c\u0103uta o alt\u0103 firm\u0103 pentru protec\u021bia \u00eempotriva DDoS.<\/p>\n

Conform declara\u021biei<\/a><\/noindex> Ministerului Justi\u021biei din SUA, pentru aceast\u0103 acuza\u021bie, lui Takeru Preston i se impune o pedeaps\u0103 de p\u00e2n\u0103 la 10 ani de \u00eenchisoare \u0219i o amend\u0103 de p\u00e2n\u0103 la 250.000 USD, ceea ce este de dou\u0103 ori mai mult dec\u00e2t c\u00e2\u0219tigul sau pierderea total\u0103 din infrac\u021biune. Sentin\u021ba va fi anun\u021bat\u0103 pe 7 mai 2020.<\/p>\n

\nGlobalSign ofer\u0103 solu\u021bii PKI scalabile pentru organiza\u021bii de orice dimensiune. \"Compania<\/a><\/noindex>
\nDetalii: +7 (499) 678 2210, sales-ru@globalsign.com.
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a 2016 \u0433\u043e\u0434\u0443 vDos \u0441\u0442\u0430\u043b \u0441\u0430\u043c\u044b\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u0432 \u043c\u0438\u0440\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u043a\u0430\u0437\u0430 DDoS-\u0430\u0442\u0430\u043a \u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0442\u0435\u043e\u0440\u0438\u044f\u043c \u0437\u0430\u0433\u043e\u0432\u043e\u0440\u0430, \u0442\u043e \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u0430\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u0432\u0438\u0440\u0443\u0441\u044b, \u0430 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 DDoS-\u0430\u0442\u0430\u043a \u0441\u0430\u043c\u0438 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u0443\u044e\u0442 \u044d\u0442\u0438 \u0430\u0442\u0430\u043a\u0438. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u044d\u0442\u043e \u0432\u044b\u0434\u0443\u043c\u043a\u0438\u2026 \u0438\u043b\u0438 \u043d\u0435\u0442? 16 \u044f\u043d\u0432\u0430\u0440\u044f 2020 \u0433\u043e\u0434\u0430 \u0424\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u043a\u0440\u0443\u0436\u043d\u043e\u0439 \u0441\u0443\u0434 \u041d\u044c\u044e-\u0414\u0436\u0435\u0440\u0441\u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043b \u0432\u0438\u043d\u043e\u0432\u043d\u044b\u043c 22-\u043b\u0435\u0442\u043d\u0435\u0433\u043e \u0422\u0430\u043a\u0435\u0440\u0430 \u041f\u0440\u0435\u0441\u0442\u043e\u043d\u0430 (Tucker Preston), \u0436\u0438\u0442\u0435\u043b\u044f \u0433\u043e\u0440\u043e\u0434\u0430 \u041c\u0435\u0439\u043a\u043e\u043d\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55778","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Compania de protec\u021bie DDoS a ini\u021biat ea \u00eens\u0103\u0219i atacuri DDoS, a recunoscut fondatorul acesteia | ProHoster","description":"P\u00e2n\u0103 \u00een 2016, vDos.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kompaniya-po-zashhite-ot-ddos-sama-zapuskala-ddos-ataki-priznal-eyo-osnovatel","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u043e\u0442 DDoS \u0441\u0430\u043c\u0430 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0430 DDoS-\u0430\u0442\u0430\u043a\u0438, \u043f\u0440\u0438\u0437\u043d\u0430\u043b \u0435\u0451 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c | ProHoster","og:description":"\u041a 2016 \u0433\u043e\u0434\u0443 vDos.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kompaniya-po-zashhite-ot-ddos-sama-zapuskala-ddos-ataki-priznal-eyo-osnovatel","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-27T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55778","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:02:37","updated":"2022-09-28 16:22:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55778","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=55778"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55778\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=55778"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=55778"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=55778"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}