{"id":30310,"date":"2019-10-31T21:34:48","date_gmt":"2019-10-31T18:34:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ya-proskaniroval-ukrainu\/"},"modified":"2019-10-31T21:34:48","modified_gmt":"2019-10-31T18:34:48","slug":"ya-proskaniroval-ukrainu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/ya-proskaniroval-ukrainu","title":{"rendered":"Skeniral sem Ukrajino","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V februarju je Avstrijec Christian Haschek na svojem blogu objavil zanimiv \u010dlanek z naslovom \u00bbPreveril sem vse Avstrijske naslove IP\u00ab<\/a><\/noindex>. Seveda me je zanimalo, kaj bi se zgodilo, \u010de bi to raziskavo ponovili, ampak s Ukrajino. Nekaj tednov nenehnega zbiranja informacij, \u0161e nekaj dni, da oblikujem \u010dlanek, in med to raziskavo pogovori z razli\u010dnimi predstavniki na\u0161e skupnosti, za bolj natan\u010dne informacije in ve\u010dja spoznanja. Prosim, nadaljujte...
\n<\/a><\/noindex><\/p>\n

TL;DR<\/h2>\n

\nZa zbiranje informacij nismo uporabili nobenih posebnih orodij (\u010deprav so nekateri svetovali, da uporabimo OpenVAS, da bi bilo raziskovanje bolj temeljito in informativno). Kar se ti\u010de varnosti naslovov IP, ki pripadajo Ukrajini (kako so bili dolo\u010deni, o tem kasneje), je situacija, po mojem mnenju, dokaj slaba (in gotovo slab\u0161a od tiste v Avstriji). Niso bili izvedeni nobeni poskusi uporabe odkrito ranljivih stre\u017enikov.<\/p>\n

Najprej: kako lahko pridobimo vse naslove IP, ki pripadajo dolo\u010deni dr\u017eavi?<\/h2>\n

\nTo je v resnici zelo preprosto. Naslovi IP se ne generirajo sami po sebi, temve\u010d se dodelijo dr\u017eavi. Zato obstaja seznam (in je javno dostopen) vseh dr\u017eav in vseh IP naslovov, ki jim pripadajo.<\/p>\n

Vsak lahko nalo\u017ei<\/a><\/noindex>, nato pa ga filtrira z grep Ukraine IP2LOCATION-LITE-DB1.CSV > ukraine.csv<\/p>\n

Enostaven skript, ki ga je ustvaril Christian<\/a><\/noindex>, omogo\u010da, da seznam postane bolj uporaben.<\/p>\n

Ukrajini pripada skoraj toliko IPv4 naslovov kot Avstriji, ve\u010d kot 11 milijonov. 11 640 409, natan\u010dneje (za primerjavo v Avstriji \u2014 11 170 487).<\/p>\n

\u010ce no\u010dete sami delati z naslovi IP (in tega ne bi smeli delati!), lahko uporabite storitev Shodan.io<\/a><\/noindex>.<\/p>\n

Ali v Ukrajini obstajajo neopravljene Windows naprave, ki imajo neposreden dostop do interneta?<\/h2>\n

\nSeveda noben zavesten Ukrajinec ne bi odprl takega dostopa za svoje ra\u010dunalnike. Ali pa vendarle?<\/p>\n

masscan -p445 --rate 300 -iL ukraine.ips -oG ukraine.445.scan && cat ukraine.445.scan | wc -l<\/code><\/pre>\n
\nNajdenih je bilo 5669 naprav z Windows in neposrednim dostopom v omre\u017eje (v Avstriji jih je le 1273, kar je prav tako veliko).<\/p>\n
Oops. Are there any among them that could be targeted using the ETHERNALBLUE exploits, known since 2017? There were none in Austria, and I hoped there would be none found in Ukraine either. Unfortunately, it's useless. 198 IP addresses have been found that haven't closed this \"hole\" on their end.<\/p>\n
DNS, DDoS and the Depth of the Rabbit Hole<\/h2>\n
\nEnough about Windows. Let's see what we have with DNS servers that are open resolvers and can be used for DDoS attacks.<\/p>\n
It works something like this. The attacker sends a small DNS request, and the vulnerable server responds to the victim with a packet that is 100 times larger. Boom! Corporate networks can collapse quite quickly from such a volume of data, and the bandwidth needed for the attack can be provided by a modern smartphone. And such attacks have been not uncommon<\/a><\/noindex> even on GitHub.<\/p>\n
Let\u2019s see if there are such servers in Ukraine.<\/p>\n
masscan -pU 53 -iL ukraine.ips -oG ukraine.53.scan && cat ukraine.53.scan | wc -l<\/code><\/pre>\n
\nThe first step is to find those that have an open port 53. As a result, we have a list of 58,730 IP addresses, but that doesn\u2019t mean all of them can be used for DDoS attacks. The second requirement is that they need to be open resolvers.<\/p>\n
\u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u0443\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u0443 dig \u0438 \u0443\u0432\u0438\u0434\u0435\u0442\u044c, \u0447\u0442\u043e \u043c\u044b \u0441\u043c\u043e\u0436\u0435\u043c \u00ab\u043d\u0430\u043a\u043e\u043f\u0430\u0442\u044c\u00bb dig + short test.openresolver.com TXT @ip.of.dns.server. \u0415\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0442\u0432\u0435\u0447\u0430\u043b open-resolver-detected, \u0442\u043e \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u043c \u0430\u0442\u0430\u043a\u0438. Open resolver’\u044b \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 25%, \u0447\u0442\u043e \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0435\u043c\u043e \u0441 \u0410\u0432\u0441\u0442\u0440\u0438\u0435\u0439. \u0421 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043e\u0431\u0449\u0435\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430, \u0442\u043e \u044d\u0442\u043e \u043e\u043a\u043e\u043b\u043e 0,02% \u0432\u0441\u0435\u0445 \u0443\u043a\u0440\u0430\u0438\u043d\u0441\u043a\u0438\u0445 IP.<\/p>\n
What else can be found in Ukraine?<\/h2>\n
\nI'm glad you asked. It\u2019s easier (and most interesting for me personally) to look for IPs with open port 80 and see what's \"running\" on them.<\/p>\n
web servers<\/h3>\n
\n260,849 Ukrainian IPs respond on port 80 (http). 125,444 addresses positively responded (200 status) to a simple GET request that your browser could send. The others returned various errors. Interestingly, 853 servers returned a 500 status, while the rarest statuses were 407 (proxy authentication request) and the absolutely non-standard 602 (IP not in the \"whitelist\") with one response each.<\/p>\n
Apache absolutely dominates \u2014 114,544 servers are using it. The oldest version I found in Ukraine is 1.3.29, released on October 29, 2003 (!!!). nginx is in second place with 61,659 servers.<\/p>\n
11 \u0441\u0435\u0440\u0432\u0435\u0440jev uporablja WinCE, ki je iz\u0161el leta 1996, in so ga nehal popravljati leta 2013 (v Avstriji so jih le 4).<\/p>\n
Protokol HTTP\/2 uporablja 5.144 stre\u017enikov, HTTP\/1.1 \u2013 256.836, HTTP\/1 \u2013 13.491.<\/p>\n
Tiskalniki... ker... zakaj pa ne?<\/h3>\n
\n2 HP, 5 Epson in 4 Canon, ki so dostopni iz omre\u017eja, nekateri brez kakr\u0161ne koli avtentifikacije.<\/p>\n
\"Skeniral
\n <\/p>\n
spletne kamere<\/h3>\n
\nNi novica, da je v Ukrajini ZELENO veliko spletnih kamer, ki se prena\u0161ajo na internet, zbranih na razli\u010dnih virih. Vsaj 75 kamer se prena\u0161a na internet brez kakr\u0161ne koli za\u0161\u010dite. Oglejte si jih lahko ovde<\/a><\/noindex>.<\/p>\n
\"Skeniral
\n <\/p>\n
Kaj zdaj?<\/h2>\n
\nUkrajina je majhna dr\u017eava, prav tako kot Avstrija, vendar se soo\u010da s podobnimi te\u017eavami kot velike dr\u017eave na podro\u010dju IT. Potrebujemo bolj\u0161e razumevanje, kaj je varno, kaj nevarno, in proizvajalci opreme bi morali ponuditi varno za\u010detno konfiguracijo svoje opreme.<\/p>\n
Poleg tega zbiram partnerske podjetja (postanite partner<\/a><\/noindex>), ki vam lahko pomagajo zagotoviti nedotakljivost va\u0161e IT infrastrukture. Naslednji korak nameravam narediti pregled varnosti ukrajinskih spletnih strani. Ne odna\u0161ajte se!
\n
Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e \u0410\u0432\u0441\u0442\u0440\u0438\u044e\u00bb. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043c\u043d\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u044d\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u0443\u0436\u0435 \u0441 \u0423\u043a\u0440\u0430\u0438\u043d\u043e\u0439. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043a\u0440\u0443\u0433\u043b\u043e\u0441\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0435\u0449\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0444\u043e\u0440\u043c\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e, \u0430 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0441\u0435\u0434\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30310","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Skeniral sem Ukrajino | ProHoster","description":"Februarja je Avstrijec Christian Haschek na svojem blogu objavil zanimiv \u010dlanek z naslovom 'Skeniral sem vse.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/ya-proskaniroval-ukrainu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0423\u043a\u0440\u0430\u0438\u043d\u0443 | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e.","og:url":"https:\/\/prohoster.info\/sl\/blog\/ya-proskaniroval-ukrainu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:48+00:00","article:modified_time":"2019-10-31T18:34:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30310","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/30310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=30310"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/30310\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=30310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=30310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=30310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}