{"id":54400,"date":"2019-12-25T00:00:00","date_gmt":"2019-12-24T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii"},"modified":"2020-02-18T14:02:24","modified_gmt":"2020-02-18T11:02:24","slug":"kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","title":{"rendered":"Kinesiske hackere fanget i omg\u00e5else af tofaktorautentificering","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kinesiske hackere ble tatt<\/a><\/noindex> mens de omg\u00e5tt tofaktorautentisering, men dette er ikke bekreftet. Nedenfor presenteres antagelser fra det nederlandske selskapet Fox-IT, som spesialiserer seg p\u00e5 konsulenttjenester innen cybersikkerhet. Det antas, uten direkte bevis, at en gruppe hackere opererer for kinesiske myndigheter, kjent som APT20.<\/p>\n

\"Kinesiske<\/p>\n

Hackeraktivitet, som tilskrives gruppen APT20, blev f\u00f8rste gang opdaget i 2011. I \u00e5rene 2016-2017 forsvandt gruppen fra eksperternes opm\u00e6rksomhed, og f\u00f8rst for nylig opdagede Fox-IT spor af APT20's indblanding i netv\u00e6rket hos en af deres kunder, der bad om at f\u00e5 unders\u00f8gt sikkerhedsbrud.<\/p>\n

If\u00f8lge Fox-IT har gruppe APT20 drevet med hacking og tilgang til data fra statlige strukturer, store selskaper og tjenesteleverand\u00f8rer i USA, Frankrike, Tyskland, Italia, Mexico, Portugal, Spania, Storbritannia og Brasil de siste to \u00e5rene. Hackerne fra APT20 har ogs\u00e5 v\u00e6rt aktive innen omr\u00e5der som luftfart, helsevesen, finans, forsikring, energi, og til og med i bransjer som gambling og elektroniske l\u00e5ser.<\/p>\n

<\/center><\/p>\n

Som regel brukte hackerne fra APT20 s\u00e5rbarheter i webservere, s\u00e6rlig i plattformen for bedriftsapplikasjoner Jboss, for \u00e5 f\u00e5 tilgang til ofrenes systemer. Etter \u00e5 ha f\u00e5tt tilgang og installert skall, kunne hackerne infiltrere alle mulige systemer gjennom ofrenes nettverk. Funne kontoer gjorde det mulig for angriperne \u00e5 stjele data ved hjelp av standardverkt\u00f8y, uten \u00e5 installere skadelig programvare. Men det st\u00f8rste problemet er at APT20-gruppen angivelig klarte \u00e5 omg\u00e5 tofaktorautentisering ved hjelp av tokens.<\/p>\n

\"Kinesiske<\/p>\n

Forskere hevder at de har funnet spor av at hackerne fikk tilgang til VPN-kontoer som var beskyttet av tofaktorautentisering. Hvordan dette skjedde, kan Fox-ITs spesialister bare spekulere i. Den mest sannsynlige forklaringen er at hackerne klarte \u00e5 stjele en RSA SecurID-programtrekker fra det kompromitterte systemet. Med det stj\u00e5lne programmet kunne hackerne deretter generere engangskoder for \u00e5 omg\u00e5 tofaktorbeskyttelsen.<\/p>\n

Under normale omst\u00e6ndigheder er dette umuligt. Den softwarebaserede token fungerer ikke uden forbindelse til det lokale system af den hardwarebaserede token. Uden det giver programmet RSA SecurID en fejl. Den softwarebaserede token oprettes til et specifikt system, og med adgang til offerets 'hardware' kan man f\u00e5 et specifikt tal til at aktivere den softwarebaserede token.<\/p>\n

\"Kinesiske<\/p>\n

Specialister fra Fox-IT h\u00e6vder, at det slet ikke er n\u00f8dvendigt at have adgang til offerets computer og hardware token for at aktivere (den stj\u00e5lne) programbaserede token. Hele det indledende kontrolkompleks gennemf\u00f8res kun ved import af den indledende generationsvektor - et tilf\u00e6ldigt 128-bit tal, der svarer til den specifikke token (SecurID Token Seed<\/a><\/noindex>). Dette tal har ikke noget at g\u00f8re med det indledende tal, som derefter relaterer til genereringen af den faktiske programbaserede token. Hvis kontrollen af SecurID Token Seed p\u00e5 nogen m\u00e5de kan omg\u00e5s (patches), vil intet senere forhindre genereringen af koder til to-faktor-autentificering. Fox-IT h\u00e6vder, at omg\u00e5else af kontrollen kan skaffes ved at \u00e6ndre blot \u00e9n instruktion. Efter dette vil offerets system v\u00e6re helt og lovligt \u00e5bnet for angriberen uden brug af specialv\u00e6rkt\u00f8jer og shells.<\/p>\n

<\/p>\n

<\/center><\/p>\n

\t\t\t\t


\n\t\t\t\t\t\t\t\t<\/center>
Kilde: 3dnews.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u043d\u043e \u044d\u0442\u043e \u043d\u0435 \u0442\u043e\u0447\u043d\u043e. \u041d\u0438\u0436\u0435 \u0431\u0443\u0434\u0443\u0442 \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0433\u043e\u043b\u043b\u0430\u043d\u0434\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fox-IT, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0443\u0441\u043b\u0443\u0433\u0430\u0445 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0435\u043c\u0443 \u043d\u0435\u0442 \u043f\u0440\u044f\u043c\u044b\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432, \u0447\u0442\u043e \u043d\u0430 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0433\u0440\u0443\u043f\u043f\u0430 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u0438\u043c\u044f APT20. \u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0435 APT20, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432 2011 \u0433\u043e\u0434\u0443. \u0412 2016–2017 \u0433\u043e\u0434\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54400","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kinesiske hackere blev taget i at omg\u00e5 to-faktor autentificering | ProHoster","description":"Kinesiske hackere blev taget i at omg\u00e5 to-faktor autentificering.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-24T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54400","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:13:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:06:38","updated":"2026-01-24 11:13:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/54400","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=54400"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/54400\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=54400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=54400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=54400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}