{"id":91919,"date":"2020-08-20T13:41:55","date_gmt":"2020-08-20T11:41:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vyyavlen-cherv-fritzfrog-porazhayushhij-servery-po-ssh-i-stroyashhij-deczentralizovannyj-botnet"},"modified":"2020-08-20T13:41:55","modified_gmt":"2020-08-20T11:41:55","slug":"vyyavlen-cherv-fritzfrog-porazhayushhij-servery-po-ssh-i-stroyashhij-deczentralizovannyj-botnet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-cherv-fritzfrog-porazhayushhij-servery-po-ssh-i-stroyashhij-deczentralizovannyj-botnet","title":{"rendered":"Avastati FritzFrog uss, mis r\u00fcndab servereid SSH kaudu ja loob detsentraliseeritud botnet'i.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Guardicore, andmete keskuste ja pilves\u00fcsteemide kaitsmisega tegelev ettev\u00f5te, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.guardicore.com\/2020\/08\/fritzfrog-p2p-botnet-infects-ssh-servers\/\">tuvastas<\/a><\/noindex> uue k\u00f5rgtehnoloogilise pahavara FritzFrog, mis r\u00fcndab Linuxi p\u00f5hiseid servereid. FritzFrog \u00fchendab endas ussi, mis levib bruteforce-r\u00fcnnaku kaudu avatud SSH-portide kaudu serveritesse, ja komponente, mis v\u00f5imaldavad luua hajusasse botneti, mis t\u00f6\u00f6tab ilma juhtimisteguri ja ei oma \u00fchtegi rikke punkti.<\/p>\n<p>Botneti loomiseks kasutatakse spetsiaalset P2P-protokolli, kus s\u00f5lmed suhtlevad omavahel, koordineerivad r\u00fcnnakute korraldust, hoolitsevad v\u00f5rgu toimimise eest ja j\u00e4lgivad \u00fcksteise seisundit. Uute sihtm\u00e4rkide leidmine toimub bruteforce-r\u00fcnnakute kaudu serveritele, mis aktsepteerivad SSH-p\u00e4ringuid. Uue serveri avastamisel viiakse l\u00e4bi s\u00f5nastiku l\u00e4bimine t\u00fc\u00fcpiliste kasutajanime ja paroolide kombinatsioonide osas. Juhtimine v\u00f5ib toimuda mistahes s\u00f5lme kaudu, mis keerukaks teeb botneti operaatorite v\u00e4ljaselgitamise ja blokeerimise.<\/p>\n<p>Uuringute andmetel on botnetil juba ligikaudu 500 s\u00f5lme, sealhulgas mitme \u00fclikooli ja suure raudteefirma serverid. M\u00e4rgitakse, et r\u00fcnnaku peamine sihtm\u00e4rk on haridusasutuste, meditsiinikeskuste, riigiasutuste, pankade ja telekommunikatsioonifirmade v\u00f5rgud. P\u00e4rast serveri kompromiteerimist organiseeritakse seal Monero kr\u00fcptovaluuta kaevandamise protsess. Selle pahavara tegevust on j\u00e4lgitud alates 2020. aasta jaanuarist.<\/p>\n<p>FritzFrogi erip\u00e4ra on see, et k\u00f5ik andmed ja t\u00e4itmisj\u00e4rgne kood hoitakse ainult m\u00e4lus. Muudatused kettale piirdumisega uue SSH-v\u00f5tme lisamisega authorized_keys failile, mida kasutatakse hiljem serverisse p\u00e4\u00e4semiseks. S\u00fcsteemifailid ei muutu, mis teeb ussi n\u00e4htamatuks s\u00fcsteemidele, mis kontrollivad terviklikkust kontrollsummade abil. M\u00e4lus hoitakse ka paroolide l\u00e4bimise jaoks s\u00f5nastikke ja kaevandamiseks vajalikke andmeid, mis s\u00fcnkroonitakse s\u00f5lmede vahel P2P-protokolli abil.<\/p>\n<p>\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043a\u0430\u043c\u0443\u0444\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b &#171;ifconfig&#187;, &#171;libexec&#187;, &#171;php-fpm&#187; \u0438 &#171;nginx&#187;. \u0423\u0437\u043b\u044b \u0431\u043e\u0442\u043d\u0435\u0442\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0441\u043e\u0441\u0435\u0434\u0435\u0439 \u0438 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438\u043b\u0438 \u0434\u0430\u0436\u0435 \u043f\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u041e\u0421 (\u0435\u0441\u043b\u0438 \u0432 \u043d\u043e\u0432\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0431\u044b\u043b \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0451\u043d \u0438\u0437\u043c\u0435\u043d\u0451\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b authorized_keys) \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u044e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043d\u0430 \u0445\u043e\u0441\u0442\u0435. \u0414\u043b\u044f \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0448\u0442\u0430\u0442\u043d\u044b\u0439 SSH &#8212; \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 &#171;netcat&#187;, \u043f\u0440\u0438\u0432\u044f\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0439\u0441\u044f \u043a \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 localhost \u0438 \u0441\u043b\u0443\u0448\u0430\u044e\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043f\u043e\u0440\u0442\u0443 1234, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0443\u0437\u043b\u044b \u043e\u0431\u0440\u0430\u0449\u0430\u044e\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 SSH-\u0442\u0443\u043d\u043d\u0435\u043b\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u044e\u0447 \u0438\u0437 authorized_keys.<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/www.guardicore.com\/wp-content\/uploads\/2020\/08\/frog-attack-1030x601.jpg\"><img decoding=\"async\" alt=\"Avastati FritzFrog uss, mis r\u00fcndab servereid SSH kaudu ja loob detsentraliseeritud botnet&#039;i.\" src=\"\/wp-content\/uploads\/2020\/08\/485d97de035ae93d10692d8934702264.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p> FritzFrog komponentide kood on kirjutatud Go keeles ja t\u00f6\u00f6tab mitme l\u00f5ime re\u017eiimis. Kahjulik tarkvara sisaldab mitmeid mooduleid, mida k\u00e4ivitatakse erinevates l\u00f5imedes:<\/p>\n<ul>\n<li class=\"l\"> Cracker &#8212; \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u0434\u0431\u043e\u0440 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u0435\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445.\n<li class=\"l\"> CryptoComm + Parser\t&#8212; \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 P2P-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435.\n<li class=\"l\"> CastVotes &#8212; \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0432\u044b\u0431\u043e\u0440\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438.\n<li class=\"l\"> TargetFeed &#8212; \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0443\u0437\u043b\u043e\u0432 \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043e\u0442 \u0441\u043e\u0441\u0435\u0434\u043d\u0438\u0445 \u0443\u0437\u043b\u043e\u0432.\n<li class=\"l\"> DeployMgmt &#8212; \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0447\u0435\u0440\u0432\u044f, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440.\n<li class=\"l\"> Owned &#8212; \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0437\u0430 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0436\u0435 \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.\n<li class=\"l\"> Assemble &#8212; \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u0444\u0430\u0439\u043b \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u0437 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0431\u043b\u043e\u043a\u043e\u0432.\n<li class=\"l\"> Antivir &#8212; \u043c\u043e\u0434\u0443\u043b\u044c \u043f\u043e\u0434\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u043a\u0443\u0440\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442 \u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0441\u043e \u0441\u0442\u0440\u043e\u043a\u043e\u0439 &#171;xmr&#187;, \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044e\u0449\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u044b CPU.\n<li class=\"l\"> Libexec &#8212; \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u043e\u0432\u0430\u043b\u044e\u0442\u044b Monero.\n<\/ul>\n<p>FritzFrogis kasutatav P2P-protokoll toetab umbes 30 k\u00e4sku, mis vastutavad andmete edastamise, skriptide k\u00e4ivitamise, kahjuliku tarkvara komponentide edastamise, oleku k\u00fcsitlemise, logide vahetamise, prokside k\u00e4ivitamise jms eest. Teave edastatakse eraldi kr\u00fcpteeritud kanali kaudu, kasutades JSON formaati. Kr\u00fcpteerimiseks kasutatakse as\u00fcmmeetri kr\u00fcpti AES ja kodeerimist Base64. V\u00f5tmete vahetamiseks kasutatakse DH protokolli (<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Diffie%E2%80%93Hellman_key_exchange\">Diffie-Hellman<\/a><\/noindex>). S\u00f5lmed vahetavad pidevalt ping-kutseid seisundi m\u00e4\u00e4ramiseks. <\/p>\n<p>\u0412\u0441\u0435 \u0443\u0437\u043b\u044b \u0431\u043e\u0442\u043d\u0435\u0442\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u0443\u044e \u0411\u0414 \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0443\u0435\u043c\u044b\u0445 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u0426\u0435\u043b\u0438 \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u0431\u043e\u0442\u043d\u0435\u0442\u0443 &#8212; \u043a\u0430\u0436\u0434\u044b\u0439 \u0443\u0437\u0435\u043b \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0446\u0435\u043b\u044c, \u0442.\u0435. \u0434\u0432\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0437\u043b\u0430 \u0431\u043e\u0442\u043d\u0435\u043d\u0442\u0430 \u043d\u0435 \u0431\u0443\u0434\u0443\u0442 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0445\u043e\u0441\u0442. \u0423\u0437\u043b\u044b \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0431\u0438\u0440\u0430\u044e\u0442 \u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0442 \u0441\u043e\u0441\u0435\u0434\u044f\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0443, \u0442\u0430\u043a\u0443\u044e \u043a\u0430\u043a \u0440\u0430\u0437\u043c\u0435\u0440 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438, uptime, \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u043d\u0430 CPU \u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432\u0445\u043e\u0434\u043e\u0432 \u043f\u043e SSH. \u0414\u0430\u043d\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0437\u043b\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u0430\u0439\u043d\u0438\u043d\u0433 \u043d\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0438\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u0447\u0430\u0441\u0442\u044b\u043c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430).<\/p>\n<p>FritzFrogi tuvastamiseks on uurijad pakkunud lihtsat <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/guardicore\/labs_campaigns\/blob\/master\/FritzFrog\/detect_fritzfrog.sh\">shelli skripti<\/a><\/noindex>. S\u00fcsteemi nakatumise m\u00e4\u00e4ramiseks<br \/>\nv\u00f5ib kasutada m\u00e4rke nagu kuuldava \u00fchenduse olemasolu sadamal 1234, kohalolek <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/guardicore\/labs_campaigns\/blob\/master\/FritzFrog\/ssh_key.md\">kahjulik v\u00f5tme<\/a><\/noindex> \u0432 authorized_keys (\u043d\u0430 \u0432\u0441\u0435\u0445 \u0443\u0437\u043b\u044b \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u044b\u0439 SSH-\u043a\u043b\u044e\u0447) \u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 &#171;ifconfig&#187;, &#171;libexec&#187;, &#171;php-fpm&#187; \u0438 &#171;nginx&#187;, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u0445 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 (&#171;\/proc\/&lt;PID&gt;\/exe&#187; \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b). \u041f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u043c \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u0441\u043b\u0443\u0436\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0440\u0442 5555, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e  \u043a \u0442\u0438\u043f\u043e\u0432\u043e\u043c\u0443 \u043f\u0443\u043b\u0443 web.xmrpool.eu \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b Monero.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53573\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Guardicore, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0435 \u0434\u0430\u0442\u0430\u0446\u0435\u043d\u0442\u0440\u043e\u0432 \u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u043e\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e FritzFrog, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 Linux. FritzFrog \u0441\u043e\u0447\u0435\u0442\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u0435 \u0447\u0435\u0440\u0432\u044c, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0435\u0437 bruteforce-\u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u043f\u043e\u0440\u0442\u043e\u043c SSH, \u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0431\u043e\u0442\u043d\u0435\u0442\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0433\u043e \u0431\u0435\u0437 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0443\u0437\u043b\u043e\u0432 \u0438 \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e \u0435\u0434\u0438\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u043e\u0442\u043a\u0430\u0437\u0430. \u0414\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f \u0431\u043e\u0442\u043d\u0435\u043d\u0442\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91920,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91919","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Guardicore, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0435 \u0434\u0430\u0442\u0430\u0446\u0435\u043d\u0442\u0440\u043e\u0432 \u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u0438\u043b\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-cherv-fritzfrog-porazhayushhij-servery-po-ssh-i-stroyashhij-deczentralizovannyj-botnet\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d \u0447\u0435\u0440\u0432\u044c FritzFrog, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043f\u043e SSH \u0438 \u0441\u0442\u0440\u043e\u044f\u0449\u0438\u0439 \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0431\u043e\u0442\u043d\u0435\u0442 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Guardicore, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0435 \u0434\u0430\u0442\u0430\u0446\u0435\u043d\u0442\u0440\u043e\u0432 \u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u0438\u043b\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-cherv-fritzfrog-porazhayushhij-servery-po-ssh-i-stroyashhij-deczentralizovannyj-botnet\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-20T11:41:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-20T11:41:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Avastatud uss FritzFrog, mis r\u00fcndab servereid SSH kaudu ja ehitab detsentraliseeritud botiv\u00f5rku | ProHoster","description":"Ettev\u00f5te Guardicore, mis spetsialiseerub andmekeskuste ja pilves\u00fcsteemide kaitsele, avastas.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-cherv-fritzfrog-porazhayushhij-servery-po-ssh-i-stroyashhij-deczentralizovannyj-botnet","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u044f\u0432\u043b\u0435\u043d \u0447\u0435\u0440\u0432\u044c FritzFrog, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043f\u043e SSH \u0438 \u0441\u0442\u0440\u043e\u044f\u0449\u0438\u0439 \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0431\u043e\u0442\u043d\u0435\u0442 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Guardicore, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0435 \u0434\u0430\u0442\u0430\u0446\u0435\u043d\u0442\u0440\u043e\u0432 \u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u0438\u043b\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vyyavlen-cherv-fritzfrog-porazhayushhij-servery-po-ssh-i-stroyashhij-deczentralizovannyj-botnet","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-20T11:41:55+00:00","article:modified_time":"2020-08-20T11:41:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91919","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:27","updated":"2022-10-04 19:20:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=91919"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91919\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/91920"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=91919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=91919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=91919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}