{"id":30311,"date":"2019-10-31T21:34:49","date_gmt":"2019-10-31T18:34:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/analiz-atak-na-hanipot-cowrie\/"},"modified":"2019-10-31T21:34:49","modified_gmt":"2019-10-31T18:34:49","slug":"analiz-atak-na-hanipot-cowrie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/analiz-atak-na-hanipot-cowrie","title":{"rendered":"R\u00fcnnakute anal\u00fc\u00fcs Cowrie hanipotile","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Statistika 24 tunni jooksul p\u00e4rast hankipoti seadistamist Digital Oceanis Singapuris<\/b> <\/p>\n

Piu-piu! Alustame kohe r\u00fcnnakukaardiga<\/h1>\n

\nMeie superlahe kaart n\u00e4itab unikaalseid ASN-e, mis liitusid meie Cowrie hankipotiga 24 tunni jooksul. Kollane t\u00e4histab SSH-\u00fchendusi, punane aga Telneti. Sellised animatsioonid muljetavad sageli ettev\u00f5tte juhatust, v\u00f5imaldades saada rohkem rahastamist turvalisusele ja ressurssidele. Siiski on kaardil teatud v\u00e4\u00e4rtus, sest see n\u00e4itab selgelt geograafilist ja organisatsioonilist levikut r\u00fcnnakute allikate osas meie serverile vaid 24 tunni jooksul. Animatsioon ei kajasta iga allika liiklust.
\n<\/a><\/noindex><\/p>\n

Mis on Pew Pew kaart?<\/h3>\n

\nPew Pew kaart<\/i> \u2014 see on k\u00fcberr\u00fcnnakute visualiseerimine<\/a><\/noindex>, mis on tavaliselt animeeritud ja v\u00e4ga ilus. See on trendikas viis oma toote m\u00fc\u00fcmiseks, mis on tuntud selle poolest, et seda kasutas Norse Corp. Ettev\u00f5te l\u00f5ppes halvasti: selgus, et ilusad animatsioonid olid nende ainus tugevus, samal ajal kui anal\u00fc\u00fcsiks kasutati killustatud andmeid.<\/p>\n

Loodud Leafletjs-i abil<\/h3>\n

\nNeile, kes soovivad luua r\u00fcnnakukaarti suurel ekraanil juhtimiskeskuses (teie bossile meeldib), on olemas raamatukogu leafletjs<\/a><\/noindex>. Koondame selle migreerimisseotise pluginaga leaflet migration layer<\/a><\/noindex>, teenusega Maxmind GeoIP \u2014 ja valmis<\/a><\/noindex>.<\/p>\n

\"R\u00fcnnakute<\/a><\/noindex><\/p>\n

WTF: Mis veel on Cowrie hankipot?<\/h1>\n

\nHankipot on s\u00fcsteem, mis on v\u00f5rku paigutatud spetsiaalselt pahatahtlike r\u00fcndajate meelitamiseks. S\u00fcsteemi suhted on tavaliselt ebaseaduslikud ja v\u00f5imaldavad avastada r\u00fcndajat detailsete logide kaudu. Logides hoitakse mitte ainult tavainfot \u00fchenduse kohta, vaid ka seansi teavet, mis paljastab r\u00fcndaja tehnikat, taktikat ja protseduure (TTP)<\/b> .<\/p>\n

Cowrie hankipot<\/a><\/noindex> on m\u00f5eldud SSH- ja Telnet-\u00fchenduste salvestamiseks<\/b>. Selliseid hankipote paigutatakse sageli internetti, et j\u00e4lgida pahatahtlike r\u00fcndajate t\u00f6\u00f6riistu, skripte ja hoste.<\/p>\n

Minu s\u00f5num ettev\u00f5tetele, mis arvavad, et neid ei r\u00fcnnata: 'Te ei otsi piisavalt h\u00e4sti.'
\n\u2014 James Snook<\/i><\/p><\/blockquote>\n

\n\"R\u00fcnnakute
\n<\/p>\n

Mis on logides?<\/h1>\n

<\/p>\n

\u00dchenduste kogus<\/h3>\n

\nPaljusid hoste ilmnes korduvaid \u00fchenduse katseid. See on normaalne, kuna r\u00fcndajate skriptides on nimekirjad mandaadidest ja nad proovivad mitmeid kombinatsioone. Cowrie hankipot on seadistatud teatud kasutajanime ja parooli kombinatsioonide vastuv\u00f5tmiseks. See on seadistatud failis user.db<\/b>.<\/p>\n

\"R\u00fcnnakute
\n<\/p>\n

R\u00fcnnakute geograafia<\/h3>\n

\nMaxmind'i geolokatsiooni andmetel olen lugenud iga riigi \u00fchenduste arvu. Brasiilia ja Hiina juhivad suurt edumaad, nendest riikidest tuleb sageli suur m\u00fcra skanneritelt.<\/p>\n

\"R\u00fcnnakute
\n<\/p>\n

V\u00f5rguploki omanik<\/h3>\n

\nV\u00f5rguplokkide (ASN) omanike uurimine v\u00f5ib paljastada organisatsioone, millel on suur hulk r\u00fcndavaid hoste. Loomulikult tuleks alati meeles pidada, et paljusid r\u00fcnnakuid tehakse nakatunud hostidelt. On m\u00f5istlik eeldada, et enamik pahatahtlikke osalejaid ei ole nii rumalad, et skaneerivad v\u00f5rku koduarvutist.<\/p>\n

\"R\u00fcnnakute
\n<\/p>\n

Avatud portid r\u00fcndavate s\u00fcsteemide pealt (andmed Shodan.io)<\/h3>\n

\nIP-nimekirja k\u00e4itamine l\u00e4bi suurep\u00e4rase Shodan API<\/a><\/noindex> m\u00e4\u00e4rab kiiresti avatud portide s\u00fcsteemid<\/b> ja mis need portid on. Alloleval pildil on n\u00e4idatud avatud portide kontsentratsioon riikide ja organisatsioonide l\u00f5ikes. Olusid on v\u00f5imalik tuvastada, kuid piiratud v\u00e4ikese valimi<\/b> m\u00f5ned kummalised asjad, v\u00e4lja arvatud suur arv avatud ports 500 Hiinas<\/b>.<\/p>\n

Huvitav avastus - suur hulk s\u00fcsteeme Brasiilias, millel on portid 22, 23 suletud<\/b> v\u00f5i teised portid<\/b>, vastavalt Censys'ile ja Shodan'ile. Tundub, et need on \u00fchendused l\u00f5ppkasutajate arvutitest.<\/p>\n

\"R\u00fcnnakute
\n <\/p>\n

Robotid? Mitte tingimata<\/h3>\n

\nAndmed Censys<\/a><\/noindex> portide 22 ja 23 n\u00e4itasid kummalisi tulemusi. Eeldasin, et enamik skaneeringutest ja parooli r\u00fcnnakutest tuleb robotitest. Skript levib avatud portide kaudu, tuvastades paroole, ja kopeerib end uudsesse s\u00fcsteemi, j\u00e4tkates levimist sama meetodi kaudu.<\/p>\n

Kuid siin on n\u00e4ha, et vaid v\u00e4hestel hostidel, kes skaneerivad telneti, on avatud v\u00e4lispord 23. See t\u00e4hendab, et s\u00fcsteemid on kas kompromiteeritud muul viisil v\u00f5i r\u00fcndajad k\u00e4ivitavad skripte k\u00e4sitsi.<\/p>\n

\"R\u00fcnnakute
\n<\/p>\n

Kodu\u00fchendused<\/h3>\n

\nTeine huvitav avastus oli suur hulk kodukasutajaid valimis. Aitasin tagasivaadet <\/b> mille kaudu m\u00e4\u00e4rasin 105 \u00fchendust konkreetsetest koduarvutitest. Paljude kodu\u00fchenduste puhul kajastub tagasivaate DNS'is hosti nimi, mis sisaldab s\u00f5nu dsl, home, cable, fiber ja nii edasi.<\/p>\n

\"R\u00fcnnakute
\n<\/p>\n

\u00d5ppige ja uurige: seadke \u00fcles oma honeypot<\/h1>\n

\nHiljuti kirjutasin l\u00fchikese juhendi, kuidas oma s\u00fcsteemis honeypoti Cowrie paigaldada<\/a><\/noindex>. Nagu juba mainitud, kasutati meie juhtumis Digital Ocean VPS Singapuris. 24-tunnise anal\u00fc\u00fcsi ajal maksis see s\u00f5na otseses m\u00f5ttes vaid paar senti ja s\u00fcsteemi kokkupanek v\u00f5ttis 30 minutit.<\/p>\n

Selle asemel, et k\u00e4ivitada Cowrie internetis ja p\u00fc\u00fcda kogu m\u00fcra, saab kasu saada honeypot'ist kohalikus v\u00f5rgus. Piisab, kui seadistada teavitus, kui teatud portidele hakkavad korraldama p\u00e4ringud. See on kas r\u00fcndaja kohaliku v\u00f5rgu sees v\u00f5i uudishimulik t\u00f6\u00f6taja v\u00f5i haavatavuste skannimine.<\/p>\n

J\u00e4reldused<\/h1>\n

\nP\u00e4rast r\u00fcndajate tegevuse vaatamist \u00f6\u00f6p\u00e4eva jooksul on ilmne, et r\u00fcnnakute selget allikat ei saa m\u00e4\u00e4rata mingisuguses organisatsioonis, riigis v\u00f5i isegi operatsioonis\u00fcsteemis.<\/p>\n

Lai allikate levik n\u00e4itab, et skannimise m\u00fcra on pidev ja ei ole seostatav konkreetse allikaga. Iga\u00fchel, kes t\u00f6\u00f6tab internetis, tuleb veenduda, et tema s\u00fcsteem on mitme turvatasemega<\/b>. Levinud ja t\u00f5hus lahendus SSH<\/b> oleks teenuse viimine juhuslikule k\u00f5rgele pordile. See ei vabasta vajadusest rangete paroolikaitsete ja j\u00e4lgimise j\u00e4rele, kuid v\u00e4hemalt tagab, et logisid ei t\u00e4ideta pideva skannimisega. \u00dchendused k\u00f5rgel pordi on suurema t\u00f5en\u00e4osusega sihikindlad r\u00fcnnakud, mis v\u00f5ivad sind huvitada.<\/p>\n

Tihti asuvad avatud telnet-pordid ruuterites v\u00f5i muudes seadmetes, nii et neid ei saa lihtsalt k\u00f5rgele pordile viia. Teave k\u00f5ikide avatud portide<\/a><\/noindex> ja r\u00fcnnakupind<\/a><\/noindex> on ainus viis veenduda, et need teenused on tulem\u00fc\u00fcriga kaitstud v\u00f5i keelatud. Kui v\u00f5imalik, ei tohiks Telnetit \u00fcldse kasutada, see protokoll ei ole kr\u00fcpteeritud. Kui seda on h\u00e4dasti vaja, siis j\u00e4lgi seda hoolikalt ja kasuta usaldusv\u00e4\u00e4rseid paroole.
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443! \u041d\u0430\u0447\u043d\u0451\u043c \u0441\u0440\u0430\u0437\u0443 \u0441 \u043a\u0430\u0440\u0442\u044b \u0430\u0442\u0430\u043a \u041d\u0430\u0448\u0430 \u0441\u0443\u043f\u0435\u0440\u043a\u043b\u0430\u0441\u0441\u043d\u0430\u044f \u043a\u0430\u0440\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 ASN, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u043b\u0438\u0441\u044c \u043a \u043d\u0430\u0448\u0435\u043c\u0443 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0443 Cowrie \u0437\u0430 24 \u0447\u0430\u0441\u0430. \u0416\u0451\u043b\u0442\u044b\u0439 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u043a\u0440\u0430\u0441\u043d\u044b\u0439\u00a0\u2014 Telnet. \u0422\u0430\u043a\u0438\u0435 \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0438 \u0447\u0430\u0441\u0442\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u044f\u044e\u0442 \u0441\u043e\u0432\u0435\u0442 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0431\u0438\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30311","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcnnakute anal\u00fc\u00fcs honeypot'il Cowrie | ProHoster","description":"Statistika 24 tunni jooksul p\u00e4rast honeypot'i seadistamist Digital Ocean'i s\u00f5lmes Singapuris Piu-piu!","canonical_url":"https:\/\/prohoster.info\/et\/blog\/analiz-atak-na-hanipot-cowrie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u0430\u0442\u0430\u043a \u043d\u0430 \u0445\u0430\u043d\u0438\u043f\u043e\u0442 Cowrie | ProHoster","og:description":"\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443!","og:url":"https:\/\/prohoster.info\/et\/blog\/analiz-atak-na-hanipot-cowrie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:49+00:00","article:modified_time":"2019-10-31T18:34:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30311","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/30311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=30311"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/30311\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=30311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=30311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=30311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}