{"id":54400,"date":"2019-12-25T00:00:00","date_gmt":"2019-12-24T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii"},"modified":"2020-02-18T14:02:24","modified_gmt":"2020-02-18T11:02:24","slug":"kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","title":{"rendered":"Hackeri chinezi prin\u0219i pe ocolind autentificarea cu doi factori","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hackeri chinezi au fost captura\u021bi<\/a><\/noindex> \u00een timp ce ocoleau autentificarea cu dou\u0103 fapte, dar nu este sigur. Mai jos sunt prezentate presupunerile companiei olandeze Fox-IT, care se specializeaz\u0103 \u00een servicii de consultan\u021b\u0103 \u00een domeniul securit\u0103\u021bii cibernetice. Se presupune, f\u0103r\u0103 dovezi directe, c\u0103 o grupare de hackeri cunoscut\u0103 sub numele de APT20 lucreaz\u0103 pentru structuri guvernamentale chineze.<\/p>\n

\"Hackeri<\/p>\n

Activit\u0103\u021bile de hacking atribuite grupului APT20 au fost descoperite pentru prima dat\u0103 \u00een 2011. \u00centre 2016 \u0219i 2017, grupul a disp\u0103rut din aten\u021bia speciali\u0219tilor, iar recent Fox-IT a descoperit urme ale interven\u021biei APT20 \u00een re\u021belele unuia dintre clien\u021bii s\u0103i, care a solicitat o investiga\u021bie a \u00eenc\u0103lc\u0103rilor de securitate cibernetic\u0103.<\/p>\n

Potrivit Fox-IT, \u00een ultimii doi ani, gruparea APT20 s-a ocupat cu hackingul \u0219i accesul la datele structurilor guvernamentale, companiilor mari \u0219i furnizorilor de servicii din SUA, Fran\u021ba, Germania, Italia, Mexic, Portugalia, Spania, Regatul Unit \u0219i Brazilia. De asemenea, hackerii din APT20 au fost activi \u00een domenii precum avia\u021bia, s\u0103n\u0103tatea, finan\u021bele, asigur\u0103rile, energia \u0219i chiar \u00een domeniile jocurilor de noroc \u0219i sistemelor de \u00eenchidere electronic\u0103.<\/p>\n

<\/center><\/p>\n

De obicei, hackerii din APT20 foloseau vulnerabilit\u0103\u021bi din serverele web pentru a accesa sistemele victimelor, \u00een special pe platforma de aplica\u021bii corporative JBoss. Dup\u0103 accesare \u0219i instalarea shell-urilor, hackerii p\u0103trundeau \u00een re\u021belele victimelor \u00een toate sistemele posibile. Conturile g\u0103site le permiteau infractorilor s\u0103 fure date folosind instrumente standard, f\u0103r\u0103 a instala programe malware. Dar principalul inconvenient este c\u0103 gruparea APT20 ar fi reu\u0219it s\u0103 ocoleasc\u0103 autentificarea cu dou\u0103 fapte cu ajutorul tokenurilor.<\/p>\n

\"Hackeri<\/p>\n

Cercet\u0103torii sus\u021bin c\u0103 au g\u0103sit urme ale hackerilor care s-au conectat la conturile VPN, protejate de autentificarea cu dou\u0103 fapte. Cum s-a \u00eent\u00e2mplat acest lucru, speciali\u0219tii Fox-IT pot doar specula. Cea mai probabil\u0103 variant\u0103 este c\u0103 hackerii au reu\u0219it s\u0103 fure un token programatic RSA SecurID din sistemul hackuit. Cu ajutorul programului furat, ulterior hackerii ar fi putut genera coduri unice pentru a ocoli protec\u021bia cu dou\u0103 fapte.<\/p>\n

\u00cen condi\u021bii normale, acest lucru nu este posibil. Tokenul software nu func\u021bioneaz\u0103 f\u0103r\u0103 a fi conectat la sistemul local al tokenului hardware. F\u0103r\u0103 acesta, programul RSA SecurID va genera o eroare. Tokenul software este creat pentru un sistem specific \u0219i, av\u00e2nd acces la \u201ehardware\u201d-ul victimei, se poate ob\u021bine un num\u0103r specific pentru a activa tokenul software.<\/p>\n

\"Hackeri<\/p>\n

Speciali\u0219tii de la Fox-IT sus\u021bin c\u0103 pentru a lansa un token software (furt) nu este deloc necesar s\u0103 ai acces la computerul \u0219i tokenul hardware al victimei. \u00centregul complex de verificare ini\u021bial\u0103 se desf\u0103\u0219oar\u0103 doar la importul vectorului ini\u021bial de generare - un num\u0103r aleator de 128 bi\u021bi, corespunz\u0103tor unui token specific (SecurID Token Seed<\/a><\/noindex>). Acest num\u0103r nu are leg\u0103tur\u0103 cu num\u0103rul ini\u021bial, care este apoi asociat gener\u0103rii efective a tokenului software. Dac\u0103 verificarea SecurID Token Seed poate fi cumva ocolit\u0103 (patch-uit\u0103), nimic nu va \u00eempiedica ulterior generarea codurilor pentru autentificarea cu doi factori. Compania Fox-IT declar\u0103 c\u0103 ocolirea verific\u0103rii se poate realiza prin modificarea unei singure instruc\u021biuni. Dup\u0103 aceasta, sistemul victimei va fi complet \u0219i legal deschis atacatorului f\u0103r\u0103 utilizarea de utilitare speciale \u0219i shell-uri.<\/p>\n

<\/p>\n

<\/center><\/p>\n

\t\t\t\t


\n\t\t\t\t\t\t\t\t<\/center>
Sursa: 3dnews.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u043d\u043e \u044d\u0442\u043e \u043d\u0435 \u0442\u043e\u0447\u043d\u043e. \u041d\u0438\u0436\u0435 \u0431\u0443\u0434\u0443\u0442 \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0433\u043e\u043b\u043b\u0430\u043d\u0434\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fox-IT, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0443\u0441\u043b\u0443\u0433\u0430\u0445 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0435\u043c\u0443 \u043d\u0435\u0442 \u043f\u0440\u044f\u043c\u044b\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432, \u0447\u0442\u043e \u043d\u0430 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0433\u0440\u0443\u043f\u043f\u0430 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u0438\u043c\u044f APT20. \u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0435 APT20, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432 2011 \u0433\u043e\u0434\u0443. \u0412 2016–2017 \u0433\u043e\u0434\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54400","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hackeri chinezi prin\u0219i \u00een timp ce ocoleau autentificarea cu doi factori | ProHoster","description":"Hackeri chinezi prin\u0219i \u00een timp ce ocoleau autentificarea cu doi factori.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-24T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54400","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:13:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:06:38","updated":"2026-01-24 11:13:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/54400","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=54400"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/54400\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=54400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=54400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=54400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}