Haisi chakavanzika kuti kutonga kwekuvhara pane runyorwa rwemashoko akarambidzwa muRussia anotariswa neautomated system "Inspector". Kuti inoshanda sei yakanyorwa zvakanaka pano mune izvi , mufananidzo kubva panzvimbo imwe chete:
Yakaiswa zvakananga kune mupi :
Iyo "Agent Inspector" module chinhu chechimiro che automated system "Inspector" (AS "Inspector"). Iyi sisitimu yakagadzirirwa kutarisisa kuteedzera kwevashandisi venhare vane zvinorambidzwa kupinda mukati megadziriro yezviga zvakatemwa neChinyorwa 15.1-15.4 cheFederal Law yaChikunguru 27, 2006 No. 149-FZ "PaRuzivo, Ruzivo Tekinoroji uye Dziviriro Yeruzivo. β
Chinangwa chikuru chekugadzira AS βRevizorβ ndechekuona kuti kutevedzerwa kwevafambisi venhare nezvinodiwa zvakatemwa neChinyorwa 15.1-15.4 cheFederal Law yaChikunguru 27, 2006 No. 149-FZ βPaRuzivo, Ruzivo Tekinoroji uye Ruzivo. Dziviriro" maererano nekuona chokwadi chekuwana ruzivo rwakarambidzwa uye kuwana zvinhu zvinotsigira (data) nezvekutyorwa kwekudzivirira kuwana ruzivo rwakarambidzwa.
Tichifunga nezve chokwadi chekuti, kana zvisiri zvese, saka vazhinji vanopa vakaisa ichi chishandiso, panofanira kunge paine network yakakura yemabeacon probes senge. uye zvakatowanda, asi nekupinda kwakavharwa. Zvisinei, beacon ibhenekeri yekutumira masaini kumativi ese, asi ko tikaabata toona zvatakabata uye zvingani?
Tisati taverenga, ngationei kuti sei izvi zvingave zvichibvira.
Chimwe chezvinyorwa
Vashandi vanotarisa kuwanikwa kwechishandiso, kusanganisira kuburikidza neHTTP(S) zvikumbiro, senge ichi:
TCP, 14678 > 80, "[SYN] Seq=0"
TCP, 80 > 14678, "[SYN, ACK] Seq=0 Ack=1"
TCP, 14678 > 80, "[ACK] Seq=1 Ack=1"
HTTP, "GET /somepage HTTP/1.1"
TCP, 80 > 14678, "[ACK] Seq=1 Ack=71"
HTTP, "HTTP/1.1 302 Found"
TCP, 14678 > 80, "[FIN, ACK] Seq=71 Ack=479"
TCP, 80 > 14678, "[FIN, ACK] Seq=479 Ack=72"
TCP, 14678 > 80, "[ACK] Seq=72 Ack=480"
Pamusoro pemubhadharo, chikumbiro chinewo chikamu chekubatanidza chekubatanidza: kuchinjana SYN ΠΈ SYN-ACK, uye zvikamu zvekupedzisa kwekubatanidza: FIN-ACK.
Rejista yeruzivo rwakarambidzwa ine akati wandei marudzi ekuvharira. Zviripachena, kana sosi yakavharwa neIP kero kana zita rezita, saka isu hatizooni chero zvikumbiro. Aya ndiwo marudzi anoparadza zvakanyanya ekuvharira, izvo zvinotungamira mukusasvika kwese zviwanikwa pane imwe IP kero kana ruzivo rwese pane domain. Kune zvakare "ne URL" rudzi rwekuvhara. Muchiitiko ichi, iyo yekusefa system inofanirwa kupatsanura iyo HTTP yekukumbira musoro kuti uone chaizvo zvekuvharisa. Uye pamberi payo, sezvazvinoonekwa pamusoro, panofanirwa kuve nechikamu chekumisikidza chaunogona kuedza kutevedzera, sezvo kazhinji sefa ichachipotsa.
Kuti uite izvi, iwe unofanirwa kusarudza yakakodzera yemahara domain ine "URL" uye HTTP yekuvharira mhando kufambisa basa resefa system, zviri nani yakasiiwa kwenguva refu, kudzikisa kupinda kwetraneous traffic kunze kwekubva kuAgents. Iri basa rakazove risiri rakaoma zvachose; kune akawanda emahara madomasi murejista yeruzivo rwakarambidzwa uye nekuravira kwese. Naizvozvo, iyo domain yakatengwa uye yakabatanidzwa kune IP kero paVPS inomhanya tcpdump uye kuverengwa kwakatanga.
Kuongororwa kwe "Auditors"
Ndaitarisira kuona kuputika kwezvikumbiro nguva nenguva, izvo mumaonero angu zvaizoratidza chiito chinodzorwa. Hazvibviri kutaura kuti handina kuzviona zvachose, asi pakanga pasina mufananidzo wakajeka:
Izvo hazvishamisi, kunyange pane imwe nzvimbo iyo isingadiwi nemunhu uye pane isina kumboshandiswa IP, pachava nekungove netani yemashoko asina kukumbirwa, akadai seInternet yemazuva ano. Asi nerombo rakanaka, ini ndaingoda zvikumbiro zveiyo URL chaiyo, saka ese ma scanner uye password crackers zvakakurumidza kuwanikwa. Zvakare, zvaive nyore kunzwisisa kuti mafashama aive papi kubva pahuwandu hwezvikumbiro zvakafanana. Tevere, ndakanyora kuwanda kwekuitika kwekero dzeIP uye ndakapfuura nepamusoro pese pamaoko, ndichiparadzanisa avo vakapotsa pamatanho apfuura. Pamusoro pezvo, ndakacheka ese masosi akatumirwa mupakeji imwe, pakanga pasisina akawanda awo zvakare. Uye izvi ndizvo zvakaitika:
Kadimburiko kerimbo. Kwasara chinguva chinopfuura zuva rimwe chete, mupi wangu wekutambira akatumira tsamba ine zvirimo zvakanyoroveswa, achiti zvivakwa zvako zvine sosi kubva kuRKN yakarambidzwa runyorwa, saka yakavharwa. Pakutanga ndakafunga kuti account yangu yakavharwa, izvi handizvo. Ndakabva ndafunga kuti vaingondinyevera nezvechimwe chinhu chandaitoziva. Asi zvakazoitika kuti mugadziri akavhura sefa yake pamberi penzvimbo yangu uye nekudaro ndakauya pasi pekusefa kaviri: kubva kune vanopa uye kubva kune hoster. Sefa yakangopfuura magumo ezvikumbiro: FIN-ACK ΠΈ RST kucheka HTTP yese pane yakarambidzwa URL. Sezvauri kuona kubva pagirafu iri pamusoro, mushure mezuva rekutanga ndakatanga kugamuchira data shoma, asi ini ndichiri kuigamuchira, iyo yaive yakakwana pabasa rekuverenga zvinyorwa zvekukumbira.
Svika papfungwa. Mukuona kwangu, kuputika kuviri kunonyatsooneka zuva rega rega, yekutanga kudiki, mushure meusiku pakati peMoscow nguva, yechipiri padyo ne6 am nemuswe kusvika 12 masikati. Peak haisi kuitika panguva imwe chete. Pakutanga, ndaida kusarudza kero dzeIP dzakadonha chete munguva idzi uye imwe neimwe munguva dzese, zvichibva pafungidziro yekuti macheki nemaAgents anoitwa nguva nenguva. Asi pakunyatsoongorora, ndakakurumidza kuona nguva dzichiwira mune dzimwe nguva, nemamwe mafrequency, kusvika pachikumbiro chimwe awa yega. Ipapo ndakafunga nezvenzvimbo dzenguva uye kuti pamwe yaive nechekuita navo, ndakabva ndafunga kuti kazhinji hurongwa hwaigona kunge husina kuwiriraniswa pasi rose. Pamusoro pezvo, NAT ingangoita basa uye Mumiriri mumwe chete anogona kuita zvikumbiro kubva kune akasiyana veruzhinji IPs.
Sezvo chinangwa changu chekutanga chaive chisiri chaicho, ndakaverenga kero dzese dzandakawana musvondo ndikawana - 2791. Nhamba yezvikamu zveTCP zvakasimbiswa kubva kune imwe kero iri paavhareji 4, nepakati pe 2. Zvikamu zvepamusoro pakero: 464, 231, 149, 83, 77. Iyo yakawanda kubva ku95% yemuenzaniso ndeye 8 zvikamu pakero. Iyo yepakati haina kunyanya kukwirira, rega ndikuyeuchidze kuti girafu inoratidza yakajeka zuva nezuva periodicity, saka munhu anogona kutarisira chimwe chinhu chakapoteredza 4 kusvika 8 mumazuva 7. Kana tikakandira kunze masangano ose anoitika kamwe chete, tichawana chiyero chepakati chakaenzana ne5. Asi ini handina kukwanisa kuvabvisa zvichienderana nechiyero chakajeka. Kusiyana neizvi, cheki isina kurongeka yakaratidza kuti yaienderana nezvikumbiro zvechinhu chinorambidzwa.
Kero ikero, asi paInternet, kuzvitonga masisitimu - AS, izvo zvakazonyanya kukosha 1510, paavhareji 2 kero pa AS ine pakati pe 1. Makero epamusoro pa AS: 288, 77, 66, 39, 27. Iyo yakawanda ye95% yemuenzaniso ndeye 4 kero pa AS. Pano iyo yepakati inotarisirwa - mumiriri mumwechete pamupi. Isu tinotarisirawo pamusoro - kune vatambi vakuru mairi. Mune network yakakura, maAgent anofanirwa kunge ari munharaunda yega yega yekuvapo kweanoshanda, uye usakanganwa nezveNAT. Kana tikaitora nenyika, iyo maximums ichave: 1409 - RU, 42 - UA, 23 - CZ, 36 kubva kune mamwe matunhu, kwete RIPE NCC. Zvikumbiro kubva kunze kweRussia zvinokwezva kutarisa. Izvi zvinogona kutsanangurwa nezvikanganiso zve geolocation kana registrar zvikanganiso kana uchizadza data. Kana chokwadi chokuti kambani yeRussia inogona kunge isina midzi yeRussia, kana kuva nehofisi yevamiririri vekunze nokuti iri nyore, iyo inowanzoitika kana ichiita nesangano rekunze RIPE NCC. Chimwe chikamu pasina mubvunzo chakanyanya kuwanda, asi chakanyanya kuoma kuchiparadzanisa, sezvo sosi iri pasi pekuvharika, uye kubva pazuva rechipiri pasi pekuvhara kaviri, uye mazhinji masesheni ingori kuchinjana kwemapaketi akati wandei. Ngatibvumirane kuti ichi chikamu chiduku.
Nhamba idzi dzinogona kutoenzaniswa nehuwandu hwevanopa muRussia. marezinesi e "Masevhisi ekufambiswa kwedata, kusasanganisa izwi" - 6387, asi iyi fungidziro yakanyanya kubva kumusoro, haasi ese emarezinesi aya anoshanda zvakananga kune vanopa Internet vanoda kuisa Agent. Munharaunda yeRIPE NCC kune nhamba yakafanana yeASes yakanyoreswa muRussia - 6230, iyo isiri iyo yose inopa. uye yakagamuchira makambani 3940 muna 2017, uye iyi ifungidziro kubva kumusoro. Chero zvazvingaitika, isu tine kaviri nehafu yakapetwa zvishoma nhamba yeakavhenekerwa ASs. Asi pano zvakakosha kunzwisisa kuti AS haina kunyatso kuenzana nemupi. Vamwe vanopa havana yavo AS, vamwe vane anopfuura mumwe. Kana isu tichifunga kuti munhu wese achine maAgents, saka mumwe munhu anosefa zvine simba kupfuura vamwe, kuitira kuti zvikumbiro zvavo zvisasiyane nemarara, kana zvikasvika kwavari zvachose. Asi pakuongorora kwakashata zvinoshiviririka, kunyangwe kana chimwe chinhu chakarasika nekuda kwekutarisa kwangu.
Nezve DPI
Kunyangwe chokwadi chekuti mupi wangu wekugamuchira akavhura sefa yayo kutanga kubva pazuva rechipiri, zvichibva paruzivo kubva pazuva rekutanga tinogona kugumisa kuti kuvharira kuri kushanda zvinobudirira. Chete mana masosi akakwanisa kupfuura uye akapedza zvachose HTTP uye TCP zvikamu (semumuenzaniso uri pamusoro). Imwe 4 inogona kutumirwa GET, asi chikamu chinobva chagumiswa ne RST. Chenjerera TTL:
TTL 50, TCP, 14678 > 80, "[SYN] Seq=0"
TTL 64, TCP, 80 > 14678, "[SYN, ACK] Seq=0 Ack=1"
TTL 50, TCP, 14678 > 80, "[ACK] Seq=1 Ack=1"
HTTP, "GET /filteredpage HTTP/1.1"
TTL 64, TCP, 80 > 14678, "[ACK] Seq=1 Ack=294"
#ΠΠΎΡ ΡΡΠΎ ΠΏΡΠΈΡΠ»Π°Π» ΡΠΈΠ»ΡΡΡ
TTL 53, TCP, 14678 > 80, "[RST] Seq=3458729893"
TTL 53, TCP, 14678 > 80, "[RST] Seq=3458729893"
HTTP, "HTTP/1.1 302 Found"
#Π ΡΡΠΎ ΠΏΠΎΠΏΡΡΠΊΠ° ΠΈΡΡ
ΠΎΠ΄Π½ΠΎΠ³ΠΎ ΡΠ·Π»Π° ΠΏΠΎΠ»ΡΡΠΈΡΡ ΠΏΠΎΡΠ΅ΡΡ
TTL 50, TCP ACKed unseen segment, 14678 > 80, "[ACK] Seq=294 Ack=145"
TTL 50, TCP, 14678 > 80, "[FIN, ACK] Seq=294 Ack=145"
TTL 64, TCP, 80 > 14678, "[FIN, ACK] Seq=171 Ack=295"
TTL 50, TCP Dup ACK 14678 > 80 "[ACK] Seq=295 Ack=145"
#ΠΡΡ
ΠΎΠ΄Π½ΡΠΉ ΡΠ·Π΅Π» ΠΏΠΎΠ½ΠΈΠΌΠ°Π΅Ρ ΡΡΠΎ ΡΠ΅ΡΡΠΈΡ ΡΠ°Π·ΡΡΡΠ΅Π½Π°
TTL 50, TCP, 14678 > 80, "[RST] Seq=294"
TTL 50, TCP, 14678 > 80, "[RST] Seq=295"
Kusiyana kweizvi kunogona kunge kwakasiyana: zvishoma RST kana zvimwe zvinodzosera - zvakare zvinoenderana nekuti iyo sefa inotumira kune sosi node. Chero zvazvingaitika, iyi ndiyo yakavimbika template, kubva kwazviri pachena kuti yaive sosi yakarambidzwa yakakumbirwa. Uyezve pane nguva dzose mhinduro inoonekwa muchirongwa ne TTL yakakura kupfuura mumapakeji apfuura uye anotevera.
Iwe haugone kana kuzviona kubva kune vamwe GET:
TTL 50, TCP, 14678 > 80, "[SYN] Seq=0"
TTL 64, TCP, 80 > 14678, "[SYN, ACK] Seq=0 Ack=1"
#ΠΠΎΡ ΡΡΠΎ ΠΏΡΠΈΡΠ»Π°Π» ΡΠΈΠ»ΡΡΡ
TTL 53, TCP, 14678 > 80, "[RST] Seq=1"
Kana zvakadaro:
TTL 50, TCP, 14678 > 80, "[SYN] Seq=0"
TTL 64, TCP, 80 > 14678, "[SYN, ACK] Seq=0 Ack=1"
TTL 50, TCP, 14678 > 80, "[ACK] Seq=1 Ack=1"
#ΠΠΎΡ ΡΡΠΎ ΠΏΡΠΈΡΠ»Π°Π» ΡΠΈΠ»ΡΡΡ
TTL 53, TCP, 14678 > 80, "[RST, PSH] Seq=1"
TTL 50, TCP ACKed unseen segment, 14678 > 80, "[FIN, ACK] Seq=89 Ack=172"
TTL 50, TCP ACKed unseen segment, 14678 > 80, "[FIN, ACK] Seq=89 Ack=172"
#ΠΠΏΡΡΡ ΡΠΈΠ»ΡΡΡ, ΠΌΠ½ΠΎΠ³ΠΎ ΡΠ°Π·
TTL 53, TCP, 14678 > 80, "[RST, PSH] Seq=1"
...
Musiyano unonyatso kuoneka TTL kana chimwe chinhu chichibva pasefa. Asi kazhinji hapana chinogona kusvika zvachose:
TCP, 14678 > 80, "[SYN] Seq=0"
TCP, 80 > 14678, "[SYN, ACK] Seq=0 Ack=1"
TCP Retransmission, 80 > 14678, "[SYN, ACK] Seq=0 Ack=1"
...
Kana zvakadaro:
TCP, 14678 > 80, "[SYN] Seq=0"
TCP, 80 > 14678, "[SYN, ACK] Seq=0 Ack=1"
TCP, 14678 > 80, "[ACK] Seq=1 Ack=1"
#ΠΡΠΎΡΠ»ΠΎ Π½Π΅ΡΠΊΠΎΠ»ΡΠΊΠΎ ΡΠ΅ΠΊΡΠ½Π΄ Π±Π΅Π· ΡΡΠ°ΡΠΈΠΊΠ°
TCP, 80 > 14678, "[FIN, ACK] Seq=1 Ack=1"
TCP Retransmission, 80 > 14678, "[FIN, ACK] Seq=1 Ack=1"
...
Uye izvi zvose zvinodzokororwa uye zvinodzokororwa uye zvinodzokororwa, sezvinogona kuonekwa pagirafu, kanopfuura kamwe chete, zuva rega rega.
Nezve IPv6
Chinofadza ndechekuti chiriko. Ndinogona kutaura nekuvimbika kuti zvikumbiro zvenguva nenguva kune inorambidzwa sosi inoitika kubva ku5 akasiyana IPv6 kero, ndiwo chaiwo maitiro eAgents andaitarisira. Uyezve, imwe yeIPv6 kero haiwire pasi pekusefa uye ini ndinoona chikamu chizere. Kubva pamamwe maviri ndakaona chikamu chimwe chete chisina kupera, chimwe chaive chavhiringwa RST kubva pasefa, yechipiri munguva. Mari yese 7.
Sezvo pane maakero mashoma, ndakadzidza ese zvakadzama uye zvakazoitika kuti kune 3 vanopa chete ipapo, vanogona kupihwa yakamira! Imwe kero ndeye cloud hosting muRussia (haisi sefa), imwe inzvimbo yekutsvagisa muGermany (pane sefa, kupi?). Asi nei vachitarisa kuwanikwa kwezvinhu zvinorambidzwa pane purogiramu mubvunzo wakanaka. Vaviri vakasara vakaita chikumbiro chimwe uye vari kunze kweRussia, uye imwe yacho inosefa (mukufamba, shure kwezvose?).
Kuvharira uye maAgents imhinganidzo huru kune IPv6, iko kuita kwayo kusiri kufamba nekukurumidza. Zvinosuwisa. Avo vakagadzirisa dambudziko iri vanogona kudada zvizere ivo pachavo.
Mukupedzisa
Ini handina kushingairira 100% chokwadi, ndapota ndiregerereiwo nekuda kweizvi, ndinovimba mumwe munhu anoda kudzokorora basa iri nekururama kukuru. Zvaive zvakakosha kuti ndinzwisise kana nzira iyi yaizoshanda mumusimboti. Mhinduro ndihongu. Iwo akawanikwa manhamba, seyekutanga fungidziro, ndinofunga, akavimbika.
Chii chimwe chingave chakaitwa uye chandakanga ndine usimbe kuita kuverenga zvikumbiro zveDNS. Izvo hazvina kusefa, asi zvakare hazvipi kurongeka kwakanyanya sezvo ivo vachingoshandira iyo domain, uye kwete yeiyo URL yese. Iyo frequency inofanira kuoneka. Kana iwe ukazvibatanidza nezvinooneka zvakananga mumibvunzo, izvi zvinokutendera kuti uparadzanise zvisiri izvo uye uwane rumwe ruzivo. Izvo zvinotogoneka kuona vanogadzira iyo DNS inoshandiswa nevanopa uye nezvimwe zvakawanda.
Ini ndakanga ndisingatarisiri kuti iyo hoster yaizosanganisira yayo sefa yeVPS yangu. Zvichida izvi zvinowanzoitika. Pakupedzisira, RKN inotumira chikumbiro chekudzima sosi kune hoster. Asi izvi hazvina kundishamisa uye mune dzimwe nzira zvakatoshanda zvakandinakira. Iyo sefa yakashanda zvine mutsindo, ichicheka zvese zvakaringana zvikumbiro zveHTTP kune yakarambidzwa URL, asi zvisiri izvo izvo zvakambopfuura nepasefa yevanopa zvakasvika kwavari, kunyangwe muchimiro chemagumo: FIN-ACK ΠΈ RST - minus ye minus uye yakatozoita yekuwedzera. Nenzira, IPv6 haina kusefa nemuiti. Ehe, izvi zvakakanganisa kunaka kwezvinhu zvakaunganidzwa, asi zvakadaro zvakaita kuti zvikwanise kuona kuwanda. Zvakazoitika kuti ichi chinhu chakakosha pakusarudza saiti yekuisa zviwanikwa; usakanganwa kufarira nyaya yekuronga basa nerunyorwa rwenzvimbo dzakarambidzwa uye zvikumbiro kubva kuRKN.
Pakutanga, ndakaenzanisa AS "Inspector" nayo . Kuenzanisa uku kwakanyatso kurongeka uye network yakakura yeAgents inogona kubatsira. Semuyenzaniso, kuona mhando yekuwanikwa kwezviwanikwa kubva kune vakasiyana vanopa munzvimbo dzakasiyana dzenyika. Iwe unogona kuverenga kunonoka, unogona kuvaka magirafu, unogona kuongorora zvese uye kuona shanduko dziri kuitika munharaunda uye pasi rose. Iyi haisi iyo nzira yakananga, asi vazivi venyeredzi vanoshandisa "makenduru akajairika", wadii kushandisa Agents? Kuziva (wawana) maitiro avo akajairwa, unogona kuona shanduko dzinoitika pavari uye kuti izvi zvinokanganisa sei kunaka kwesevhisi inopihwa. Uye panguva imwecheteyo, haufanire kuzvimiririra kuisa probes pane network; Roskomnadzor yakatodziisa.
Imwe pfungwa yandinoda kubata pairi ndeyekuti mudziyo wese unogona kuva chombo. AS "Inspector" itiweki yakavharwa, asi maAgents anopa munhu wese nekutumira zvikumbiro zvezvese zviwanikwa kubva pane zvakarambidzwa runyorwa. Kuva nechinhu chakadaro hachipi matambudziko zvachose. Pakazara, vanopa kuburikidza neAgents, vasingazive, vanotaura zvakawanda nezve network yavo pane zvingangove zvakakosha: DPI neDNS marudzi, nzvimbo yeAgent (central node uye service network?), network mamaki ekunonoka uye kurasikirwa - uye izvi ndizvo chete zviri pachena. Sezvo mumwe munhu anogona kutarisa zviito zveAgents kuvandudza kuwanikwa kwezviwanikwa zvavo, mumwe munhu anogona kuita izvi kune zvimwe zvinangwa uye hapana zvipingamupinyi kune izvi. Mhedzisiro yacho chiridzwa chine mativi maviri uye chakawanda kwazvo, chero munhu anogona kuona izvi.
Source: www.habr.com