{"id":85141,"date":"2020-06-13T13:42:24","date_gmt":"2020-06-13T11:42:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki"},"modified":"2020-06-13T13:42:24","modified_gmt":"2020-06-13T11:42:24","slug":"chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","title":{"rendered":"Ce s\u0103 faci dac\u0103 la providerul t\u0103u de hosting au venit siloviki","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506334\/\"><img decoding=\"async\" alt=\"Ce s\u0103 faci dac\u0103 la providerul t\u0103u de hosting au venit siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/867a0b09b6e2b2676e520a16cee0148d.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><i>kdpv \u2014 Reuters<\/i><\/p>\n<p>Dac\u0103 a\u021bi \u00eenchiriat un server, atunci nu ave\u021bi control deplin asupra acestuia. Aceasta \u00eenseamn\u0103 c\u0103 \u00een orice moment, c\u0103tre providerul de g\u0103zduire pot veni persoane special preg\u0103tite \u0219i pot cere s\u0103 le furniza\u021bi orice date ale dumneavoastr\u0103. Iar gazda le va oferi, dac\u0103 cererea este formulat\u0103 legal. <\/p>\n<p>Nu dori\u021bi deloc ca jurnalele serverului dumneavoastr\u0103 web sau datele utilizatorilor s\u0103 ajung\u0103 la altcineva. Nu se poate construi o protec\u021bie ideal\u0103. Este aproape imposibil s\u0103 te protejezi de gazda care de\u021bine hipervizorul \u0219i \u00ee\u021bi ofer\u0103 o ma\u0219in\u0103 virtual\u0103. Dar, poate, este posibil s\u0103 reduci pu\u021bin riscurile. Criptarea ma\u0219inilor \u00eenchiriate nu este at\u00e2t de inutil\u0103 pe c\u00e2t pare la prima vedere. De asemenea, s\u0103 ne uit\u0103m la amenin\u021b\u0103rile de extragere a datelor din servere fizice.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Modelul amenin\u021b\u0103rilor<\/h2>\n<p>\n\u00cen general, gazda va \u00eencerca s\u0103 protejeze c\u00e2t mai mult interesele clientului, at\u00e2t c\u00e2t permite legea. Dac\u0103 \u00eentr-o scrisoare de la autorit\u0103\u021bile oficiale au cerut doar jurnalele de acces, gazda nu va oferi copiile tuturor ma\u0219inilor virtuale cu bazele de date. Nu ar trebui, cel pu\u021bin. Dac\u0103 vor solicita toate datele, atunci gazda va copia discurile virtuale cu toate fi\u0219ierele \u0219i nu ve\u021bi \u0219ti despre acest lucru.<\/p>\n<p>Indiferent de scenariul evenimentelor, sarcina dumneavoastr\u0103 principal\u0103 este s\u0103 face\u021bi atacul prea complicat \u0219i scump. De obicei, exist\u0103 trei principale variante de amenin\u021bare.<\/p>\n<h2>Oficial<\/h2>\n<p>\nCel mai des, la biroul oficial al gazdei se trimite o scrisoare pe suport de h\u00e2rtie cu cererea de a furniza datele necesare conform ordinului respectiv. Dac\u0103 totul este redactat corect, gazda ofer\u0103 jurnalele de acces necesare \u0219i alte date autorit\u0103\u021bilor oficiale. De obicei, se cere doar trimiterea datelor necesare.<\/p>\n<p>Ocazional, dac\u0103 este absolut necesar, reprezentan\u021bii autorit\u0103\u021bilor de aplicare a legii vin personal la datacenter. De exemplu, c\u00e2nd ave\u021bi propriul server dedicat \u0219i datele de acolo pot fi ob\u021binute doar fizic.<\/p>\n<p>\u00cen toate \u021b\u0103rile, pentru a ob\u021bine acces pe un teren privat, pentru a efectua o perchezi\u021bie \u0219i pentru alte activit\u0103\u021bi, este necesar\u0103 dovada c\u0103 datele pot con\u021bine informa\u021bii importante pentru investigarea unei infrac\u021biuni. De asemenea, este necesar un mandat de perchezi\u021bie \u00eentocmit conform tuturor reglement\u0103rilor. Aici pot exista nuan\u021be legate de particularit\u0103\u021bile legisla\u021biei locale. Cel mai important lucru de \u00een\u021beles este c\u0103, \u00een cazul unui parcurs oficial corect, reprezentan\u021bii centrului de date nu vor l\u0103sa pe nimeni mai departe de punctul de control.<\/p>\n<p>Mai mult, \u00een majoritatea \u021b\u0103rilor nu po\u021bi pur \u0219i simplu s\u0103 iei echipamente func\u021bionale. De exemplu, \u00een Rusia, p\u00e2n\u0103 la sf\u00e2r\u0219itul anului 2018, conform articolului 183 din Codul de Procedur\u0103 Penal\u0103 al Federa\u021biei Ruse, partea 3.1, era garantat c\u0103, \u00een cadrul unei perchezi\u021bii, confiscarea suporturilor electronice de informa\u021bii se efectueaz\u0103 cu participarea unui specialist. La cererea proprietarului legal al suporturilor electronice de informa\u021bii sau a posesorului informa\u021biilor con\u021binute pe acestea, specialistul particip\u00e2nd la perchezi\u021bie, \u00een prezen\u021ba martorilor, se realizeaz\u0103 copierea informa\u021biilor de pe suporturile electronice de informa\u021bii.<\/p>\n<p>Din p\u0103cate, ulterior acest punct a fost eliminat din articol.<\/p>\n<h2>Secret \u0219i neoficial<\/h2>\n<p>\nAceasta este deja domeniul de activitate al colegilor specializa\u021bi din NSA, FBI, MI5 \u0219i alte organiza\u021bii cu acronime. Cel mai adesea, legisla\u021bia \u021b\u0103rilor prevede puteri extrem de extinse pentru astfel de structuri. Mai mult, aproape \u00eentotdeauna exist\u0103 o interdic\u021bie legal\u0103 asupra oric\u0103rei divulg\u0103ri directe sau indirecte a faptului colabor\u0103rii cu astfel de agen\u021bii de for\u021b\u0103. \u00cen Rusia exist\u0103 norme legale similare. <noindex><a rel=\"nofollow\" href=\"http:\/\/publication.pravo.gov.ru\/Document\/View\/0001201801220009?index=3&amp;rangeSize=1\">norme legale<\/a><\/noindex>.<\/p>\n<p>\u00cen cazul unei astfel de amenin\u021b\u0103ri pentru datele tale, acestea aproape c\u0103 vor fi extrase cu siguran\u021b\u0103. \u00cen plus fa\u021b\u0103 de simpla confiscare, se pot folosi toate arsenalul neoficial de backdoor-uri, vulnerabilit\u0103\u021bile de tip zero-day, extragerea datelor din memoria operativ\u0103 a ma\u0219inii tale virtuale \u0219i alte surprize pl\u0103cute. Providerul de hosting va fi obligat s\u0103 ajute \u00een mod maxim speciali\u0219tii agen\u021biilor de aplicare a legii.<\/p>\n<h2>Angajat necorespunz\u0103tor<\/h2>\n<p>\nNu toate persoanele sunt la fel de bine inten\u021bionate. Unii dintre administratorii de datacentere ar putea alege s\u0103 c\u00e2\u0219tige un venit suplimentar v\u00e2nz\u00e2nd datele dumneavoastr\u0103. Ulterior, desf\u0103\u0219urarea evenimentelor depinde de autoritatea \u0219i acces\u0103rile sale. Cel mai nepl\u0103cut lucru este c\u0103 un administrator cu acces la consola de virtualizare are control complet asupra ma\u0219inilor dumneavoastr\u0103. Oric\u00e2nd poate crea un snapshot \u00eempreun\u0103 cu tot con\u021binutul memoriei RAM \u0219i poate studia ulterior \u00een detaliu.<\/p>\n<h2>VDS<\/h2>\n<p>\nA\u0219adar, ave\u021bi o ma\u0219in\u0103 virtual\u0103 pe care v-a furnizat-o providerul de hosting. Cum pute\u021bi organiza criptarea pentru a v\u0103 proteja? De fapt, aproape c\u0103 nu exist\u0103 metode. Mai mult, chiar \u0219i un server dedicat str\u0103in poate fi, \u00een final, o ma\u0219in\u0103 virtual\u0103, \u00een care sunt integrate dispozitivele necesare.<\/p>\n<p>Dac\u0103 scopul sistemului de la distan\u021b\u0103 nu este doar stocarea datelor, ci \u0219i realizarea unor calcule, atunci singura op\u021biune pentru a lucra cu o ma\u0219in\u0103 de \u00eencredere va fi implementarea <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%9F%D0%BE%D0%BB%D0%BD%D0%BE%D1%81%D1%82%D1%8C%D1%8E_%D0%B3%D0%BE%D0%BC%D0%BE%D0%BC%D0%BE%D1%80%D1%84%D0%BD%D0%BE%D0%B5_%D1%88%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5\">cript\u0103rii ghomomorfe<\/a><\/noindex>. \u00cen acest timp, sistemul va efectua calcule f\u0103r\u0103 a avea capacitatea de a \u00een\u021belege ce anume realizeaz\u0103. Din p\u0103cate, costurile de implementare a unei astfel de cript\u0103ri sunt at\u00e2t de mari \u00eenc\u00e2t aplicarea practic\u0103 a acesteia este, \u00een prezent, limitat\u0103 la sarcini foarte restr\u00e2nse.<\/p>\n<p>Plus, \u00een momentul \u00een care ma\u0219ina virtual\u0103 este pornit\u0103 \u0219i realizeaz\u0103 diverse ac\u021biuni, toate volumele criptate se afl\u0103 \u00eentr-o stare accesibil\u0103; altfel, sistemul de operare pur \u0219i simplu nu va putea lucra cu ele. Asta \u00eenseamn\u0103 c\u0103, av\u00e2nd acces la consola de virtualizare, pute\u021bi oric\u00e2nd crea un snapshot al ma\u0219inii \u00een func\u021biune \u0219i extrage toate cheile din memoria RAM.<\/p>\n<p>Mul\u021bi furnizori au \u00eencercat s\u0103 organizeze criptarea hardware a memoriei RAM pentru a se asigura c\u0103 nici m\u0103car providerul de hosting nu are acces la aceste date. De exemplu, tehnologia Intel Software Guard Extensions, care creeaz\u0103 zone \u00een spa\u021biul de adrese virtuale, protejate de citire \u0219i scriere din exterior de c\u0103tre alte procese, inclusiv kernelul sistemului de operare. Din p\u0103cate, nu ve\u021bi putea ave\u021bi \u00eencredere deplin\u0103 \u00een aceste tehnologii, deoarece ve\u021bi fi limitat la ma\u0219ina dumneavoastr\u0103 virtual\u0103. \u00cen plus, exist\u0103 deja exemple concrete <noindex><a rel=\"nofollow\" href=\"https:\/\/www.theregister.co.uk\/2017\/03\/07\/eggheads_slip_a_note_under_intels_door_sgx_can_leak_crypto_keys\/\">de atacuri reu\u0219ite<\/a><\/noindex> \u00eempotriva acestei tehnologii. Cu toate acestea, criptarea ma\u0219inilor virtuale nu este la fel de lipsit\u0103 de sens cum ar putea p\u0103rea.<\/p>\n<h2>Cript\u0103m datele pe VDS<\/h2>\n<p>\nA\u0219 vrea s\u0103 precizez c\u0103 tot ce facem mai jos nu ofer\u0103 o protec\u021bie complet\u0103. Hypervizorul va permite s\u0103 facem copiile necesare f\u0103r\u0103 a opri serviciul \u0219i f\u0103r\u0103 ca dumneavoastr\u0103 s\u0103 observa\u021bi.<\/p>\n<ul>\n<li>Dac\u0103, la cerere, gazda va trimite o imagine \"rece\" a ma\u0219inii dumneavoastr\u0103 virtuale, sunte\u021bi \u00eentr-o siguran\u021b\u0103 relativ\u0103. Acesta este cel mai frecvent scenariu.<\/li>\n<li>Dac\u0103 gazda va oferi un snapshot complet al unei ma\u0219ini func\u021bion\u00e2nd, atunci situa\u021bia nu este prea bun\u0103. Toate datele vor fi montate \u00een sistem \u00een mod deschis. \u00cen plus, va exista posibilitatea de a explora RAM-ul \u00een c\u0103utarea cheilor private \u0219i a altor astfel de date.<\/li>\n<\/ul>\n<p>\n\u00cen mod implicit, dac\u0103 a\u021bi desf\u0103\u0219urat un sistem de operare dintr-o imagine vanil\u0103, gazda nu are acces root. Poate fi \u00eentotdeauna montat un suport cu o imagine de salvare \u0219i schimbat parola pentru root, realiz\u00e2nd un chroot \u00een mediu virtual. Dar aceasta va necesita repornirea, ceea ce va fi observat. \u00cen plus, toate parti\u021biile criptate montate vor fi \u00eenchise.<\/p>\n<p>Cu toate acestea, dac\u0103 desf\u0103\u0219urarea ma\u0219inii virtuale nu este dintr-o imagine vanil\u0103, ci dintr-una preg\u0103tit\u0103 anterior, gazda poate adesea s\u0103 adauge un cont cu privilegii pentru a ajuta \u00een situa\u021bii de urgen\u021b\u0103 ale clientului. De exemplu, pentru a schimba o parol\u0103 uitat\u0103 pentru root.<\/p>\n<p>Chiar \u0219i \u00een cazul unui snapshot complet, nu este totul at\u00e2t de sumbru. Atacatorul nu va primi fi\u0219ierele criptate dac\u0103 le-a\u021bi montat dintr-un sistem de fi\u0219iere la distan\u021b\u0103 al unei alte ma\u0219ini. Da, \u00een teorie, se poate s\u0103 se scotoceasc\u0103 \u00een dump-ul de memorie \u0219i s\u0103 extrag\u0103 cheile de criptare de acolo. Dar \u00een practic\u0103, aceasta este foarte complicat \u0219i este foarte pu\u021bin probabil ca procesul s\u0103 avanseze dincolo de simple transferuri de fi\u0219iere.<\/p>\n<h2>Comand\u0103m o ma\u0219in\u0103<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Ce s\u0103 faci dac\u0103 la providerul t\u0103u de hosting au venit siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/3a4c244720963e8da57e782aa53e2db0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPentru scopurile noastre de testare, lu\u0103m o ma\u0219in\u0103 simpl\u0103 \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/ruvds.com\/ru-rub#order\">sec\u021biunea de comand\u0103 a serverelor<\/a><\/noindex>. Nu avem nevoie de multe resurse, a\u0219a c\u0103 vom alege op\u021biunea cu plat\u0103 pentru megaher\u021bii efectiv utiliza\u021bi \u0219i trafic. Va fi suficient pentru a ne juca.<\/p>\n<p>Classic dm-crypt pentru \u00eentreaga parti\u021bie nu a func\u021bionat. Disk-ul este livrat implicit \u00eentr-o singur\u0103 parte, cu root pe \u00eentreaga parti\u021bie. Reducerea unei parti\u021bii ext4 pe root-ul montat este practic garantat\u0103 a deveni un brick \u00een loc de sistem de fi\u0219iere. Am \u00eencercat) Buba nu a ajutat.<\/p>\n<h2>Cre\u0103m un container criptat<\/h2>\n<p>\nA\u0219adar, nu vom cripta \u00eentreaga sec\u021biune, ci vom folosi containere criptate de fi\u0219iere, \u0219i anume VeraCrypt, care a trecut auditul \u0219i este de \u00eencredere. Acest lucru este suficient pentru scopurile noastre. Mai \u00eent\u00e2i, desc\u0103rc\u0103m \u0219i instal\u0103m pachetul CLI de pe site-ul oficial. Pute\u021bi verifica \u0219i semn\u0103tura.<\/p>\n<pre><code class=\"bash\">wget https:\/\/launchpad.net\/veracrypt\/trunk\/1.24-update4\/+download\/veracrypt-console-1.24-Update4-Ubuntu-18.04-amd64.deb\ndpkg -i veracrypt-console-1.24-Update4-Ubuntu-18.04-amd64.deb\n<\/code><\/pre>\n<p>\nAcum vom crea containerul \u00een directorul nostru home, pentru a-l monta manual la repornire. \u00cen varianta interactiv\u0103, specifica\u021bi dimensiunea containerului, parola \u0219i algoritmii de criptare. Pute\u021bi alege algoritmul patriotic Kuznechik \u0219i func\u021bia hash Streebog.<\/p>\n<pre><code class=\"bash\">veracrypt -t -c ~\/my_super_secret<\/code><\/pre>\n<p>\nAcum s\u0103 instal\u0103m nginx, s\u0103 mont\u0103m containerul \u0219i s\u0103 \u00eenc\u0103rc\u0103m \u00een el informa\u021biile secrete.<\/p>\n<pre><code class=\"bash\">mkdir \/var\/www\/html\/images\nveracrypt ~\/my_super_secret \/var\/www\/html\/images\/\nwget https:\/\/upload.wikimedia.org\/wikipedia\/ru\/2\/24\/Lenna.png<\/code><\/pre>\n<p>\nS\u0103 ajust\u0103m \/var\/www\/html\/index.nginx-debian.html pentru a ob\u021bine pagina dorit\u0103 \u0219i putem verifica.<\/p>\n<h2>Ne conect\u0103m \u0219i verific\u0103m<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Ce s\u0103 faci dac\u0103 la providerul t\u0103u de hosting au venit siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/1b1567cfd45db0d6f8421e89c0617a3a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Containerul este montat, datele sunt disponibile \u0219i sunt livrate.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Ce s\u0103 faci dac\u0103 la providerul t\u0103u de hosting au venit siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/216440e8f586886a6ce79dc2b8d76fb0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Iat\u0103 ma\u0219ina dup\u0103 repornire. Datele sunt \u00een siguran\u021b\u0103 \u00een ~\/my_super_secret.<\/i><\/p>\n<p>Dac\u0103 este foarte necesar \u0219i dori\u021bi ceva avansat, pute\u021bi criptat \u00eentreaga OS, astfel \u00eenc\u00e2t la repornire s\u0103 cear\u0103 conectare prin ssh \u0219i introducerea parolei. Acest lucru va fi de asemenea suficient \u00een scenariul de extragere simpl\u0103 a \u201edatelor reci\u201d. Iat\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/benediktkr.github.io\/ops\/2015\/05\/01\/remote-fde.html\">instruc\u021biunea pentru utilizarea dropbear<\/a><\/noindex> \u0219i criptarea de la distan\u021b\u0103 a discurilor. De\u0219i \u00een cazul VDS este complicat \u0219i excesiv.<\/p>\n<h2>Bare metal<\/h2>\n<p>\nNu este at\u00e2t de simplu s\u0103 \u00ee\u021bi pui propriul server \u00een data center. Un server dedicat extern poate fi o ma\u0219in\u0103 virtual\u0103, la care sunt conectate toate dispozitivele. Dar lucruri interesante \u00een ceea ce prive\u0219te protec\u021bia \u00eencep s\u0103 apar\u0103 atunci c\u00e2nd ave\u021bi posibilitatea de a plasa \u00een data center serverul fizic de \u00eencredere. Aici deja pute\u021bi folosi \u00een \u00eentregime dm-crypt, VeraCrypt sau orice alt tip de criptare la alegerea dumneavoastr\u0103.<\/p>\n<p>Trebuie s\u0103 \u00een\u021belegem c\u0103, atunci c\u00e2nd implement\u0103m criptarea total\u0103, serverul nu va putea porni singur dup\u0103 repornire. Va fi necesar s\u0103 stabilim conexiunea cu interfa\u021ba local\u0103 IP-KVM, IPMI sau alt echivalent similar. Dup\u0103 care introducem manual cheia principal\u0103. Schema nu arat\u0103 foarte bine din punct de vedere al continuit\u0103\u021bii \u0219i fiabilit\u0103\u021bii, dar nu exist\u0103 alternative semnificative, dac\u0103 datele sunt at\u00e2t de valoroase.<\/p>\n<p><img decoding=\"async\" alt=\"Ce s\u0103 faci dac\u0103 la providerul t\u0103u de hosting au venit siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/db32aac0efebed1bc71a2277b7f51244.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>NCipher nShield F3 Hardware Security Module<\/i><\/p>\n<p>O variant\u0103 mai bl\u00e2nd\u0103 presupune ca datele s\u0103 fie criptate, iar cheia s\u0103 se afle direct \u00een server, \u00eentr-un HSM (Hardware Security Module) special. De obicei, acestea sunt dispozitive foarte func\u021bionale, care nu doar c\u0103 asigur\u0103 criptografie hardware, dar au \u0219i mecanisme de detectare a \u00eencerc\u0103rilor de acces fizic neautorizat. Dac\u0103 cineva \u00eencepe s\u0103 for\u021beze serverul cu un polizor, HSM-ul cu o surs\u0103 de alimentare independent\u0103 va \u0219terge cheile pe care le stocheaz\u0103 \u00een memorie. Atacatorul va primi un amestec criptat. De asemenea, repornirea poate avea loc automat.<\/p>\n<p>\u0218tergerea cheilor este o variant\u0103 mult mai rapid\u0103 \u0219i uman\u0103 dec\u00e2t activarea unei bombe termice sau a unui desc\u0103rc\u0103tor electromagnetic. Vecinii din centrul de date v\u0103 vor totu\u0219i aborda cu nemul\u021bumiri pentru un timp \u00eendelungat. Cu at\u00e2t mai mult, \u00een cazul utiliz\u0103rii <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Opal_Storage_Specification\">TCG Opal 2<\/a><\/noindex> cript\u0103rii pe por\u021bile de stocare nu ve\u021bi resim\u021bi practic niciun overhed. Totul se \u00eent\u00e2mpl\u0103 transparent pentru sistemul de operare. Totu\u0219i, trebuie s\u0103 ave\u021bi \u00eencredere \u00een Samsung \u0219i s\u0103 spera\u021bi c\u0103 utilizeaz\u0103 AES256 corect, nu un simplu XOR.<\/p>\n<p>\u00cen acela\u0219i timp, nu trebuie uitat c\u0103 toate porturile suplimentare trebuie s\u0103 fie dezactivate fizic sau pur \u0219i simplu umplute cu un compus. Altfel, oferi\u021bi atacatorilor oportunitatea de a efectua <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/DMA_attack\">atacuri DMA<\/a><\/noindex>. Dac\u0103 ave\u021bi un PCI Express sau Thunderbolt expus, inclusiv USB cu suport pentru acesta, sunte\u021bi vulnerabil. Atacatorul va putea efectua un atac prin aceste porturi \u0219i ob\u021bine acces direct la memoria cu cheile.<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"E6gzVVjW4yY\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/E6gzVVjW4yY\/hqdefault.jpg\" alt=\"Reda\u021bi video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>\u00centr-o variant\u0103 foarte sofisticat\u0103, atacatorul va putea efectua un atac de tip cold boot. \u00cen acest caz, el va turna o cantitate bun\u0103 de azot lichid \u00een serverul dumneavoastr\u0103, va extrage cu brutalitate modulele de memorie \u00eenghe\u021bate \u0219i va ob\u021bine un dump cu toate cheile. Adesea, pentru realizarea atacului, este suficient un spray de r\u0103cire obi\u0219nuit \u0219i o temperatur\u0103 \u00een jur de -50 de grade. Exist\u0103 \u0219i o variant\u0103 mai delicat\u0103. Dac\u0103 nu a\u021bi dezactivat bootarea de pe dispozitive externe, algoritmul atacatorului va fi \u0219i mai simplu:<\/p>\n<ol>\n<li>\u00cenghe\u021ba\u021bi modulele de memorie f\u0103r\u0103 a deschide carcasa<\/li>\n<li>Conecta\u021bi stick-ul de boot pe care l-a\u021bi preg\u0103tit<\/li>\n<li>Folosi\u021bi utilitare speciale pentru a extrage datele din memoria RAM care au supravie\u021buit repornirii, datorit\u0103 \u00eenghe\u021b\u0103rii.<\/li>\n<\/ol>\n<p><\/p>\n<h2>\u00cemparte \u0219i cucere\u0219te<\/h2>\n<p>\nOk, avem doar ma\u0219ini virtuale, dar vrem s\u0103 reducem \u00een vreun fel riscurile de scurgere a datelor.<br \/>\nSe poate \u00eencerca s\u0103 se reproiecteze arhitectura \u0219i s\u0103 se separe stocarea datelor de procesare \u00een diferite jurisdic\u021bii. De exemplu, frontend-ul cu cheile de criptare la un provider din Cehia, iar backend-ul cu date criptate undeva \u00een Rusia. \u00cen cazul unei \u00eencerc\u0103ri standard de confiscare, este extrem de pu\u021bin probabil ca autorit\u0103\u021bile s\u0103 poat\u0103 ac\u021biona simultan \u00een diferite jurisdic\u021bii. \u00cen plus, aceasta ne protejeaz\u0103 par\u021bial de scenariul \u00een care se realizeaz\u0103 un snapshot.<\/p>\n<p>Sau se poate lua \u00een considerare o op\u021biune complet curat\u0103 \u2014 criptarea End-to-End. Desigur, aceasta dep\u0103\u0219e\u0219te cadrul cerin\u021belor \u0219i nu implic\u0103 efectuarea calculelor pe partea ma\u0219inii externe. Cu toate acestea, este o op\u021biune acceptabil\u0103 atunci c\u00e2nd este vorba despre stocarea \u0219i sincronizarea datelor. De exemplu, acest lucru este foarte bine implementat \u00een Nextcloud. \u00cen acela\u0219i timp, sincronizarea, versionarea \u0219i alte caracteristici ale serverului nu vor disp\u0103rea.<\/p>\n<h2>\u00cen concluzie<\/h2>\n<p>\nNu exist\u0103 sisteme perfect protejate. Sarcina const\u0103 doar \u00een a face atacul mai costisitor dec\u00e2t beneficiul poten\u021bial.<\/p>\n<p>O reducere a riscurilor de acces la date pe un server virtual poate fi ob\u021binut\u0103, combin\u00e2nd criptarea cu stocarea separat\u0103 la diferi\u021bi provider.<\/p>\n<p>O op\u021biune mai mult sau mai pu\u021bin fiabil\u0103 este utilizarea unui server pe care \u00eel de\u021bii.<\/p>\n<p>\u00cens\u0103 providerul tot va trebui s\u0103 fie de \u00eencredere, \u00eentr-un fel sau altul. Aici se bazeaz\u0103 toat\u0103 industria.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=mekl&amp;utm_content=prishli-siloviki\"><img decoding=\"async\" alt=\"Ce s\u0103 faci dac\u0103 la providerul t\u0103u de hosting au venit siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/13474ad7e4e39f259f91f51f4fd1febc.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=mekl&amp;utm_content=prishli-siloviki#order\"><img decoding=\"async\" alt=\"Ce s\u0103 faci dac\u0103 la providerul t\u0103u de hosting au venit siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/92555b963c5ff5b7bf0393a1918c40dd.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506334\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u043a\u0434\u043f\u0432 \u2014 Reuters \u0415\u0441\u043b\u0438 \u0432\u044b \u0430\u0440\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440, \u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0443 \u0432\u0430\u0441 \u043d\u0430\u0434 \u043d\u0438\u043c \u043d\u0435\u0442. \u042d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u0432 \u043b\u044e\u0431\u043e\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043a \u0445\u043e\u0441\u0442\u0435\u0440\u0443 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u043b\u044e\u0434\u0438 \u0438 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043b\u044e\u0431\u044b\u0435 \u0432\u0430\u0448\u0438 \u0434\u0430\u043d\u043d\u044b\u0435. \u0418 \u0445\u043e\u0441\u0442\u0435\u0440 \u0438\u0445 \u043e\u0442\u0434\u0430\u0441\u0442, \u0435\u0441\u043b\u0438 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043e \u043f\u043e \u0437\u0430\u043a\u043e\u043d\u0443. \u0412\u044b \u043e\u0447\u0435\u043d\u044c \u043d\u0435 \u0445\u043e\u0442\u0438\u0442\u0435, \u0447\u0442\u043e\u0431\u044b \u043b\u043e\u0433\u0438 \u0432\u0430\u0448\u0435\u0433\u043e \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85142,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85141","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c, \u0435\u0441\u043b\u0438 \u043a \u0442\u0432\u043e\u0435\u043c\u0443 \u0445\u043e\u0441\u0442\u0435\u0440\u0443 \u043f\u0440\u0438\u0448\u043b\u0438 siloviki | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-13T11:42:24+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-13T11:42:24+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ce s\u0103 faci dac\u0103 autorit\u0103\u021bile au venit la providerul t\u0103u | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c, \u0435\u0441\u043b\u0438 \u043a \u0442\u0432\u043e\u0435\u043c\u0443 \u0445\u043e\u0441\u0442\u0435\u0440\u0443 \u043f\u0440\u0438\u0448\u043b\u0438 siloviki | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-13T11:42:24+00:00","article:modified_time":"2020-06-13T11:42:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85141","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:43:30","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/85141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=85141"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/85141\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/85142"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=85141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=85141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=85141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}