{"id":58,"date":"2018-09-08T12:29:57","date_gmt":"2018-09-08T11:29:57","guid":{"rendered":"https:\/\/www.tomatom.cz\/blog\/?p=58"},"modified":"2018-09-08T12:31:41","modified_gmt":"2018-09-08T11:31:41","slug":"jak-hacknout-ucet-vodafone","status":"publish","type":"post","link":"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone","title":{"rendered":"Jak hacknout \u00fa\u010det u Vodafone? Bohu\u017eel velmi snadno."},"content":{"rendered":"

D\u00e9le ne\u017e p\u016fl roku upozor\u0148uji Vodafone na to, \u017ee vystavuj\u00ed sv\u00e9 z\u00e1kazn\u00edky velk\u00e9mu riziku phishingu. Po celou dobu (poka\u017ed\u00e9, kdy\u017e mi zavolaj\u00ed) se prakticky nem\u016f\u017eeme dohodnout na tom, abychom se spole\u010dn\u011b dostali do na\u0161eho firemn\u00edho z\u00e1kaznick\u00e9ho \u00fa\u010dtu. D\u016fvod je prost\u00fd – nebudu d\u00e1vat sv\u00e9 heslo n\u011bkomu na druh\u00e9 stran\u011b telefonu, koho nezn\u00e1m a vol\u00e1 z b\u011b\u017en\u00e9ho \u010d\u00edsla. Oper\u00e1tor na druh\u00e9 stran\u011b telefonu m\u011b nedok\u00e1\u017ee spolehliv\u011b p\u0159esv\u011bd\u010dit o tom, \u017ee je skute\u010dn\u011b z Vodafonu. Bohu\u017eel v\u011bt\u0161ina lid\u00ed tak opatrn\u00e1 nen\u00ed, jinak by u\u017e d\u00e1vno m\u011bli jin\u00fd zp\u016fsob ov\u011b\u0159ov\u00e1n\u00ed.<\/p>\n

Kontaktoval jsem n\u011bkolikr\u00e1t Vodafone s t\u00edm, jak\u00e1 vid\u00edm v jejich komunikaci rizika, ale bez reakce a n\u00e1pravy. T\u0159eba to zm\u011bn\u00ed tento \u010dl\u00e1nek.<\/p>\n

<\/p>\n

Jak vlastn\u011b hovor od Vodafone prob\u00edh\u00e1?<\/h3>\n

Zavol\u00e1 v\u00e1m oper\u00e1tor z \u010d\u00edsla za\u010d\u00ednaj\u00edc\u00ed 581 (ano, ani to nen\u00ed n\u011bjak\u00e9 premiov\u00e9 \u010d\u00edslo jako dev\u011bt sedmi\u010dek), p\u0159edstav\u00ed se jako Vodafone p\u00e1\u010de o z\u00e1kazn\u00edky a informuje v\u00e1s, \u017ee by s v\u00e1mi r\u00e1d pro\u0161el novinky v tarifech, atp. Standardn\u011b informuje o monitorovan\u00e9m hovoru. Pokud souhlas\u00edte, informuje v\u00e1s o tom, \u017ee aby se dostal do va\u0161eho \u00fa\u010dtu, bude pot\u0159ebovat dv\u011b n\u00e1hodn\u00e9 pozice z PINu. A zde nast\u00e1v\u00e1 probl\u00e9m. Pr\u00e1v\u011b d\u00edky tomuto postupu lze prakticky za 3 minuty hacknout n\u011b\u010d\u00ed z\u00e1kaznick\u00fd \u00fa\u010det.<\/p>\n

V \u010dem je probl\u00e9m, aneb jak hacknout Vodafone \u00fa\u010det?<\/h3>\n

Naprosto b\u011b\u017en\u00fdm phishingem, jen v offline re\u017eimu. Koup\u00edte si jednor\u00e1zovou SIMku a zavol\u00e1te na \u010d\u00edslo, kter\u00e9 chcete hacknout. Jak m\u016f\u017ee takov\u00fd hovor prob\u00edhat?<\/p>\n

Oper\u00e1tor: Dobr\u00fd den, Jan Nov\u00e1k z Vodafone p\u00e9\u010de o z\u00e1kazn\u00edky. M\u016f\u017eeme se pros\u00edm spole\u010dn\u011b pod\u00edvat na nastaven\u00ed Va\u0161ich tarif\u016f a optimalizovat tak Va\u0161e n\u00e1klady? M\u00e1me nov\u00e9 tarify, kter\u00e9 by se V\u00e1m mohly l\u00edbit.
\n<\/em>Klient: Ano, m\u016f\u017eeme.
\n<\/em>Oper\u00e1tor: Dovol\u00edm si V\u00e1s upozornit, \u017ee hovor m\u016f\u017ee b\u00fdt monitorovan\u00fd. Souhlas\u00edte?
\n<\/em>Klient: Ano
\n<\/em>Oper\u00e1tor: D\u011bkuji. Abych se mohl p\u0159ihl\u00e1sit do Va\u0161eho z\u00e1kaznick\u00e9ho \u00fa\u010dtu, budu pot\u0159ebovat dv\u011b pozice z Va\u0161eho a\u017e 6ti m\u00edstn\u00e9ho PINu. Syst\u00e9m mi nyn\u00ed losuje n\u00e1hodn\u00e9 pozice. Pros\u00edm o strpen\u00ed.
\n<\/em>Oper\u00e1tor: M\u00e1me vylosov\u00e1no, pros\u00edm V\u00e1s o 1 a 3. pozici
\n<\/em>Klient: 6 a 5
\n<\/em>Oper\u00e1tor: D\u011bkuji, pros\u00edm o chvilku strpen\u00ed.
\n<\/em>Oper\u00e1tor: Bohu\u017eel, syst\u00e9m mi tato \u010d\u00edsla odm\u00edtl. Jste si jist\u00fd, \u017ee m\u00e1te k dispozici spr\u00e1vn\u00fd PIN?
\n<\/em>Klient: Ano
\n<\/em>Oper\u00e1tor: Zkus\u00edme to je\u0161t\u011b jednou, syst\u00e9m n\u00e1m nyn\u00ed vylosuje znovu n\u00e1hodn\u00e9 pozice. Pros\u00edm o strpen\u00ed.
\n<\/em>Oper\u00e1tor: M\u00e1me vylosov\u00e1no, pros\u00edm V\u00e1s o 2 a 4. pozici
\n<\/em>Klient: 1 a 4
\n<\/em>Oper\u00e1tor: D\u011bkuji, pros\u00edm o chvilku strpen\u00ed.
\n<\/em>Oper\u00e1tor: Bohu\u017eel, syst\u00e9m mi tato \u010d\u00edsla op\u011bt odm\u00edtl. Zkus\u00edme to je\u0161t\u011b jednou. Pros\u00edm V\u00e1s o 5. a 6. pozici PINu.
\n<\/em>Klient: 3 a 8
\n<\/em>Oper\u00e1tor: D\u011bkuji, pros\u00edm o chvilku strpen\u00ed.
\n<\/em>Oper\u00e1tor: Omlouv\u00e1m se za del\u0161\u00ed odmlku. Pr\u00e1v\u011b m\u011b informoval vedouc\u00ed call centra, \u017ee m\u00e1 n\u00e1\u0161 syst\u00e9m v\u00fdpadek, proto n\u00e1m ne\u0161lo PIN ov\u011b\u0159it. Velmi se omlouv\u00e1m, mohu V\u00e1m zavolat, a\u017e n\u00e1m syst\u00e9m op\u011bt nab\u011bhne?
\n<\/em>Klient: Ano, jist\u011b.
\n<\/em>Oper\u00e1tor: D\u011bkuji a prozat\u00edm V\u00e1m p\u0159eji hezk\u00fd den.<\/em><\/p>\n

… Hovor vypad\u00e1 b\u011b\u017en\u011b jako jak\u00fdkoliv jin\u00fd hovor od Vodafone, se kter\u00fdm se ji\u017e klient setkal. Jen tam byly v\u00fdpadky.\u00a0V\u00fdpadky syst\u00e9mu jsou dnes b\u011b\u017enou sou\u010d\u00e1st\u00ed \u017eivota a klient nem\u00e1 d\u016fvod znejistit.\u00a0Hacker vyd\u00e1vaj\u00edc\u00ed se za oper\u00e1tora m\u00e1 k dispozici PIN pro volan\u00e9 \u010d\u00edslo v pln\u00e9m rozsahu, tzn. 615438. M\u016f\u017ee tak disponovat s cel\u00fdm prost\u0159ed\u00edm „M\u016fj Vodafone“ dan\u00e9ho klienta.<\/p>\n

Jak by m\u011bl hovor prob\u00edhat?<\/h3>\n

Pokud vol\u00e1 Vodafone v\u00e1m, vol\u00e1 na z\u00e1klad\u011b kontaktn\u00edho telefonu veden\u00e9ho v \u00fa\u010dtu. Z toho usuzuji, \u017ee si kartu z\u00e1kazn\u00edka oper\u00e1tor ji\u017e otev\u0159el a vid\u00ed ji (v m\u00e9m p\u0159\u00edpad\u011b je kontaktn\u00ed telefon jin\u00fd, ne\u017e tel. ve smlouv\u011b, za kter\u00e9 se plat\u00ed tarify) – nen\u00ed tedy co ov\u011b\u0159ovat, v\u0161e mus\u00ed ji\u017e m\u00edt otev\u0159en\u00e9. Pokud tak podpora vol\u00e1 v\u00e1m a ne vy j\u00ed, pro\u010d \u017e\u00e1dat o ov\u011b\u0159en\u00ed? Opa\u010dn\u011b bych to ch\u00e1pal.<\/p>\n

Pokud bychom se bavili obecn\u011b o ov\u011b\u0159en\u00ed, pak se mi jako nejrozumn\u011bj\u0161i varianta jev\u00ed generov\u00e1n\u00ed jednor\u00e1zov\u00e9 SMS zpr\u00e1vy, kter\u00e1 by byla odeslan\u00e1 na kontaktn\u00ed telefon uveden\u00fd v \u00fa\u010dtu. Klient by musel nadiktovat jednor\u00e1zov\u00fd k\u00f3d v SMSce, platn\u00fd nap\u0159. 5 minut. Jednoduch\u00e9, rychl\u00e9, jednor\u00e1zov\u00e9 a t\u00edm i bezpe\u010dn\u00e9.<\/p>\n

Upozor\u0148uji, \u017ee tento \u010dl\u00e1nek nen\u00ed n\u00e1vodem na\u00a0protipr\u00e1vn\u00ed jedn\u00e1n\u00ed. P\u0159\u00edpadn\u00e1 aplikace v praxi je trestn\u00edm \u010dinem. Tento \u010dl\u00e1nek m\u00e1 upozornit na chybu, kterou Vodafone doposud ignoroval. C\u00edlem je, aby se ve Vodafone kone\u010dn\u011b chytli za hlavu, \u017ee to v roce 2018 skute\u010dn\u011b ned\u011blaj\u00ed dob\u0159e a zm\u011bnili komunikaci a zp\u016fsob autorizace jejich z\u00e1kaznick\u00e9 linky. Do doby, ne\u017e to ud\u011blaj\u00ed vystavuj\u00ed sv\u00e9 z\u00e1kazn\u00edky mo\u017en\u00e9mu phishingu ze strany \u00fato\u010dn\u00edka.<\/em><\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

D\u00e9le ne\u017e p\u016fl roku upozor\u0148uji Vodafone na to, \u017ee vystavuj\u00ed sv\u00e9 z\u00e1kazn\u00edky velk\u00e9mu riziku phishingu. Po celou dobu (poka\u017ed\u00e9, kdy\u017e mi zavolaj\u00ed) se prakticky nem\u016f\u017eeme dohodnout na tom, abychom se spole\u010dn\u011b dostali do na\u0161eho firemn\u00edho z\u00e1kaznick\u00e9ho \u00fa\u010dtu. D\u016fvod je prost\u00fd – nebudu d\u00e1vat sv\u00e9 heslo n\u011bkomu na druh\u00e9 stran\u011b telefonu, koho nezn\u00e1m a vol\u00e1 z […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[25],"tags":[26,31],"yoast_head":"\nJak hacknout \u00fa\u010det u Vodafone? Bohu\u017eel velmi snadno. - Blog Tom Atom<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone\" \/>\n<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Jak hacknout \u00fa\u010det u Vodafone? Bohu\u017eel velmi snadno. - Blog Tom Atom\" \/>\n<meta property=\"og:description\" content=\"D\u00e9le ne\u017e p\u016fl roku upozor\u0148uji Vodafone na to, \u017ee vystavuj\u00ed sv\u00e9 z\u00e1kazn\u00edky velk\u00e9mu riziku phishingu. Po celou dobu (poka\u017ed\u00e9, kdy\u017e mi zavolaj\u00ed) se prakticky nem\u016f\u017eeme dohodnout na tom, abychom se spole\u010dn\u011b dostali do na\u0161eho firemn\u00edho z\u00e1kaznick\u00e9ho \u00fa\u010dtu. D\u016fvod je prost\u00fd – nebudu d\u00e1vat sv\u00e9 heslo n\u011bkomu na druh\u00e9 stran\u011b telefonu, koho nezn\u00e1m a vol\u00e1 z […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone\" \/>\n<meta property=\"og:site_name\" content=\"Blog Tom Atom\" \/>\n<meta property=\"article:published_time\" content=\"2018-09-08T11:29:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-09-08T11:31:41+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary\" \/>\n<meta name=\"twitter:label1\" content=\"Napsal(a)\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tom\u00e1\u0161 Libich\" \/>\n\t<meta name=\"twitter:label2\" content=\"Odhadovan\u00e1 doba \u010dten\u00ed\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minut\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.tomatom.cz\/blog\/#website\",\"url\":\"https:\/\/www.tomatom.cz\/blog\/\",\"name\":\"Blog Tom Atom\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.tomatom.cz\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"cs\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone#webpage\",\"url\":\"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone\",\"name\":\"Jak hacknout \u00fa\u010det u Vodafone? Bohu\u017eel velmi snadno. - Blog Tom Atom\",\"isPartOf\":{\"@id\":\"https:\/\/www.tomatom.cz\/blog\/#website\"},\"datePublished\":\"2018-09-08T11:29:57+00:00\",\"dateModified\":\"2018-09-08T11:31:41+00:00\",\"author\":{\"@id\":\"https:\/\/www.tomatom.cz\/blog\/#\/schema\/person\/9d5cd43012ca3661a8717a21e6c2e64c\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone#breadcrumb\"},\"inLanguage\":\"cs\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Dom\u016f\",\"item\":\"https:\/\/www.tomatom.cz\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Jak hacknout \u00fa\u010det u Vodafone? Bohu\u017eel velmi snadno.\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.tomatom.cz\/blog\/#\/schema\/person\/9d5cd43012ca3661a8717a21e6c2e64c\",\"name\":\"Tom\u00e1\u0161 Libich\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.tomatom.cz\/blog\/#personlogo\",\"inLanguage\":\"cs\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/84c7b7dcf14f9b5b846d7e10dbd682b0?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/84c7b7dcf14f9b5b846d7e10dbd682b0?s=96&d=mm&r=g\",\"caption\":\"Tom\u00e1\u0161 Libich\"},\"url\":\"https:\/\/www.tomatom.cz\/blog\/author\/tomas-libich\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Jak hacknout \u00fa\u010det u Vodafone? Bohu\u017eel velmi snadno. - Blog Tom Atom","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone","og_locale":"cs_CZ","og_type":"article","og_title":"Jak hacknout \u00fa\u010det u Vodafone? Bohu\u017eel velmi snadno. - Blog Tom Atom","og_description":"D\u00e9le ne\u017e p\u016fl roku upozor\u0148uji Vodafone na to, \u017ee vystavuj\u00ed sv\u00e9 z\u00e1kazn\u00edky velk\u00e9mu riziku phishingu. Po celou dobu (poka\u017ed\u00e9, kdy\u017e mi zavolaj\u00ed) se prakticky nem\u016f\u017eeme dohodnout na tom, abychom se spole\u010dn\u011b dostali do na\u0161eho firemn\u00edho z\u00e1kaznick\u00e9ho \u00fa\u010dtu. D\u016fvod je prost\u00fd – nebudu d\u00e1vat sv\u00e9 heslo n\u011bkomu na druh\u00e9 stran\u011b telefonu, koho nezn\u00e1m a vol\u00e1 z […]","og_url":"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone","og_site_name":"Blog Tom Atom","article_published_time":"2018-09-08T11:29:57+00:00","article_modified_time":"2018-09-08T11:31:41+00:00","twitter_card":"summary","twitter_misc":{"Napsal(a)":"Tom\u00e1\u0161 Libich","Odhadovan\u00e1 doba \u010dten\u00ed":"5 minut"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/www.tomatom.cz\/blog\/#website","url":"https:\/\/www.tomatom.cz\/blog\/","name":"Blog Tom Atom","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.tomatom.cz\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"cs"},{"@type":"WebPage","@id":"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone#webpage","url":"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone","name":"Jak hacknout \u00fa\u010det u Vodafone? Bohu\u017eel velmi snadno. - Blog Tom Atom","isPartOf":{"@id":"https:\/\/www.tomatom.cz\/blog\/#website"},"datePublished":"2018-09-08T11:29:57+00:00","dateModified":"2018-09-08T11:31:41+00:00","author":{"@id":"https:\/\/www.tomatom.cz\/blog\/#\/schema\/person\/9d5cd43012ca3661a8717a21e6c2e64c"},"breadcrumb":{"@id":"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone#breadcrumb"},"inLanguage":"cs","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.tomatom.cz\/blog\/jak-hacknout-ucet-vodafone#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Dom\u016f","item":"https:\/\/www.tomatom.cz\/blog"},{"@type":"ListItem","position":2,"name":"Jak hacknout \u00fa\u010det u Vodafone? Bohu\u017eel velmi snadno."}]},{"@type":"Person","@id":"https:\/\/www.tomatom.cz\/blog\/#\/schema\/person\/9d5cd43012ca3661a8717a21e6c2e64c","name":"Tom\u00e1\u0161 Libich","image":{"@type":"ImageObject","@id":"https:\/\/www.tomatom.cz\/blog\/#personlogo","inLanguage":"cs","url":"https:\/\/secure.gravatar.com\/avatar\/84c7b7dcf14f9b5b846d7e10dbd682b0?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/84c7b7dcf14f9b5b846d7e10dbd682b0?s=96&d=mm&r=g","caption":"Tom\u00e1\u0161 Libich"},"url":"https:\/\/www.tomatom.cz\/blog\/author\/tomas-libich"}]}},"_links":{"self":[{"href":"https:\/\/www.tomatom.cz\/blog\/wp-json\/wp\/v2\/posts\/58"}],"collection":[{"href":"https:\/\/www.tomatom.cz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tomatom.cz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tomatom.cz\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tomatom.cz\/blog\/wp-json\/wp\/v2\/comments?post=58"}],"version-history":[{"count":11,"href":"https:\/\/www.tomatom.cz\/blog\/wp-json\/wp\/v2\/posts\/58\/revisions"}],"predecessor-version":[{"id":69,"href":"https:\/\/www.tomatom.cz\/blog\/wp-json\/wp\/v2\/posts\/58\/revisions\/69"}],"wp:attachment":[{"href":"https:\/\/www.tomatom.cz\/blog\/wp-json\/wp\/v2\/media?parent=58"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tomatom.cz\/blog\/wp-json\/wp\/v2\/categories?post=58"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tomatom.cz\/blog\/wp-json\/wp\/v2\/tags?post=58"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}