{"id":30311,"date":"2019-10-31T21:34:49","date_gmt":"2019-10-31T18:34:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/analiz-atak-na-hanipot-cowrie\/"},"modified":"2019-10-31T21:34:49","modified_gmt":"2019-10-31T18:34:49","slug":"analiz-atak-na-hanipot-cowrie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/analiz-atak-na-hanipot-cowrie","title":{"rendered":"Analiza napada na honeypot Cowrie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Statistika za 24 sata nakon postavljanja honeypota na \u010dvoru Digital Ocean u Singapuru<\/b> <\/p>\n

Piu-piu! Po\u010dnimo odmah s kartom napada<\/h1>\n

\nNa\u0161a super cool karta prikazuje jedinstvene ASN-ove koji su se povezivali na na\u0161 honeypot Cowrie u posljednja 24 sata. \u017duta boja odgovara SSH vezama, a crvena \u2013 Telnetu. Ove animacije \u010desto impresioniraju upravni odbor tvrtke, \u0161to omogu\u0107ava osiguranje dodatnog financiranja za sigurnost i resurse. Ipak, karta ima neku vrijednost, jasno prikazuju\u0107i geografsko i organizacijsko \u0161irenje izvora napada na na\u0161 host u samo 24 sata. U animaciji se ne prikazuje koli\u010dina prometa iz svakog izvora.
\n<\/a><\/noindex><\/p>\n

\u0160to je Pew Pew karta?<\/h3>\n

\nPew Pew karta<\/i> \u2014 to je vizualizacija cyber napada<\/a><\/noindex>, obi\u010dno animirana i vrlo lijepa. To je moderan na\u010din prodaje va\u0161eg proizvoda, poznat po tome \u0161to ga je koristila tvrtka Norse Corp. Te tvrtke imali su lo\u0161 zavr\u0161etak: ispostavilo se da su lijepe animacije njihova jedina vrlina, a za analizu su koristili fragmentirane podatke.<\/p>\n

Napravljen s Leafletjs<\/h3>\n

\nZa one koji \u017eele razviti kartu napada za veliki ekran u operativnom centru (va\u0161em \u0161efu \u0107e se svidjeti), postoji biblioteka leafletjs<\/a><\/noindex>. Kombiniramo je s pluginom leaflet migration layer<\/a><\/noindex>, uslugom Maxmind GeoIP \u2013 i to je to<\/a><\/noindex>.<\/p>\n

\"Analiza<\/a><\/noindex><\/p>\n

WTF: \u0161to je jo\u0161 taj honeypot Cowrie?<\/h1>\n

\nHoneypot je sustav koji se postavlja u mre\u017eu posebno za privla\u010denje zlonamjernih aktera. Povezivanja na sustav obi\u010dno su ilegalna i omogu\u0107uju otkrivanje napada\u010da putem detaljnih logova. Logovi \u010duvaju ne samo uobi\u010dajene informacije o vezama, ve\u0107 i informacije o sesiji, otkrivaju\u0107i tehnike, taktike i procedure (TTP)<\/b> napada\u010da.<\/p>\n

Honeypot Cowrie<\/a><\/noindex> predvi\u0111en je za bilje\u017eenje SSH i Telnet veza<\/b>. Ovi honeypoti \u010desto se izla\u017eu internetu radi pra\u0107enja alata, skripti i hostova napada\u010da.<\/p>\n

Moja poruka za tvrtke koje misle da nisu na meti napada: \"Lo\u0161e tra\u017eite.\"
\n\u2014 James Snook<\/i><\/p><\/blockquote>\n

\n\"Analiza
\n<\/p>\n

\u0160to je u logovima?<\/h1>\n

<\/p>\n

Ukupan broj veza<\/h3>\n

\nIz vi\u0161e hostova dolazile su vi\u0161ekratne poku\u0161aje povezivanja. To je normalno, jer su skripti napada\u010da napunjene popisom vjerodajnica i oni isprobavaju vi\u0161e kombinacija. Honeypot Cowrie postavljen je za prihva\u0107anje odre\u0111enih kombinacija korisni\u010dkog imena i lozinke. To se konfigurira u datoteci user.db<\/b>.<\/p>\n

\"Analiza
\n<\/p>\n

Geografija napada<\/h3>\n

\nPrema podacima geolokacije Maxmind, izbrojao sam broj veza iz svake zemlje. Brazil i Kina prednja\u010de sa velikom razlikom, iz tih zemalja \u010desto dolazi puno buke od skenera.<\/p>\n

\"Analiza
\n<\/p>\n

Vlasnik mre\u017enog bloka<\/h3>\n

\nIstra\u017eivanje vlasnika mre\u017enih blokova (ASN) mo\u017ee otkriti organizacije s velikim brojem napada\u010dkih hostova. Naravno, u tim slu\u010dajevima uvijek treba imati na umu da mnogi napadi dolaze s zara\u017eenih hostova. Razmjerno je pretpostaviti da ve\u0107ina zlonamjernika nije toliko glupa da skenira mre\u017eu s ku\u0107nog ra\u010dunala.<\/p>\n

\"Analiza
\n<\/p>\n

Otvorene portove na napada\u010dkim sustavima (podaci Shodan.io)<\/h3>\n

\nProlazak liste IP-ova kroz izvrstan Shodan API<\/a><\/noindex> brzo odre\u0111uje sustave s otvorenim portovima<\/b> i koje su to portove. Na slici ispod prikazana je koncentracija otvorenih portova po zemljama i organizacijama. Moglo bi se otkriti blokove kompromitiranih sustava, ali unutar malog uzorka<\/b> ne vidi se ni\u0161ta izvanredno, osim velikog broja otvorenih portova 500 u Kini.<\/b>.<\/p>\n

Zanimljivo otkri\u0107e - veliki broj sustava u Brazilu, koji imaju zatvorene portove 22, 23<\/b> ili ostale portove<\/b>, prema podacima Censys i Shodan. Na\u017ealost, \u010dini se da su to veze s ra\u010dunalima krajnjih korisnika.<\/p>\n

\"Analiza
\n <\/p>\n

Botovi? Ne nu\u017eno<\/h3>\n

\nPodaci Censys<\/a><\/noindex> za portove 22 i 23 toga dana prikazali su ne\u0161to \u010dudno. Pretpostavljao sam da ve\u0107ina skeniranja i napada s lozinkama dolazi od botova. Skripta se \u0161iri kroz otvorene portove, probijaju\u0107i lozinke, a s novog sustava kopira se i nastavlja \u0161iriti istom metodom.<\/p>\n

No ovdje se vidi da samo mali broj hostova koji skeniraju telnet imaju otvoreni port 23. To zna\u010di da su sustavi ili kompromitirani na neki drugi na\u010din, ili zlonamjernici pokre\u0107u skripte ru\u010dno.<\/p>\n

\"Analiza
\n<\/p>\n

Ku\u0107ne veze<\/h3>\n

\nJo\u0161 jedno zanimljivo otkri\u0107e bio je veliki broj ku\u0107nih korisnika u uzorku. Uz pomo\u0107 obratnog pregleda <\/b> odredio sam 105 veza s konkretnih ku\u0107nih ra\u010dunala. Za mnoge ku\u0107ne veze, obratni pregled DNS-a prikazuje naziv hosta sa rije\u010dima dsl, home, cable, fiber i tako dalje.<\/p>\n

\"Analiza
\n<\/p>\n

U\u010dite i istra\u017eujte: podignite svoj vlastiti honeypot<\/h1>\n

\nNedavno sam napisao kratak priru\u010dnik kako postaviti honeypot Cowrie na svom sustavu.<\/a><\/noindex>. Kao \u0161to je ve\u0107 spomenuto, u na\u0161em slu\u010daju koristio se Digital Ocean VPS u Singapuru. Za 24 sata analize tro\u0161ak je iznosio samo nekoliko centi, a vreme za instalaciju sistema je bilo 30 minuta.<\/p>\n

Umesto da pokre\u0107ete Cowrie na internetu i privla\u010dite sav \u0161um, mo\u017eete izvu\u0107i korist od honeypota u lokalnoj mre\u017ei. Samo postavite obave\u0161tenje ako su na odre\u0111ene portove stigli zahtevi. To mo\u017ee biti ili napada\u010d unutar mre\u017ee, ili radoznali zaposlenik, ili skeniranje ranjivosti.<\/p>\n

Zaklju\u010dci<\/h1>\n

\nNakon pregleda aktivnosti napada\u010da tokom dana, jasno je da nije mogu\u0107e izdvojiti o\u010digledni izvor napada unutar neke organizacije, zemlje ili \u010dak operativnog sistema.<\/p>\n

\u0160iroka rasprostranjenost izvora pokazuje da je \u0161um skeniranja konstantan i nije povezan s odre\u0111enim izvorom. Svako ko radi na internetu treba da osigura da njegov sistem ima nekoliko nivoa sigurnosti<\/b>. Uobi\u010dajeno i efikasno re\u0161enje za SSH<\/b> bi bilo premestiti uslugu na nasumi\u010dan visoki port. To ne osloba\u0111a potrebu za strogom za\u0161titom lozinkom i nadzorom, ali barem garantuje da se logovi ne zagu\u0161uju stalnim skeniranjem. Povezivanja na visokom portu su sa ve\u0107om verovatno\u0107om ciljana napada koja bi vas mogla zanimati.<\/p>\n

\u010cesto su otvoreni telnet portovi na rutere ili drugim ure\u0111ajima, tako da ih nije lako premestiti na visoki port. Informacije o svim otvorenim portovima<\/a><\/noindex> i napada\u010dke povr\u0161ine<\/a><\/noindex> su jedini na\u010din da se osigura da su te usluge za\u0161ti\u0107ene vatrozidom ili isklju\u010dene. Ako je mogu\u0107e, ne treba koristiti Telnet uop\u0161te, ovaj protokol nije \u0161ifrovan. Ako je neophodan i bez njega ne ide, pa\u017eljivo ga nadgledajte i koristite pouzdane lozinke.
\n
Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443! \u041d\u0430\u0447\u043d\u0451\u043c \u0441\u0440\u0430\u0437\u0443 \u0441 \u043a\u0430\u0440\u0442\u044b \u0430\u0442\u0430\u043a \u041d\u0430\u0448\u0430 \u0441\u0443\u043f\u0435\u0440\u043a\u043b\u0430\u0441\u0441\u043d\u0430\u044f \u043a\u0430\u0440\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 ASN, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u043b\u0438\u0441\u044c \u043a \u043d\u0430\u0448\u0435\u043c\u0443 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0443 Cowrie \u0437\u0430 24 \u0447\u0430\u0441\u0430. \u0416\u0451\u043b\u0442\u044b\u0439 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u043a\u0440\u0430\u0441\u043d\u044b\u0439\u00a0\u2014 Telnet. \u0422\u0430\u043a\u0438\u0435 \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0438 \u0447\u0430\u0441\u0442\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u044f\u044e\u0442 \u0441\u043e\u0432\u0435\u0442 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0431\u0438\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30311","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Analiza napada na honeypot Cowrie | ProHoster","description":"Statistika tokom 24 sata nakon instalacije honeypota na \u010dvoru Digital Ocean u Singapuru Piu-piu!","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/analiz-atak-na-hanipot-cowrie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u0430\u0442\u0430\u043a \u043d\u0430 \u0445\u0430\u043d\u0438\u043f\u043e\u0442 Cowrie | ProHoster","og:description":"\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443!","og:url":"https:\/\/prohoster.info\/hr\/blog\/analiz-atak-na-hanipot-cowrie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:49+00:00","article:modified_time":"2019-10-31T18:34:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30311","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/30311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=30311"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/30311\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=30311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=30311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=30311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}