{"id":54400,"date":"2019-12-25T00:00:00","date_gmt":"2019-12-24T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii"},"modified":"2020-02-18T14:02:24","modified_gmt":"2020-02-18T11:02:24","slug":"kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","title":{"rendered":"Hiina h\u00e4kkerid tabati kaheastmelise autentimise \u00fcletamisel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hiina h\u00e4kkerid tabati<\/a><\/noindex> kaheastmelise autentimise \u00fcletamise ajal, kuid see ei ole kindel. Allpool on toodud Hollandi ettev\u00f5tte Fox-IT oletused, mis on spetsialiseerunud k\u00fcberjulgeoleku konsultatsiooniteenustele. Eeldatakse, et on olemas t\u00f5endeid, et Hiina valitsusasutustele t\u00f6\u00f6tab h\u00e4kkerigrupp, mille nimi on APT20.<\/p>\n

\"Hiina<\/p>\n

K\u00fcberkuritegevus, mida omistatakse APT20 r\u00fchmale, avastati esmakordselt 2011. aastal. 2016\u20132017. aastal kadus r\u00fchm spetsialistide silmist ning alles hiljuti avastas Fox-IT j\u00e4lgi APT20 sekkumisest \u00fche oma kliendi v\u00f5rgus, kes palus uurida k\u00fcberjulgeoleku rikkumisi.<\/p>\n

Fox-IT arvates tegeles APT20 grupp viimase kahe aasta jooksul h\u00e4kkimise ja andmete juurdep\u00e4\u00e4suga valitsusasutustes, suurtes ettev\u00f5tetes ja teenusepakkujates USA-s, Prantsusmaal, Saksamaal, Itaalias, Mehhikos, Portugas, Hispaanias, \u00dchendkuningriigis ja Brasiilias. APT20 h\u00e4kkerid olid aktiivsed ka lennunduse, tervishoiu, rahanduse, kindlustuse, energia ja isegi hasartm\u00e4ngude ja elektrooniliste lukustuse valdkondades.<\/p>\n

<\/center><\/p>\n

Tavaliselt kasutas APT20 h\u00e4kkerite saagiks ohvrite s\u00fcsteemide sisenemiseks veebiserverite ja eesk\u00e4tt Jbossi ettev\u00f5tte rakenduste platvormi haavatavusi. P\u00e4rast sisenemist ja shelle juurutamist tungisid h\u00e4kkerid ohvrite v\u00f5rkudesse k\u00f5ikidesse v\u00f5imalikesse s\u00fcsteemidesse. Leidnud kasutajakontod, suutsid kurjategijad varastada andmeid standardsete t\u00f6\u00f6riistade abil, ilma pahavara installimata. Kuid peamine probleem on see, et APT20 grupp suutis v\u00e4idetavalt \u00fcletada kaheastmelise autentimise tokenite abil.<\/p>\n

\"Hiina<\/p>\n

Uurijad v\u00e4idavad, et on leidnud j\u00e4lgi sellest, et h\u00e4kkerid on \u00fchendunud kaheastmelise autentimisega kaitstud VPN-kontodele. Kuidas see juhtus, saavad Fox-IT spetsialistid ainult oletada. K\u00f5ige t\u00f5en\u00e4olisem on, et h\u00e4kkerid suutsid varastada rikutud s\u00fcsteemist RSA SecurID tarkvaratokeni. Varastatud programmi abil suutsid h\u00e4kkerid hiljem genereerida \u00fchekordseid koode kaheastmelise kaitse \u00fcletamiseks.<\/p>\n

Tavatingimustes on seda v\u00f5imatu teha. Tarkvaratoken ei t\u00f6\u00f6ta ilma f\u00fc\u00fcsilise tokeni kohaliku s\u00fcsteemiga \u00fchendamata. Ilma selleta annab RSA SecurID programm vea. Tarkvaratoken luuakse konkreetse s\u00fcsteemi jaoks ja, omades juurdep\u00e4\u00e4su ohvri 'rauda', on v\u00f5imalik saada spetsiifiline number tarkvaratokeni k\u00e4ivitamiseks.<\/p>\n

\"Hiina<\/p>\n

Fox-IT spetsialistid v\u00e4idavad, et varastatud programmi tokeni k\u00e4ivitamiseks ei ole \u00fcldse vajalik juurdep\u00e4\u00e4s ohvri arvutile ja riistvara tokenile. Kogu algse kontrolli kompleks toimub ainult algse genereerimise veeru importimise ajal - 128-bitise juhusliku numbri, mis vastab konkreetselt tokenile, ajal (SecurID Token Seed<\/a><\/noindex>). See number ei ole seotud algse numbriga, mis seej\u00e4rel kuulub tegeliku programmi tokeni genereerimisele. Kui SecurID Token Seedi kontrolli saab kuidagi vahele j\u00e4tta (patchida), siis ei takista miski hiljem kahefaasilise autentimise koode genereerida. Fox-IT ettev\u00f5ttes v\u00e4idetakse, et kontrolli v\u00e4ltimise tagamiseks piisab \u00fche juhise muutmisest. P\u00e4rast seda on ohvri s\u00fcsteem t\u00e4ielikult ja seaduslikult avatud kurjategijale ilma spetsiaalsete utiliitide v\u00f5i katteta.<\/p>\n

<\/p>\n

<\/center><\/p>\n

\t\t\t\t


\n\t\t\t\t\t\t\t\t<\/center>
Allikas: 3dnews.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u043d\u043e \u044d\u0442\u043e \u043d\u0435 \u0442\u043e\u0447\u043d\u043e. \u041d\u0438\u0436\u0435 \u0431\u0443\u0434\u0443\u0442 \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0433\u043e\u043b\u043b\u0430\u043d\u0434\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fox-IT, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0443\u0441\u043b\u0443\u0433\u0430\u0445 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0435\u043c\u0443 \u043d\u0435\u0442 \u043f\u0440\u044f\u043c\u044b\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432, \u0447\u0442\u043e \u043d\u0430 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0433\u0440\u0443\u043f\u043f\u0430 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u0438\u043c\u044f APT20. \u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0435 APT20, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432 2011 \u0433\u043e\u0434\u0443. \u0412 2016–2017 \u0433\u043e\u0434\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54400","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Hiina h\u00e4kkereid tabati kahefaasilise autentimise v\u00e4ltimisel | ProHoster","description":"Hiina h\u00e4kkereid tabati kahefaasilise autentimise v\u00e4ltimisel.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-24T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54400","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:13:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:06:38","updated":"2026-01-24 11:13:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54400","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=54400"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54400\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=54400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=54400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=54400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}