{"id":88098,"date":"2020-07-12T13:42:23","date_gmt":"2020-07-12T11:42:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/5-kiberatak-kotorye-legko-mozhno-bylo-predotvratit"},"modified":"2020-07-12T13:42:23","modified_gmt":"2020-07-12T11:42:23","slug":"5-kiberatak-kotorye-legko-mozhno-bylo-predotvratit","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/5-kiberatak-kotorye-legko-mozhno-bylo-predotvratit","title":{"rendered":"5 kyber\u00fatok\u016f, kter\u00e9 bylo snadn\u00e9 zamezit.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ahoj, Habr! Dnes chceme hovo\u0159it o nov\u00fdch kybernetick\u00fdch \u00fatoc\u00edch, kter\u00e9 ned\u00e1vno odhalila na\u0161e analytick\u00e1 centra kybernetick\u00e9 ochrany. Pod textem je p\u0159\u00edb\u011bh o velk\u00e9 ztr\u00e1t\u011b dat v\u00fdrobce silikonov\u00fdch \u010dip\u016f, historie o v\u00fdpadku s\u00edt\u00ed v cel\u00e9m m\u011bst\u011b, n\u011bco o nebezpe\u010d\u00edch upozorn\u011bn\u00ed Google, statistiky o naru\u0161en\u00ed americk\u00e9ho zdravotnick\u00e9ho syst\u00e9mu a odkaz na kan\u00e1l Acronis na YouTube.<\/p>\n

\"5<\/a><\/noindex>
\n<\/a><\/noindex>
\nKrom\u011b ochrany va\u0161ich dat se v Acronis tak\u00e9 zab\u00fdv\u00e1me monitorov\u00e1n\u00edm hrozeb, vyv\u00edj\u00edme opravy pro nov\u00e9 zranitelnosti a p\u0159ipravujeme doporu\u010den\u00ed pro zaji\u0161t\u011bn\u00ed ochrany pro r\u016fzn\u00e9 syst\u00e9my. Za t\u00edmto \u00fa\u010delem byla ned\u00e1vno vytvo\u0159ena glob\u00e1ln\u00ed s\u00ed\u0165 centr\u016f bezpe\u010dnosti Acronis Cyber Protection Operations Centers (CPOCs). V t\u011bchto centrech prob\u00edh\u00e1 st\u00e1l\u00e1 anal\u00fdza provozu, aby se odhalily nov\u00e9 typy malwaru, vir\u016f a kryptom\u011bnov\u00fdch t\u011b\u017ea\u0159\u016f. <\/p>\n

Dnes chceme mluvit o v\u00fdsledc\u00edch \u010dinnosti CPOCs, kter\u00e9 nyn\u00ed pravideln\u011b zve\u0159ej\u0148ujeme na kan\u00e1lu Acronis na YouTube. Tady je 5 nejzaj\u00edmav\u011bj\u0161\u00edch zpr\u00e1v o incidentech, kter\u00fdm by bylo mo\u017en\u00e9 p\u0159edej\u00edt s alespo\u0148 z\u00e1kladn\u00ed ochranou proti Ransomware a phishingu.<\/p>\n

Ransomware Black Kingdom se nau\u010dil kompromitovat u\u017eivatele Pulse VPN. <\/h3>\n

\n

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

VPN poskytovatel Pulse Secure, na jeho\u017e \u0159e\u0161en\u00ed spol\u00e9h\u00e1 80 % spole\u010dnost\u00ed z \u017eeb\u0159\u00ed\u010dku Fortune 500, se stal ob\u011bt\u00ed \u00fatok\u016f ransomwaru z rodiny Black Kingdom. Ty vyu\u017e\u00edvaj\u00ed zranitelnost syst\u00e9mu, kter\u00e1 umo\u017e\u0148uje p\u0159e\u010d\u00edst soubor a extrahovat z n\u011bj \u00fadaje o \u00fa\u010dtu. Po kr\u00e1de\u017ei jsou z\u00edskan\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje pou\u017eity k p\u0159\u00edstupu do kompromitovan\u00e9 s\u00edt\u011b.<\/p>\n

I kdy\u017e Pulse Secure ji\u017e uvolnila opravu, kter\u00e1 tuto zranitelnost odstra\u0148uje, spole\u010dnosti, kter\u00e9 je\u0161t\u011b nezavedly aktualizaci, jsou vystaveny zv\u00fd\u0161en\u00e9mu riziku. <\/p>\n

Jak v\u0161ak uk\u00e1zaly testy, \u0159e\u0161en\u00ed pou\u017e\u00edvaj\u00edc\u00ed um\u011blou inteligenci pro identifikaci hrozeb, jako Acronis Active Protection, nedovoluj\u00ed, aby Black Kingdom infikoval po\u010d\u00edta\u010de koncov\u00fdch u\u017eivatel\u016f. Pokud tedy m\u00e1 spole\u010dnost takovou ochranu nebo syst\u00e9m se zabudovan\u00fdm mechanismem pro sledov\u00e1n\u00ed aktualizac\u00ed (nap\u0159\u00edklad Acronis Cyber Protect), nemus\u00edte m\u00edt obavy o Black Kingdom.<\/p>\n

\u00datok ransomware na Knoxville vedl k v\u00fdpadku s\u00edt\u011b.<\/h3>\n

\n

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Dne 12. \u010dervna 2020 byla ve m\u011bst\u011b Knoxville (USA, st\u00e1t Tennessee) provedena rozs\u00e1hl\u00e1 Ransomware \u00fatok, kter\u00fd vedl k odpojen\u00ed po\u010d\u00edta\u010dov\u00fdch s\u00edt\u00ed. Mezi t\u00edm, org\u00e1ny \u010dinn\u00e9 v trestn\u00edm \u0159\u00edzen\u00ed ztratily mo\u017enost reagovat na incidenty s v\u00fdjimkou nal\u00e9hav\u00fdch p\u0159\u00edpad\u016f a hrozby pro \u017eivot lid\u00ed. A dokonce i n\u011bkolik dn\u00ed po ukon\u010den\u00ed \u00fatoku bylo na m\u011bstsk\u00e9m webu st\u00e1le vyv\u011b\u0161eno ozn\u00e1men\u00ed o tom, \u017ee online slu\u017eby nejsou k dispozici. <\/p>\n

Prvotn\u00ed vy\u0161et\u0159ov\u00e1n\u00ed uk\u00e1zalo, \u017ee \u00fatok byl v\u00fdsledkem rozs\u00e1hl\u00e9ho phishingov\u00e9ho \u00fatoku s rozes\u00edl\u00e1n\u00edm fale\u0161n\u00fdch e-mail\u016f pracovn\u00edk\u016fm m\u011bstsk\u00fdch slu\u017eeb. Byly p\u0159itom pou\u017eity ransomware programy jako Maze, DoppelPaymer nebo NetWalker. Stejn\u011b jako v p\u0159edchoz\u00edm p\u0159\u00edkladu, kdyby m\u011bstsk\u00e9 \u00fa\u0159ady pou\u017e\u00edvaly prost\u0159edky proti Ransomware, takov\u00fdto \u00fatok by nebyl mo\u017en\u00fd, proto\u017ee ochrann\u00e9 syst\u00e9my s AI okam\u017eit\u011b detekuj\u00ed varianty pou\u017eit\u00e9ho \u0161ifrov\u00e1n\u00ed.<\/p>\n

MaxLinear ozn\u00e1mila \u00fatok s vyu\u017eit\u00edm Maze a \u00fanik dat<\/h3>\n

\n

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

V\u00fdrobce integrovan\u00fdch syst\u00e9m\u016f na \u010dipu, MaxLinear, potvrdil, \u017ee s\u00edt\u011b spole\u010dnosti byly napadeny ransomwarem Maze. P\u0159ibli\u017en\u011b 1 TB dat bylo ukradeno, v\u010detn\u011b osobn\u00edch \u00fadaj\u016f a finan\u010dn\u00edch informac\u00ed zam\u011bstnanc\u016f. Organiz\u00e1to\u0159i \u00fatoku ji\u017e zve\u0159ejnili 10 GB t\u011bchto dat.<\/p>\n

V d\u016fsledku toho musela MaxLinear uv\u00e9st v\u0161echny s\u00edt\u011b spole\u010dnosti do offline re\u017eimu a tak\u00e9 najmout konzultanty na vy\u0161et\u0159ov\u00e1n\u00ed. Na p\u0159\u00edkladu tohoto \u00fatoku zopakujme je\u0161t\u011b jednou: Maze je dost zn\u00e1m\u00e1 a dob\u0159e rozpoznateln\u00e1 varianta ransomware. P\u0159i pou\u017eit\u00ed syst\u00e9m\u016f ochrany proti Ransomware by MaxLinear u\u0161et\u0159ila nemal\u00e9 pen\u00edze a tak\u00e9 se vyhnula reputa\u010dn\u00edm \u0161kod\u00e1m.<\/p>\n

Malware \"pro\u0161el\" p\u0159es fale\u0161n\u00e1 upozorn\u011bn\u00ed Google Alerts <\/h3>\n

\n

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Zlo\u010dinci za\u010dali pou\u017e\u00edvat Google Alerts k rozes\u00edl\u00e1n\u00ed fale\u0161n\u00fdch upozorn\u011bn\u00ed na \u00faniky dat. V d\u016fsledku toho, dost\u00e1vaj\u00edc znepokojuj\u00edc\u00ed zpr\u00e1vy, vylekan\u00ed u\u017eivatel\u00e9 p\u0159ech\u00e1zeli na fale\u0161n\u00e9 weby a stahovali malware v nad\u011bji, \u017ee \"vy\u0159e\u0161\u00ed probl\u00e9m\".
\nMalware upozorn\u011bn\u00ed funguj\u00ed v prohl\u00ed\u017ee\u010d\u00edch Chrome a Firefox. Nicm\u00e9n\u011b slu\u017eby pro filtrov\u00e1n\u00ed URL, v\u010detn\u011b slu\u017eby Acronis Cyber Protect, nedovolily u\u017eivatel\u016fm v chr\u00e1n\u011bn\u00fdch s\u00edt\u00edch p\u0159ech\u00e1zet na infikovan\u00e9 odkazy. <\/p>\n

Americk\u00fd ministerstvo zdravotnictv\u00ed ozn\u00e1milo 393 poru\u0161en\u00ed po\u017eadavk\u016f na bezpe\u010dnost HIPAA za minul\u00fd rok<\/h3>\n

\n

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Ministerstvo zdravotnictv\u00ed a soci\u00e1ln\u00edch slu\u017eeb USA (Department of Health and Human Services \u2014 HHS) ozn\u00e1milo 393 \u00fanik\u016f citliv\u00fdch informac\u00ed o zdrav\u00ed pacient\u016f, kter\u00e9 vedly k poru\u0161en\u00edm po\u017eadavk\u016f Z\u00e1kona o p\u0159enositelnosti a odpov\u011bdnosti zdravotn\u00edho poji\u0161t\u011bn\u00ed (HIPAA) za obdob\u00ed od \u010dervna 2019 do \u010dervna 2020. Z toho 142 incident\u016f bylo v\u00fdsledkem phishingov\u00fdch \u00fatok\u016f na District Medical Group a Marinette Wisconsin, p\u0159i nich\u017e uniklo 10190 a 27137 elektronick\u00fdch zdravotn\u00edch z\u00e1znam\u016f.<\/p>\n

Bohu\u017eel prax\u00ed se uk\u00e1zalo, \u017ee i speci\u00e1ln\u011b vy\u0161kolen\u00ed u\u017eivatel\u00e9, kter\u00fdm bylo opakovan\u011b vysv\u011btleno, jak\u00e9 riziko p\u0159edstavuj\u00ed odkazy a p\u0159\u00edlohy v podez\u0159el\u00fdch e-mailech, se mohou st\u00e1t ob\u011bt\u00ed. A bez automatizovan\u00fdch syst\u00e9m\u016f blokov\u00e1n\u00ed podez\u0159el\u00e9 aktivity a filtrov\u00e1n\u00ed URL je velmi obt\u00ed\u017en\u00e9 se chr\u00e1nit p\u0159ed rafinovan\u00fdmi \u00fatoky, kter\u00e9 vyu\u017e\u00edvaj\u00ed velmi p\u0159esv\u011bd\u010div\u00e9 pob\u00eddky, d\u016fv\u011bryhodn\u00e9 rozes\u00edlac\u00ed schr\u00e1nky a vysokou \u00farove\u0148 soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed. <\/p>\n

Pokud m\u00e1te z\u00e1jem o novinky o nejnov\u011bj\u0161\u00edch hrozb\u00e1ch, m\u016f\u017eete se p\u0159ihl\u00e1sit k odb\u011bru kan\u00e1lu Acronis na YouTube, kde informujeme o nejnov\u011bj\u0161\u00edch v\u00fdsledc\u00edch monitorov\u00e1n\u00ed CPOC t\u00e9m\u011b\u0159 v re\u00e1ln\u00e9m \u010dase. M\u016f\u017eete se tak\u00e9 p\u0159ihl\u00e1sit k na\u0161emu blogu na Habr.com, proto\u017ee zde budeme p\u0159en\u00e1\u0161et nejzaj\u00edmav\u011bj\u0161\u00ed aktualizace a v\u00fdsledky v\u00fdzkumu.<\/p>\n

Pouze registrovan\u00ed u\u017eivatel\u00e9 se mohou \u00fa\u010dastnit ankety. P\u0159ihlaste se<\/a><\/noindex>, pros\u00edm.<\/p>\n

Obdr\u017eeli jste za posledn\u00ed rok velmi p\u0159esv\u011bd\u010div\u00e9 phishingov\u00e9 e-maily?<\/h2>\n