analitika dbo

Click here to load reader

Post on 12-Jun-2015

274 views

Category:

Technology

0 download

Embed Size (px)

TRANSCRIPT

  • 1. (20112012), 2013

2. 1. ........................................................................................................................................................................... 3 2. ...................................................................................................................................................................6 3. ................................................................................................................................................... 9 3.1. ..........................................93.2. ............................................................133.3. .................................................................................... .......................................14 3.4. ............................................................................164. ...........................................................................................................18 4.1. ...................................................................................................................194.2. XML (XXE)..................................................................................................204.3. SQL ..............................................................................................................................205. ................................................................................................................21 5.1. ............................................................................................225.2. ......................................................................................236. ...............................................................................................................24 6.1. ..............................................................................................................256.2. .......................................................................256.3. ..................................................................................267. .......................................................................................................................27 7.1. ........................................................................................................................297.2. ............................................................................................297.3. .......................................298. -...................................................................................................... 30 8.1. - , .................................................................................................................................318.2. -..............................................329. ...............................................................................................................................................35 9.1. , ..................................................................................................................................3610. ................................................................................................................38 11. .............................................................................................................................................................39 12. ........................................................................................................................................................................... 402 3. 1 (), 2011 2012 , , Positive Technologies . . , , , . 37% . . , 8% , 51% , 41% . : (Brute Force), 82% . , , : , . - , , , 4 , . - .3 4. , , , . , - . , , , . , . , . 60% . : . . 80% , . , , , .4 5. 2011 2012 Brute Force82% 82%82% 82% 73% % 62% 48% 43% 38% 38% 38% PAN23% 9% 23% 34% 9% 18% 37% 9%1% , , 4 -, . 1,5 , . . 9% 43% , OTP 9% ( ) 6. 2 11 , Positive Technologies 2011 2012 . , . , , - . . 70% , . - , (). 73% 627% 7. 55% , . : Java C# PHP.PHPJava9%27% 9%55%C# , , , , . - . . , , , . . , 1, , .1 , CNews Analytics 2012 . (http://www.cnews.ru/downloads/CNews_DBO_Report_2012.pdf ), , .7 8. , , , , . . , . . 9%27% C 64% , , , , , , , . .8 9. 3 3.1. 8% 51%: 8% C , (51%), 41% (41%). (43%) , (34%), - (23%). 23%43% 34% 1% 9 10. 82% Brute Force82% 73% 62% 48% 43% 38% 38% 38% PAN23% (82%) , (82%). (73%), . - , (64%), (, ). . , , . . 4 . 18.10 11. 70% , , . , , , , . , : , .C , 9% 9% 18% 37% 9% 9% 9% OTP ( )11 12. 100 500 28% 10 50 BANK 500 27% 18%C9%9% 50 100 9% 10 50 , , ( ). , , , , , .12 13. 3.2. (38% 18% ), , (37% 24%). C 44% 37% 18%1% 24% . ( ) ( )13 14. 3.3. , ( ), . , % 50 45 40 35 30 25 20 15 10 5 0 6 5 4 3 2 1 0, , , , . , , , . , .14 15. 10%7%45%60%33%45% , , . . , , . , 7 6 5 4 3 2 1 0, 15 16. 3.4. . % 50 45 40 35 30 25 20 15 10 5 0 , (47% 38% ), (31% 16% ).16 17. 6 5 4 3 2 1 0 , , , . , . , . , , , , . .10% 52%8% 49%43%38% 17 18. . , .8 7 6 5 4 3 2 1 0 , , . , .18 19. 4 , , . , , . XML (XXE)27% SQL18% , 18% 18% 9% 9% 9% , . .4.1. - , . . .19 20. 4.2. XML (XXE) XML , , . , : , XML-. , SMB- HTTP- . , -, . , , . ( ). : , SMS, , .4.3. SQL SQL . , : , SQL. : ; ; ; . . SQL , . , , -, .20 21. 5 60% : ; . , (, ). , (. 6 7) . , , , . , 01234521 22. 5.1. . . , (, , ), , . : , (: 344985127) 27% ;, (: 211113AA, 1231254) 27% . (), (7 ). . , 37% , . , . 18% 18% 9% 9% 9% 28% 9% 22 () . , . . , () 23. , , : 1234567-Tn4, 1234568-h2S. (Brute Force). , , ( qwerty).5.2. , 45% . . , . .HTTP/1.1 200 OK *** 1| . . , 36% : , .23 24. 6 (82%) . , , -. : ; (Brute Force); ., (Brute Force) . , (Brute Force) 024123456 25. 6.1. : : 8 ; (, 111111, P@ssw0rd); , . , , , . , , . , , . ( , %) , Brute Force37% : 6 , Brute Force18% 18% , Brute Force9% , , Brute Force9% , , , Brute Force9%6.2. , , , . , , , . , .25 26. , . Completely Automatic Public Turing test to tell Computers and Humans Apart (CAPTCHA) . . CAPTCHA (Brute Force). , , IP- , , .6.3. . , , . , , . , . , , . , , , , . , , (, XML SQL).26 27. 7 . , . , . . 27% IP- , 18% IP-, . . POST- GET- ( ) , cookie-, , secure HttpOnly, (. . 8). . (one time passwords, OTP). . , 18% , . , , : , , .27 28. ( %) ( )18% 28% , 9% 9% ( )9% 9% 18% , 0281234 29. 7.1. , . , 18% . ( , ). , ( , ). , . , . , . .7.2. . , , . (, ).7.3. . ,