{"id":30167,"date":"2019-10-31T21:33:58","date_gmt":"2019-10-31T18:33:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform\/"},"modified":"2019-10-31T21:33:58","modified_gmt":"2019-10-31T18:33:58","slug":"razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","title":{"rendered":"Analys av ett kritiskt fel i algoritmen f\u00f6r kryptering av KIB SEARCHINFORM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00d6vervakning av all information som cirkulerar inom organisationen \u00e4r en av huvuduppgifterna vid praktisk implementering av organisatoriska och styrande dokument (Informationss\u00e4kerhetspolicy och andra interna dokument p\u00e5 l\u00e4gre niv\u00e5er) i organisationen.
\nSystem f\u00f6r att f\u00f6rhindra l\u00e4ckage av konfidentiell information fr\u00e5n informationssystemet (Data Leak Prevention, DLP) kan i stor utstr\u00e4ckning l\u00f6sa detta problem.
\n<\/a><\/noindex>
\nDet finns tillr\u00e4ckligt med varianter av dessa system p\u00e5 den moderna marknaden, s\u00e5som: SearchInform DLP, Infowatch Traffic Monitor DLP, Zecurion DLP, Symantec DLP och andra. Men idag kommer denna artikel att handla om produkten fr\u00e5n f\u00f6retaget LLC \"S\u00f6rchInform\".<\/p>\n

Informationss\u00e4kerhetsramverket SearchInform (KIB S\u00f6rchInform) \u00e4r en seri\u00f6s och flexibelt anpassningsbar programvara som, tack vare sin funktionalitet och omfattande analytiska verktyg, utg\u00f6r en allvarlig konkurrens till andra f\u00f6retag i denna sektor. Men som med alla produkter har KIB S\u00f6rchInform en av nackdelarna, som nu kommer att diskuteras.<\/p>\n

\"Analys
\n
\nBild 1 \u2013 Logotyp f\u00f6r KIB S\u00f6rchInform<\/i><\/p>\n

I KIB S\u00f6rchInform \u00e4r en av k\u00e4llorna f\u00f6r informationsinsamling agenten (Windows\/Linux). Agenten f\u00f6r Windows och Linux har ett modul\u00e4rt system f\u00f6r informationsinsamling, d\u00e4r moduler kan aktiveras eller deaktiveras vid behov. Vi kommer att titta p\u00e5 modulen Device (\u00f6vervakning av externa enheter, n\u00e4tverksenheter, processer etc.). En demoversion av denna produkt kan officiellt erh\u00e5llas via utvecklarens webbplats (med fullst\u00e4ndig funktionalitet). De f\u00f6ljande \u00e5tg\u00e4rderna kommer att genomf\u00f6ras med hj\u00e4lp av den erh\u00e5llna licensnyckeln \u2014 programversionen EndPointController 5.51.0.9 (agentversion 5.51.0.9).<\/p>\n

Det st\u00f6rsta problemet med detta modul \u00e4r algoritmen f\u00f6r kryptering av information p\u00e5 externa b\u00e4rbara enheter. L\u00e5t oss granska arbetsprincipen f\u00f6r krypteringsalgoritmen i KIB S\u00f6rchInform.<\/p>\n

Installera agenten p\u00e5 arbetsstationen och st\u00e4ller in \u00f6vervakningen av externa enheter (modul Device) i avsnittet \"N\u00e4tverksmilj\u00f6\" i EndPointController 5.51.0.9.<\/p>\n

\"Analys
\nBild 2 \u2013 Installation och aktivering av modulen<\/i><\/p>\n

Vi konfigurerar krypteringsinst\u00e4llningarna i modulen Device under fliken \"Kryptering\": vi genererar en nyckel och aktiverar kryptering f\u00f6r alla enheter (det \u00e4r m\u00f6jligt att aktivera kryptering endast f\u00f6r vissa informationsb\u00e4rare).<\/p>\n

\"Analys
\nBild 3 \u2013 Inst\u00e4llning av vitlista<\/i><\/p>\n

\"Analys
\nBild 4 \u2013 Konfiguration av kryptering<\/i><\/p>\n

Nu g\u00e5r vi vidare med att analysera krypteringsalgoritmen f\u00f6r denna produkt. Vi kopierar filerna \"Install.exe\" och \"Grundl\u00e4ggande r\u00e4tt.rtf\" fr\u00e5n den kontrollerade arbetsstationen \"WINOC\" till det externa flyttbara lagringsmediet \"Flyttbar disk (E:)\". Som kan ses p\u00e5 bild 5 skapades objekten \"Install.exe\" och \"Grundl\u00e4ggande r\u00e4tt.rtf\" i den dolda mappen \"System Volume Information\". D\u00e4rmed kan vi dra slutsatsen att mappen \"System Volume Information\" inneh\u00e5ller en lista \u00f6ver krypterade objekt p\u00e5 det flyttbara lagringsmediet.<\/p>\n

\"Analys
\nBild 5 \u2013 mappen \"System Volume Information\"<\/i><\/p>\n

\"Analys
\nBild 6 \u2013 Rotmappen av det flyttbara informationslagringsmediet<\/i><\/p>\n

Som bekant finns det tre aspekter som bygger upp informationss\u00e4kerheten \u2013 dessa \u00e4r integritet, tillg\u00e4nglighet och konfidentialitet. Dessa aspekter \u00e4ventyras med anv\u00e4ndning av detta krypteringsmetod, eftersom systeminformation om huruvida ett objekt \u00e4r krypterat eller inte m\u00e5ste finnas i sj\u00e4lva objektets header. <\/p>\n

Vid den nuvarande uppbyggnaden av algoritmen finns det risker f\u00f6r slumpm\u00e4ssig modifiering\/borttagning av objekt i mappen \"System Volume Information\" p\u00e5 det flyttbara lagringsmediet, vilket kan leda till att de ursprungliga krypterade objekten g\u00e5r f\u00f6rlorade, liksom modifiering av sj\u00e4lva objekten p\u00e5 okontrollerade stationer (till exempel: omd\u00f6pning av objektet \"Install.exe\" med den n\u00e4tverksv\u00e4gen \"E:Install.exe\" p\u00e5 en dator utan agent, medan informationsfilen fr\u00e5n programvaran KIB SearchInform i mappen \"System Volume Information\" \"Install.exe\" med n\u00e4tverksv\u00e4gen \"E:System Volume InformationInstall.exe\" f\u00f6rblir of\u00f6r\u00e4ndrad, eftersom agenten som skulle \u00e4ndra metadata saknas, vilket g\u00f6r att \u00f6ppenheten av denna fil blir om\u00f6jlig).<\/p>\n

Vi hoppas att utvecklaren tar h\u00e4nsyn till denna brist i funktionen f\u00f6r kryptering av flyttbara informationslagringsmedier i produkten KIB SearchInform och \u00e4ndrar dess algoritm.
\n
K\u00e4lla: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0432\u0441\u0435\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 \u043f\u0440\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u043e-\u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u043d\u0438\u0436\u043d\u0438\u0445 \u0443\u0440\u043e\u0432\u043d\u0435\u0439) \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0421\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0443\u0442\u0435\u0447\u0435\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u0437 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (Data Leak Prevention, DLP) \u0432 \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u041d\u0430 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u0440\u044b\u043d\u043a\u0435 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0435\u0439 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a: […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30167","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Analys av kritiskt fel i krypteringsalgoritmen f\u00f6r KIB SEARCHINFORM | ProHoster","description":"\u00d6vervakning av all information som cirkulerar inom organisationen \u00e4r en av de viktigaste uppgifterna vid praktisk genomf\u00f6rande av organisatoriska och administrativa dokument (informationss\u00e4kerhetspolitik och andra interna).","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u043e\u0440 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u041a\u0418\u0411 SEARCHINFORM | ProHoster","og:description":"\u041a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0432\u0441\u0435\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 \u043f\u0440\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u043e-\u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0438\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435.","og:url":"https:\/\/prohoster.info\/sv\/blog\/razbor-kriticheskoj-oshibki-v-algoritme-raboty-shifrovaniya-kib-searchinform","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:33:58+00:00","article:modified_time":"2019-10-31T18:33:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30167","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 23:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:40:41","updated":"2026-01-20 23:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/30167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=30167"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/30167\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=30167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=30167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=30167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}