{"id":96242,"date":"2020-10-09T19:42:33","date_gmt":"2020-10-09T17:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza"},"modified":"2020-10-09T19:42:33","modified_gmt":"2020-10-09T17:42:33","slug":"dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","title":{"rendered":"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>(za ideu nadpisu \u010fakujem Sergey G. Brester <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/users\/sebres\/\" class=\"user_link\">sebres<\/a><\/noindex>)<\/p>\n<p>Kolegovia, cie\u013eom tohto \u010dl\u00e1nku je zdie\u013ea\u0165 sk\u00fasenosti z ro\u010dn\u00e9ho testovania nov\u00e9ho typu IDS rie\u0161en\u00ed zalo\u017een\u00fdch na Deception technol\u00f3gi\u00e1ch. <\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/f641b6735cf846d12a0081c7709662e7.png\" style=\"display:block;margin: 0 auto;\" \/><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Aby sa zachovala logick\u00e1 s\u00favislos\u0165 materi\u00e1lu, pova\u017eujem za potrebn\u00e9 za\u010da\u0165 od predpokladov. Tak\u017ee, probl\u00e9m je:<\/p>\n<ol>\n<li>Zameran\u00e9 \u00fatoky s\u00fa najnebezpe\u010dnej\u0161\u00edm typom \u00fatokov, aj ke\u010f ich podiel na celkovom po\u010dte hrozieb nie je ve\u013ek\u00fd. <\/li>\n<li>Neexistuje \u017eiadny zaru\u010den\u00fd efekt\u00edvny prostriedok na ochranu perimetra (alebo s\u00fabor tak\u00fdchto prostriedkov), ktor\u00fd by bol doteraz vymyslen\u00fd. <\/li>\n<li>Ako pravidlo, zameran\u00e9 \u00fatoky prebiehaj\u00fa v nieko\u013ek\u00fdch f\u00e1zach. Prekonanie perimetra je len jednou z po\u010diato\u010dn\u00fdch f\u00e1z, ktor\u00e1 (m\u00f4\u017eete ma h\u00e1dza\u0165 kame\u0148mi) nezp\u00f4sobuje ve\u013ek\u00e9 \u0161kody \u201eobeti\u201c, pokia\u013e nejde o DEoS (Destruction of service) \u00fatoky (\u0161ifrovacie softv\u00e9ry a pod.). Skuto\u010dne \u201ebolestiv\u00e9\u201c to za\u010d\u00edna nesk\u00f4r, ke\u010f sa zachyten\u00e9 akt\u00edva za\u010dn\u00fa pou\u017e\u00edva\u0165 na pivotovanie a rozvoj \u00fatoku \u201edo h\u013abky\u201c, a my si toho nev\u0161imneme. <\/li>\n<li>Ke\u010f\u017ee za\u010d\u00edname skuto\u010dne str\u00e1ca\u0165 a\u017e vtedy, ke\u010f sa \u00fato\u010dn\u00edci dostan\u00fa k cie\u013eom \u00fatoku (serverom aplik\u00e1ci\u00ed, DB, d\u00e1tov\u00fdm \u00falo\u017eisk\u00e1m, repozit\u00e1rom, prvkom kritickej infra\u0161trukt\u00fary), je logick\u00e9, \u017ee jednou z \u00faloh oddelenia IT bezpe\u010dnosti je preru\u0161i\u0165 \u00fatoky pred touto tragickou udalos\u0165ou. Ale aby sme nie\u010do preru\u0161i\u0165, mus\u00edme sa o tom najprv dozvedie\u0165. A \u010d\u00edm sk\u00f4r \u2013 t\u00fdm lep\u0161ie. <\/li>\n<li>Preto je kritick\u00e9 pre \u00faspe\u0161n\u00e9 riadenie riz\u00edk (to znamen\u00e1, zn\u00ed\u017eenie \u0161k\u00f4d sp\u00f4soben\u00fdch zameran\u00fdmi \u00fatokmi) ma\u0165 n\u00e1stroje, ktor\u00e9 zabezpe\u010dia minim\u00e1lne TTD (time to detect \u2013 \u010das od momentu vniknutia do momentu zistenia \u00fatoku). V z\u00e1vislosti od odvetvia a regi\u00f3nu tento obdobie v priemere trv\u00e1 99 dn\u00ed v USA, 106 dn\u00ed v regi\u00f3ne EMEA, 172 dn\u00ed v regi\u00f3ne APAC (M-Trends 2017, A View From the Front Lines, Mandiant). <\/li>\n<li>\u010co pon\u00faka trh?\n<ul>\n<li>\u201ePieskovisk\u00e1\u201c. E\u0161te jeden prevent\u00edvny kontrol, ktor\u00fd je \u010faleko od ide\u00e1lu. Existuje mno\u017estvo efekt\u00edvnych techn\u00edk na zistenie a ob\u00eddenie pieskov\u00edsk alebo whitelisting rie\u0161en\u00ed. Chlapci z \u201etmavej strany\u201c s\u00fa tu zatia\u013e o krok vpred. \n<\/li>\n<li>UEBA (syst\u00e9my profilovania spr\u00e1vania a odha\u013eovania odch\u00fdlok) - v te\u00f3rii m\u00f4\u017ee by\u0165 ve\u013emi efekt\u00edvne. Ale z m\u00f4jho poh\u013eadu, to je niekedy niekedy v \u010falekej bud\u00facnosti. V praxi - to je zatia\u013e ve\u013emi drah\u00e9, nespo\u013eahliv\u00e9 a vy\u017eaduje ve\u013emi zrel\u00fa a stabiln\u00fa IT a IB infra\u0161trukt\u00faru, kde u\u017e existuj\u00fa v\u0161etky n\u00e1stroje, ktor\u00e9 bud\u00fa generova\u0165 \u00fadaje pre behavior\u00e1lnu anal\u00fdzu.\n<\/li>\n<li>SIEM je dobr\u00fdm n\u00e1strojom na vy\u0161etrovanie, ale nie je schopn\u00fd v\u010das odhali\u0165 nie\u010do nov\u00e9, origin\u00e1lne, preto\u017ee korela\u010dn\u00e9 pravidl\u00e1 s\u00fa v podstate tie ist\u00e9 signat\u00fary. <\/li>\n<\/ul>\n<p>\n <\/li>\n<li>Nakoniec vznikla potreba tak\u00e9ho n\u00e1stroja, ktor\u00fd by:\n<ul>\n<li>\u00faspe\u0161ne pracoval v podmienkach u\u017e skompromitovan\u00e9ho perimetra,\n<\/li>\n<li>odhalil \u00faspe\u0161n\u00e9 \u00fatoky v re\u017eime bl\u00edzkom k re\u00e1lnemu \u010dasu nez\u00e1visle od n\u00e1strojov a t\u00fdch zranite\u013enost\u00ed, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa,<\/li>\n<li>nez\u00e1visel od signat\u00far\/pravidiel\/scen\u00e1rov\/polit\u00edk\/profily a \u010fal\u0161\u00edch statick\u00fdch vec\u00ed,<\/li>\n<li>nevy\u017eadoval pr\u00edtomnos\u0165 ve\u013ek\u00fdch mno\u017estiev \u00fadajov a ich zdrojov na anal\u00fdzu,<\/li>\n<li>umo\u017enil definova\u0165 \u00fatoky nie ako ak\u00e9si rizikov\u00e9 sk\u00f3re v d\u00f4sledku pr\u00e1ce \"najlep\u0161ej na svete, patentovanej a preto uzavretej matematiky\", ktor\u00e1 vy\u017eaduje \u010fal\u0161ie vy\u0161etrovanie, ale prakticky ako bin\u00e1rnu udalos\u0165 - \"\u00c1no, sme napadnut\u00ed\" alebo \"Nie, v\u0161etko je OK\",<\/li>\n<li>bol univerz\u00e1lny, efekt\u00edvne \u0161k\u00e1lovate\u013en\u00fd a re\u00e1lne implementovate\u013en\u00fd v akomko\u013evek heterog\u00e9nnom prostred\u00ed, nez\u00e1visle od pou\u017e\u00edvan\u00e9 fyzick\u00e9 a logick\u00e9 topol\u00f3gie siete.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>\nNa rolu tak\u00e9hoto n\u00e1stroja teraz kandiduj\u00fa, takzvan\u00e9, deception rie\u0161enia. To znamen\u00e1 rie\u0161enia, ktor\u00fdch z\u00e1kladom je star\u00e1 dobr\u00e1 koncepcia honeypotov, ale s \u00faplne inou \u00farov\u0148ou implement\u00e1cie. T\u00e1to t\u00e9ma je teraz jednozna\u010dne na vzostupe.<\/p>\n<p>Na z\u00e1klade <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gartner.com\/newsroom\/id\/3744917\">Gartner Security&amp;Risc management summit 2017<\/a><\/noindex> Deception rie\u0161enia vstupuj\u00fa do TOP-3 strat\u00e9gi\u00ed a n\u00e1strojov, ktor\u00e9 sa odpor\u00fa\u010da aplikova\u0165. <\/p>\n<p>Pod\u013ea spr\u00e1vy <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tag-cyber.com\/Annual\/2017\/\">TAG Cybersecurity Annual 2017<\/a><\/noindex> Deception je jedn\u00fdm z hlav\u00fdch smerov v\u00fdvoja IDS (Intrusion Detection Systems) rie\u0161en\u00ed.<\/p>\n<p>Cel\u00e1 sekcia poslednej <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/security\/security-reports.html\">spr\u00e1vy Cisco o stave IT bezpe\u010dnosti<\/a><\/noindex>, venovan\u00e1 SCADA, je postaven\u00e1 na \u00fadajoch jedn\u00e9ho z l\u00eddrov tohto trhu, TrapX Security (Izrael), ktor\u00e9ho rie\u0161enie u\u017e rok funguje v na\u0161ej testovacej z\u00f3ne. <\/p>\n<p>TrapX Deception Grid umo\u017e\u0148uje centr\u00e1lne konfigurova\u0165 a spravova\u0165 rozsiahle distribuovan\u00e9 IDS bez zvy\u0161ovania licen\u010dnej z\u00e1\u0165a\u017ee a po\u017eiadaviek na hardv\u00e9rov\u00e9 prostriedky. V skuto\u010dnosti je TrapX kon\u0161truktor, ktor\u00fd umo\u017e\u0148uje vytvori\u0165 z prvkov existuj\u00facej IT infra\u0161trukt\u00fary jeden ve\u013ek\u00fd mechanizmus na detekciu \u00fatokov na podnikovej \u00farovni, ak\u00fdsi distribuovan\u00fd sie\u0165ov\u00fd \"alarm\". <\/p>\n<h3>\u0160trukt\u00fara Rie\u0161enia<\/h3>\n<p>\nV na\u0161ej laborat\u00f3rii neust\u00e1le sk\u00famame a testujeme r\u00f4zne novinky v oblasti IT bezpe\u010dnosti. Teraz je tu nasaden\u00fdch pribli\u017ene 50 r\u00f4znych virtu\u00e1lnych serverov, vr\u00e1tane komponentov TrapX Deception Grid.<\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/9c9c21101020c1005edc938a3a7ca393.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTak\u017ee, zhora nadol:<\/p>\n<ol>\n<li>TSOC (TrapX Security Operation Console) \u2013 mozog syst\u00e9mu. Je to centr\u00e1lna konzola spr\u00e1vy, prostredn\u00edctvom ktorej sa nastavuje a nas\u00e1dza rie\u0161enie a vykon\u00e1va sa ka\u017edodenn\u00e1 pr\u00e1ca. Preto\u017ee ide o webov\u00fa slu\u017ebu, m\u00f4\u017ee by\u0165 nasaden\u00e1 kdeko\u013evek \u2013 na per\u00edmetri, v cloude alebo u poskytovate\u013ea MSSP. <\/li>\n<li>TrapX Appliance (TSA) \u2013 virtu\u00e1lny server, do ktor\u00e9ho pomocou trunk-portu prip\u00e1jame tie podsiete, ktor\u00e9 chceme pokry\u0165 monitoringom. Tie\u017e tu v skuto\u010dnosti \"\u017eij\u00fa\" v\u0161etky na\u0161e sie\u0165ov\u00e9 senzory.\n<p>V na\u0161ej laborat\u00f3rii je nasaden\u00fd jeden TSA (mwsapp1), ale v skuto\u010dnosti ich m\u00f4\u017ee by\u0165 viac. M\u00f4\u017ee to by\u0165 potrebn\u00e9 v rozsiahlych sie\u0165ach, kde medzi segmentmi nie je L2 konektivita (typick\u00fd pr\u00edklad \u2013 \"Holding a dc\u00e9rske spolo\u010dnosti\" alebo \"\u00dastredie banky a pobo\u010dky\") alebo ak s\u00fa v sieti izolovan\u00e9 segmenty, napr\u00edklad ASUTP. V ka\u017edej takej pobo\u010dke\/segmente je mo\u017en\u00e9 nasadi\u0165 svoj TSA a pripoji\u0165 ho k jedn\u00e9mu TSOC, na ktorom bud\u00fa v\u0161etky inform\u00e1cie centr\u00e1lne spracov\u00e1van\u00e9. Tak\u00e1to architekt\u00fara umo\u017e\u0148uje budova\u0165 distribuovan\u00e9 monitorovacie syst\u00e9my bez nutnosti radik\u00e1lnej prestavby siete alebo naru\u0161enia existuj\u00facej segment\u00e1cie.<\/p>\n<p>Tie\u017e na TSA m\u00f4\u017eeme predklada\u0165 k\u00f3piu odch\u00e1dzaj\u00faceho prenosu cez TAP\/SPAN. V pr\u00edpade zistenia pripojen\u00ed k zn\u00e1mym botnetom, riadiacim serverom, TOR rel\u00e1ci\u00e1m, dostaneme v\u00fdsledok tie\u017e v konzole. O toto sa star\u00e1 Network Intelligence Sensor (NIS). V na\u0161om prostred\u00ed je t\u00e1to funkcia realizovan\u00e1 na firewall, preto sme ju tu nepou\u017eili. <\/li>\n<li>Aplik\u00e1cie Traps (\u00fapln\u00fd OS) \u2013 tradi\u010dn\u00e9 honeypoty zalo\u017een\u00e9 na Windows serveroch. Nie je ich potrebn\u00e9 ve\u013ea, preto\u017ee hlavn\u00e1 \u00faloha t\u00fdchto serverov je poskytn\u00fa\u0165 IT slu\u017eby \u010fal\u0161ej \u00farovni senzorov alebo odha\u013eova\u0165 \u00fatoky na obchodn\u00e9 aplik\u00e1cie, ktor\u00e9 m\u00f4\u017eu by\u0165 nasaden\u00e9 v prostred\u00ed Windows. V na\u0161ej laborat\u00f3rii m\u00e1me nain\u0161talovan\u00fd jeden tak\u00fd server (FOS01)\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/8de44215efff4a49f3b773da10185a73.png\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li>Emulovan\u00e9 pasce \u2013 hlavn\u00fd komponent rie\u0161enia, ktor\u00fd n\u00e1m umo\u017e\u0148uje pomocou jednej virtu\u00e1lnej ma\u0161iny vytvori\u0165 ve\u013emi hust\u00e9 \u201em\u00ednov\u00e9\u201c pole pre \u00fato\u010dn\u00edkov a nas\u00fdti\u0165 sie\u0165 podniku, v\u0161etky jeho VLAN-y, na\u0161imi senzormi. \u00dato\u010dn\u00edk vid\u00ed tak\u00fd senzor alebo falo\u0161n\u00fd hostite\u013e ako skuto\u010dn\u00fd Windows PC alebo server, Linux server alebo in\u00e9 zariadenie, ktor\u00e9 sa rozhodneme mu uk\u00e1za\u0165.\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/306c21046c5baadd591b66cdfe153ec2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPre dobro veci a zvedavosti sme nasadili \u201eka\u017edej potvore po p\u00e1re\u201c \u2013 Windows PC a servery r\u00f4znych verzi\u00ed, Linux servery, bankomat s Windows embedded, SWIFT Web Access, sie\u0165ov\u00fa tla\u010diare\u0148, Cisco switch, IP kameru Axis, MacBook, PLC zariadenie a dokonca aj inteligentn\u00fa \u017eiarovku. Celkovo \u2013 13 hostite\u013eov. V skuto\u010dnosti dod\u00e1vate\u013e odpor\u00fa\u010da nasadi\u0165 tak\u00e9 senzory v mno\u017estve minim\u00e1lne 10% z po\u010dtu skuto\u010dn\u00fdch hostite\u013eov. Horn\u00e1 hranica je dostupn\u00fd adresn\u00fd priestor. <\/p>\n<p>Ve\u013emi d\u00f4le\u017eit\u00fdm aspektom je to, \u017ee ka\u017ed\u00fd tak\u00fd hostite\u013e nie je plnohodnotn\u00e1 virtu\u00e1lna ma\u0161ina, ktor\u00e1 vy\u017eaduje zdroje a licencie. Je to \u201ev\u00fdmena\u201c, emul\u00e1cia, jeden proces na TSA, ktor\u00fd m\u00e1 sadu parametrov a IP adresu. Preto m\u00f4\u017eeme pomocou aj jedn\u00e9ho TSA nas\u00fdti\u0165 sie\u0165 stovkami tak\u00fdch falo\u0161n\u00fdch hostite\u013eov, ktor\u00e9 bud\u00fa fungova\u0165 ako senzory v syst\u00e9me alarmov. Presne t\u00e1to technol\u00f3gia umo\u017e\u0148uje ekonomicky efekt\u00edvne \u0161k\u00e1lova\u0165 koncept \u201ehoneypotov\u201c v r\u00e1mci ak\u00e9hoko\u013evek ve\u013ek\u00e9ho distribuovan\u00e9ho podniku. <\/p>\n<p>Tieto hostitelia s\u00fa z poh\u013eadu \u00fato\u010dn\u00edka atrakt\u00edvne, preto\u017ee obsahuj\u00fa zranite\u013enosti a vyzeraj\u00fa ako relat\u00edvne \u013eahk\u00e9 ciele. \u00dato\u010dn\u00edk vid\u00ed slu\u017eby na t\u00fdchto hostite\u013eoch a m\u00f4\u017ee s nimi interagova\u0165, \u00fato\u010di\u0165 na ne, pri\u010dom pou\u017e\u00edva \u0161tandardn\u00e9 n\u00e1stroje a protokoly (smb\/wmi\/ssh\/telnet\/web\/dnp\/bonjour\/Modbus a pod.). Ale pou\u017e\u00edva\u0165 tieto hostite\u013eov na rozvoj \u00fatoku a spustenie svojho k\u00f3du nie je mo\u017en\u00e9.\n<\/li>\n<li>Kombin\u00e1cia t\u00fdchto dvoch technol\u00f3gi\u00ed (FullOS a emulovan\u00fdch pasc\u00ed) umo\u017e\u0148uje dosiahnu\u0165 vysok\u00fa \u0161tatistick\u00fa pravdepodobnos\u0165, \u017ee \u00fato\u010dn\u00edk sa sk\u00f4r \u010di nesk\u00f4r stretne s nejak\u00fdm elementom na\u0161ej sign\u00e1lnej siete. Ale ako dosiahnu\u0165, aby t\u00e1to pravdepodobnos\u0165 bola bl\u00edzka 100%?\n<p>Do hry vstupuj\u00fa tzv. tokeny (Deception tokens). V\u010faka nim m\u00f4\u017eeme zahrn\u00fa\u0165 do n\u00e1\u0161ho distribuovan\u00e9ho IDS v\u0161etky existuj\u00face PC a servery podniku. Tokeny s\u00fa umiestnen\u00e9 na skuto\u010dn\u00fdch PC pou\u017e\u00edvate\u013eov. Je d\u00f4le\u017eit\u00e9 ch\u00e1pa\u0165, \u017ee tokeny nie s\u00fa agenti, ktor\u00ed spotreb\u00favaj\u00fa zdroje a m\u00f4\u017eu vyvol\u00e1va\u0165 konflikty. Tokeny s\u00fa pas\u00edvne informa\u010dn\u00e9 elementy, ak\u00e9si \u201echlebov\u00e9 omrvinky\u201c pre \u00fato\u010dn\u00edkov, ktor\u00e9 ich ved\u00fa do pasce. Napr\u00edklad pripojen\u00e9 sie\u0165ov\u00e9 disky, z\u00e1lo\u017eky na falo\u0161n\u00e9 webov\u00e9 administr\u00e1cie v prehliada\u010di a ulo\u017een\u00e9 hesl\u00e1 k nim, ulo\u017een\u00e9 session ssh\/rdp\/winscp, na\u0161e pasce s koment\u00e1rmi v hosts s\u00faboroch, ulo\u017een\u00e9 hesl\u00e1 v pam\u00e4ti, \u00fadaje neexistuj\u00facich pou\u017e\u00edvate\u013eov, kancel\u00e1rske s\u00fabory, ktor\u00fdch otvorenie vyvol\u00e1 aktiv\u00e1ciu syst\u00e9mu, a mnoho \u010fal\u0161ieho. Takto umiestnime \u00fato\u010dn\u00edka do skreslen\u00e9ho prostredia, pres\u00fdten\u00e9ho t\u00fdmi vektormi \u00fatokov, ktor\u00e9 v skuto\u010dnosti pre n\u00e1s nepredstavuj\u00fa hrozbu, sk\u00f4r naopak. A on nem\u00e1 mo\u017enos\u0165 ur\u010di\u0165, kde s\u00fa pravdiv\u00e9 inform\u00e1cie a kde nepravdiv\u00e9. Takto nielen zabezpe\u010dujeme r\u00fdchle zis\u0165ovanie \u00fatoku, ale aj v\u00fdrazne spoma\u013eujeme jeho priebeh. <\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/812409dca0c8bc991c7e9812f16d77cf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Pr\u00edklad vytvorenia sie\u0165ovej pasce a nastavenia tokenov. Priate\u013esk\u00e9 rozhranie bez ak\u00fdchko\u013evek ru\u010dn\u00fdch \u00faprav konfigur\u00e1ci\u00ed, skriptov a podobne.<\/i><\/p>\n<p>V na\u0161om prostred\u00ed sme nakonfigurovali a umiestnili radu tak\u00fdchto tokenov na FOS01 riaden\u00e9ho Windows Server 2012R2 a na testovom PC pod Windows 7. Na t\u00fdchto strojoch be\u017e\u00ed RDP a periodicky ich \u201evystavujeme\u201c v DMZ, kam sme umiestnili aj nieko\u013eko na\u0161ich senzorov (emulated traps). T\u00fdmto sp\u00f4sobom z\u00edskavame neust\u00e1ly pr\u00edsun incidentov, tak povediac, prirodzene. <\/p>\n<p>Tak\u017ee, stru\u010dn\u00e1 \u0161tatistika za rok:<\/p>\n<p>56 208 \u2013 incidentov zaznamenan\u00fdch,<br \/>\n2 912 \u2013 zdrojov\u00fdch hostite\u013eov \u00fatokov bolo objaven\u00fdch. <\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/0b2404084a997ba5fe4ad33303501612.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Interakt\u00edvna, klikate\u013en\u00e1 mapa \u00fatokov<\/i><\/p>\n<p>Rie\u0161enie generuje \u013eahko \u010ditate\u013en\u00fd preh\u013ead udalost\u00ed, v ktorom sa u\u017e nemus\u00edte dlho prehrab\u00e1va\u0165. Namiesto toho sa udalos\u0165 automaticky klasifikuje pod\u013ea typu a umo\u017e\u0148uje t\u00edmu kybernetickej bezpe\u010dnosti s\u00fastredi\u0165 sa najprv na najnebezpe\u010dnej\u0161ie: ke\u010f \u00fato\u010diaca strana sk\u00fa\u0161a vytvori\u0165 riadiace rel\u00e1cie (interaction) alebo ke\u010f sa v na\u0161om prenosovom tok nach\u00e1dzaj\u00fa bin\u00e1rne za\u0165a\u017eenia (infection). <\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/d0ad109bae7dc0fb80182d43be713d4e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u0161etky inform\u00e1cie o udalostiach s\u00fa zrozumite\u013en\u00e9 a prezentovan\u00e9, pod\u013ea m\u00f4jho n\u00e1zoru, v \u013eahko pochopite\u013enej forme aj pre pou\u017e\u00edvate\u013ea s z\u00e1kladn\u00fdmi znalos\u0165ami v oblasti kybernetickej bezpe\u010dnosti. <\/p>\n<p>V\u00e4\u010d\u0161ina zaznamenan\u00fdch incidentov s\u00fa pokusy o skenovanie na\u0161ich hostite\u013eov alebo ojedinel\u00fdch pripojen\u00ed. <\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/ea87b3592b2d3727815050b9fd1f708e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAlebo pokusy o prelomenie hesiel pre RDP.<\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/645b5984d1ffaf31758fb23e9a23c9eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNavy\u0161e sme sa stretli aj s zauj\u00edmavej\u0161\u00edmi pr\u00edpadmi, najm\u00e4 ke\u010f sa \u00fato\u010dn\u00edkom \u201epodarilo\u201c uh\u00e1dnu\u0165 heslo pre RDP a z\u00edska\u0165 pr\u00edstup do miestnej siete. <\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/3cde5beadaa306d32c382f66bd67ec33.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00dato\u010dn\u00edk sa pok\u00fa\u0161a vykona\u0165 k\u00f3d pomocou psexec.<\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/1356ef44f3581b37c3163ce454fecf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00dato\u010dn\u00edk na\u0161iel ulo\u017een\u00fa rel\u00e1ciu, ktor\u00e1 ho priviedla do pasce v podobe Linux servera. Ihne\u010f po pripojen\u00ed pomocou jedn\u00e9ho vopred pripraven\u00e9ho s\u00faboru pr\u00edkazov sa pok\u00fasil zni\u010di\u0165 v\u0161etky s\u00fabory protokolov a pr\u00edslu\u0161n\u00e9 syst\u00e9mov\u00e9 premenn\u00e9.<\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/6d8994cd3bb2268e45540e5bbcdc74a4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00dato\u010dn\u00edk sa pok\u00fa\u0161a vykona\u0165 SQL injekciu na pasci, ktor\u00e1 imituje SWIFT Web Access.<\/p>\n<p>Okrem tak\u00fdchto \"prirodzen\u00fdch\" \u00fatokov sme vykonali aj nieko\u013eko vlastn\u00fdch testov. Jedn\u00fdm z najv\u00fdznamnej\u0161\u00edch je testovanie \u010dasu detekcie sie\u0165ov\u00e9ho \u010derva v sieti. Na tento \u00fa\u010del sme pou\u017eili n\u00e1stroj od GuardiCore, ktor\u00fd sa naz\u00fdva <noindex><a rel=\"nofollow\" href=\"http:\/\/www.guardicore.com\/infectionmonkey\/\">Infection Monkey<\/a><\/noindex>. Je to sie\u0165ov\u00fd \u010derv, ktor\u00fd dok\u00e1\u017ee infikova\u0165 Windows a Linux, ale bez nejakej \u201eu\u017eito\u010dnej\u201c z\u00e1\u0165a\u017ee. <br \/>\nZriadili sme miestne riadiace stredisko, na jednom z po\u010d\u00edta\u010dov sme spustili prv\u00fa in\u0161tanciu \u010derva a dostali sme prv\u00e9 upozornenie v konzole TrapX za menej ako jednu a pol min\u00faty. \u010cas TTD 90 sek\u00fand oproti 106 d\u0148om v priemere\u2026 <\/p>\n<p>V\u010faka mo\u017enosti integr\u00e1cie s in\u00fdmi triedami rie\u0161en\u00ed m\u00f4\u017eeme prejs\u0165 z r\u00fdchlej detekcie hrozieb na automatick\u00e9 reakcie na ne. <\/p>\n<p>Napr\u00edklad integr\u00e1cia so syst\u00e9mami NAC (Network Access Control) alebo s CarbonBlack umo\u017en\u00ed automaticky odpoji\u0165 kompromitovan\u00e9 PC od siete. <\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/4364d6374b57e5741e33f8981b4cb0ad.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIntegr\u00e1cia s pieskoviskami umo\u017e\u0148uje automaticky odosiela\u0165 na anal\u00fdzu s\u00fabory, ktor\u00e9 sa podie\u013eaj\u00fa na \u00fatokoch. <\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/c66b8051d0dbd31c1215329d1b55930b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Integr\u00e1cia s McAfee<\/h3>\n<p>\nRie\u0161enie obsahuje aj vlastn\u00fd zabudovan\u00fd syst\u00e9m korel\u00e1cie udalost\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/d4030212690f3ee1f1a641c49bc90960.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAle jeho schopnosti n\u00e1s neuspokojili, a preto sme ho integrovali s HP ArcSight.<\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/f08d607c5b4abf8dc354f65ed2591ebc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa zvl\u00e1danie zisten\u00fdch hrozieb pom\u00e1ha zabudovan\u00fd syst\u00e9m tiketingu.<\/p>\n<p><img decoding=\"async\" alt=\"Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako lovi\u0165 APT \u201ena \u017eivca\u201c\" src=\"\/wp-content\/uploads\/2020\/10\/0e78fa59b2f2b114fa9bdf572f37ea96.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKe\u010f\u017ee rie\u0161enie bolo od za\u010diatku navrhnut\u00e9 pre potreby vl\u00e1dnych org\u00e1nov a ve\u013ek\u00e9ho korpor\u00e1tneho sektora, samozrejme, zrealizovan\u00fd je pr\u00edstup na z\u00e1klade rol\u00ed, integr\u00e1cia s AD, pokro\u010dil\u00fd syst\u00e9m reportov a sp\u00fa\u0161\u0165a\u010dov (notifik\u00e1ci\u00ed udalost\u00ed), orchestr\u00e1cia pre ve\u013ek\u00e9 holdingu alebo MSSP poskytovate\u013eov. <\/p>\n<h3>Namiesto zhrnutia<\/h3>\n<p>\nAk existuje podobn\u00fd monitorovac\u00ed syst\u00e9m, ktor\u00fd n\u00e1m obrazne povedan\u00e9 kryje chrb\u00e1t, s kompromit\u00e1ciou perimetra to len za\u010d\u00edna. Najd\u00f4le\u017eitej\u0161ie je, \u017ee sa objavuje re\u00e1lna mo\u017enos\u0165 bojova\u0165 s incidentami kybernetickej bezpe\u010dnosti a nie len odstra\u0148ova\u0165 ich n\u00e1sledky.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/softline\/blog\/413893\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G. Brester sebres) \u041a\u043e\u043b\u043b\u0435\u0433\u0438, \u0446\u0435\u043b\u044c\u044e \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0433\u043e\u0434\u0438\u0447\u043d\u043e\u0439 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 IDS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Deception-\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439. \u0427\u0442\u043e\u0431\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u0441\u0447\u0438\u0442\u0430\u044e \u043d\u0443\u0436\u043d\u044b\u043c \u043d\u0430\u0447\u0430\u0442\u044c \u0441 \u043f\u0440\u0435\u0434\u043f\u043e\u0441\u044b\u043b\u043e\u043a. \u0418\u0442\u0430\u043a, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0442\u0438\u043a\u0430: \u041d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u2013 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0432\u0438\u0434 \u0430\u0442\u0430\u043a, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432 \u043e\u0431\u0449\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0433\u0440\u043e\u0437 \u0438\u0445 \u0443\u0434\u0435\u043b\u044c\u043d\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0414\u044b\u0440\u0430 \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2013 2, \u0438\u043b\u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u044c APT \u00ab\u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T17:42:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T17:42:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Diera ako n\u00e1stroj bezpe\u010dnosti \u2013 2, alebo ako chyta\u0165 APT \u201ena \u017eivca\u201c | ProHoster","description":"(za n\u00e1pad na nadpis \u010fakujem Sergey G.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u044b\u0440\u0430 \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2013 2, \u0438\u043b\u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u044c APT \u00ab\u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb | ProHoster","og:description":"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T17:42:33+00:00","article:modified_time":"2020-10-09T17:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:47:24","updated":"2022-10-03 07:10:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/96242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=96242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/96242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/96243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=96242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=96242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=96242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}