{"id":55145,"date":"2020-01-13T00:00:00","date_gmt":"2020-01-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta"},"modified":"2020-02-18T14:03:13","modified_gmt":"2020-02-18T11:03:13","slug":"obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta","title":{"rendered":"\u00cen\u0219al\u0103-m\u0103, dac\u0103 po\u021bi: caracteristici ale realiz\u0103rii unei pentest\u0103ri socio-tehnice","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"\u00cen\u0219al\u0103-m\u0103, dac\u0103 po\u021bi: caracteristici ale realiz\u0103rii unei pentest\u0103ri socio-tehnice\" src=\"\/wp-content\/uploads\/2020\/01\/fa938cb2a5cb85adb395a1b2c3b14d4b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nImagina\u021bi-v\u0103 urm\u0103toarea situa\u021bie: o diminea\u021b\u0103 rece de octombrie, un institut de proiectare \u00eentr-unul dintre ora\u0219ele regionale din Rusia. Cineva din departamentul de resurse umane acceseaz\u0103 una dintre paginile de joburi de pe site-ul institutului, publicat\u0103 cu c\u00e2teva zile \u00een urm\u0103, \u0219i vede acolo o fotografie cu o pisic\u0103. Diminea\u021ba \u00eenceteaz\u0103 s\u0103 mai fie plictisitoare... <\/p>\n<p>\u00cen acest articol, Pavel Suprunuk, \u0219eful departamentului de audit \u0219i consultan\u021b\u0103 la Group-IB, poveste\u0219te despre locul pe care \u00eel ocup\u0103 atacurile socio-tehnice \u00een proiectele de evaluare a securit\u0103\u021bii practice, ce forme neobi\u0219nuite pot lua acestea \u0219i cum putem s\u0103 ne protej\u0103m de astfel de atacuri. Autorul precizeaz\u0103 c\u0103 articolul are un caracter de sintez\u0103, totu\u0219i, dac\u0103 un anumit aspect intereseaz\u0103 cititorii, exper\u021bii Group-IB vor r\u0103spunde cu pl\u0103cere la \u00eentreb\u0103rile din comentarii. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex> <\/p>\n<h2>Partea 1. De ce at\u00e2t de serios?<\/h2>\n<p>\nS\u0103 ne \u00eentoarcem la pisica noastr\u0103. Dup\u0103 un timp, departamentul de resurse umane \u0219terge fotografia (capturile de ecran de aici \u0219i din continuare sunt par\u021bial retu\u0219ate pentru a nu dezv\u0103lui numele reale), dar aceasta revine insistent; iar ei o \u0219terg din nou, \u0219i a\u0219a se \u00eent\u00e2mpl\u0103 de c\u00e2teva ori. \u00cen departamentul de resurse umane \u00ee\u0219i dau seama c\u0103 inten\u021biile pisicii sunt foarte serioase, nu vrea s\u0103 plece, a\u0219a c\u0103 apeleaz\u0103 la ajutorul unui programator web - persoana care a realizat site-ul, se pricepe la el \u0219i acum \u00eel administreaz\u0103. Programatorul acceseaz\u0103 site-ul, \u0219terge din nou pisica enervant\u0103, constat\u0103 c\u0103 a fost postat\u0103 \u00een numele departamentului de resurse umane \u0219i face presupunerea c\u0103 parola departamentului a ajuns la ni\u0219te huligani din re\u021beaua social\u0103, apoi o schimb\u0103. Pisica nu mai apare.<\/p>\n<p><img decoding=\"async\" alt=\"\u00cen\u0219al\u0103-m\u0103, dac\u0103 po\u021bi: caracteristici ale realiz\u0103rii unei pentest\u0103ri socio-tehnice\" src=\"\/wp-content\/uploads\/2020\/01\/319d5d30d3b563897339362e0fac1a6e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCe s-a \u00eent\u00e2mplat, de fapt? \u00cen leg\u0103tur\u0103 cu grupul de companii din care f\u0103cea parte institutul, speciali\u0219tii de la Group-IB au realizat un test de penetrare \u00eentr-un format apropiat de Red Teaming (pe scurt, aceasta este o simulare a atacurilor \u021bintite asupra companiei dvs. utiliz\u00e2nd cele mai avansate metode \u0219i instrumente din arsenalul grup\u0103rilor de hackeri). Am vorbit detaliat despre Red Teaming. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/group-ib\/blog\/460461\/\">aici<\/a><\/noindex>Este important de \u0219tiut c\u0103, la realizarea acestui test, poate fi aplicat un spectru foarte larg de atacuri din cele convenite anterior, inclusiv inginerie social\u0103. E clar c\u0103 plasarea pisicii nu a fost scopul final al ac\u021biunii. Iar scopul a fost urm\u0103torul:<\/p>\n<ul>\n<li>site-ul institutului a fost g\u0103zduit pe un server din propria re\u021bea a institutului, \u0219i nu pe servere externe;<\/li>\n<li>s-a descoperit o bre\u0219\u0103 a contului de resurse umane (fi\u0219ier de jurnal al mesajelor \u00een r\u0103d\u0103cina site-ului). Nu a fost posibil s\u0103 se administreze site-ul cu acest cont, dar paginile de angajare puteau fi editate;<\/li>\n<li>Modific\u00e2nd paginile, era posibil s\u0103 \u00ee\u021bi \u00eencorporezi propriile scripturi \u00een JavaScript. De obicei, acestea fac paginile interactive, dar \u00een aceast\u0103 situa\u021bie, acelea\u0219i scripturi puteau fura din browserul vizitatorului ceea ce distinge contul de resurse umane de programator \u0219i programatorul de un vizitator obi\u0219nuit - identificatorul sesiunii de pe site. Pisica a fost declan\u0219atorul atacului \u0219i imaginea pentru a atrage aten\u021bia. \u00cen limbajul de marcare HTML, acesta ar\u0103ta astfel: dac\u0103 s-a \u00eenc\u0103rcat o imagine, JavaScript-ul s-a executat deja \u0219i identificatorul t\u0103u de sesiune, \u00eempreun\u0103 cu datele despre browserul t\u0103u \u0219i adresa ta IP, au fost deja furate.<\/li>\n<li> Cu identificatorul de sesiune al administratorului furat, ar fi fost posibil s\u0103 ob\u021bii acces complet la site, s\u0103 \u00eencarci pagini executable \u00een PHP, ceea ce ar fi dus la accesul \u00een sistemul de operare al serverului \u0219i apoi \u00een re\u021beaua local\u0103, ceea ce a fost o \u021bint\u0103 intermediar\u0103 important\u0103 a proiectului.<\/li>\n<\/ul>\n<p>\nAtacul s-a \u00eencheiat cu un succes par\u021bial - identificatorul de sesiune al administratorului a fost furat, dar acesta era legat de adresa IP. Nu am reu\u0219it s\u0103 o ocolim, nu am putut s\u0103 ne ridic\u0103m privilegiile pe site la cele de administrator, \u00eens\u0103 ne-am \u00eembun\u0103t\u0103\u021bit dispozi\u021bia. Rezultatul final a fost ob\u021binut \u00een cele din urm\u0103 pe alt\u0103 parte a perimetrului de re\u021bea.<\/p>\n<h2>Partea 2. \u00ce\u021bi scriu - ce mai e? De asemenea, sun \u0219i m\u0103 plimb \u00een biroul t\u0103u, l\u0103s\u00e2nd flash-uri;<br \/>\n<\/h2>\n<p>\nCeea ce s-a \u00eent\u00e2mplat \u00een situa\u021bia cu pisica este un exemplu de inginerie social\u0103, de\u0219i nu tocmai clasic. De fapt, \u00een aceast\u0103 poveste au fost mai multe evenimente: a fost o pisic\u0103, un institut, departamentul de resurse umane \u0219i un programator, dar au fost \u0219i emailuri cu \u00eentreb\u0103ri de clarificare, scrise aparent de \"candidati\" c\u0103tre departamentul de resurse umane \u0219i personal c\u0103tre programator, pentru a-i provoca s\u0103 acceseze pagina site-ului.<\/p>\n<blockquote><p>Apropo de emailuri. Un email obi\u0219nuit - probabil principalul mijloc de transport pentru ingineria social\u0103 - nu \u0219i-a pierdut relevan\u021ba de c\u00e2teva decenii \u0219i uneori duce la cele mai neobi\u0219nuite consecin\u021be. <\/p><\/blockquote>\n<p>Urm\u0103toarea poveste este adesea spus\u0103 la evenimentele noastre, deoarece este foarte reprezentativ\u0103.<\/p>\n<p>De obicei, pe baza rezultatelor proiectelor de inginerie social\u0103, \u00eentocmim statistici care, a\u0219a cum se \u0219tie, sunt lucruri seci \u0219i plictisitoare. Un anumit procent din destinatari a deschis ata\u0219amentul din email, un alt grup a accesat linkul, iar ace\u0219ti trei au introdus efectiv numele de utilizator \u0219i parola. \u00centr-un proiect, am \u00eenregistrat mai mult de 100% din introducerea parolelor \u2014 adic\u0103 au fost mai multe intr\u0103ri dec\u00e2t am trimis. <\/p>\n<p>Asta s-a \u00eent\u00e2mplat astfel: s-a trimis un email de phishing, pretins a fi de la CISO-ul unei corpora\u021bii de stat, solicit\u00e2nd \u201eurgenta testare a modific\u0103rilor \u00een serviciul de po\u0219t\u0103\u201d. Emailul a ajuns la \u0219eful unei mari subdiviziuni care se ocupa cu suportul tehnic. \u0218eful era foarte dedicat \u00een \u00eendeplinirea sarcinilor de la conducerea superioar\u0103 \u0219i l-a retransmis tuturor subordona\u021bilor. Call-centerul s-a dovedit a fi destul de mare. \u00cen general, situa\u021biile \u00een care cineva retrimite \u201eemailuri interesante\u201d de phishing colegilor s\u0103i \u0219i ace\u0219tia cad, sunt destul de frecvente. Pentru noi, aceasta este cea mai bun\u0103 feedback referitor la calitatea redact\u0103rii emailului.<\/p>\n<p><img decoding=\"async\" alt=\"\u00cen\u0219al\u0103-m\u0103, dac\u0103 po\u021bi: caracteristici ale realiz\u0103rii unei pentest\u0103ri socio-tehnice\" src=\"\/wp-content\/uploads\/2020\/01\/2af30148f4b5d22033c5137625f421ab.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPu\u021bin mai t\u00e2rziu, ne-au demascat (emailul a fost trimis dintr-o c\u0103su\u021b\u0103 po\u0219tal\u0103 compromis\u0103):<\/p>\n<p><img decoding=\"async\" alt=\"\u00cen\u0219al\u0103-m\u0103, dac\u0103 po\u021bi: caracteristici ale realiz\u0103rii unei pentest\u0103ri socio-tehnice\" src=\"\/wp-content\/uploads\/2020\/01\/1d36db3cb55d0e6d6061fb002d5f987a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAcest succes al atacului a fost determinat de faptul c\u0103, \u00een timpul trimiterii, au fost folosite o serie de deficien\u021be tehnice ale sistemului de po\u0219t\u0103 al clientului. A fost configurat \u00een a\u0219a fel \u00eenc\u00e2t s\u0103 se poat\u0103 trimite orice email \u00een numele oric\u0103rui expeditor din organiza\u021bie f\u0103r\u0103 autorizare, chiar \u0219i din internet. Adic\u0103, putea fi pretins a fi CISO, sau \u0219eful suportului tehnic, sau altcineva. Mai mult, interfa\u021ba de po\u0219t\u0103, observ\u00e2nd emailurile din \u201edomeniul s\u0103u\u201d, introducea cu grij\u0103 fotografia din agenda de contacte, ceea ce ad\u0103uga naturalitate expeditorului.<\/p>\n<p>Adev\u0103rul este c\u0103 un astfel de atac nu se \u00eencadreaz\u0103 \u00een tehnologiile foarte complexe, este o exploatare reu\u0219it\u0103 a unei deficien\u021be de baz\u0103 \u00een configurarea po\u0219tei. Acest subiect este discutat regulat pe resursele de specialitate IT \u0219i de securitate informa\u021bional\u0103, dar cu toate acestea, \u00eenc\u0103 mai exist\u0103 companii care au aceste probleme. Deoarece nimeni nu este predispus s\u0103 verifice cu minu\u021biozitate antetele serviciului de po\u0219te SMTP, emailul este de obicei verificat pentru \u201epericole\u201d \u00een func\u021bie de indicatorii de avertizare ai interfe\u021bei po\u0219tale, care nu reflect\u0103 \u00eentotdeauna \u00eentreaga imagine.<\/p>\n<blockquote><p>Este interesant c\u0103 o astfel de vulnerabilitate func\u021bioneaz\u0103 \u0219i \u00een cealalt\u0103 direc\u021bie: un atacator poate trimite un e-mail \u00een numele companiei dumneavoastr\u0103 unui destinatar ter\u021b. De exemplu, poate falsifica o factur\u0103 lunar\u0103 \u00een numele dumneavoastr\u0103, indic\u00e2nd alte detalii dec\u00e2t cele ale companiei. Dac\u0103 nu lu\u0103m \u00een considerare problemele de anti-fraud\u0103 \u0219i de \u00eencasare, acesta este probabil unul dintre cele mai simple moduri de a fura bani prin inginerie social\u0103.\n<\/p><\/blockquote>\n<p> Pe l\u00e2ng\u0103 furtul parolelor prin phishing, un element clasic al atacurilor socio-tehnologice este trimiterea de ata\u0219amente executabile. Dac\u0103 aceste ata\u0219amente reu\u0219esc s\u0103 dep\u0103\u0219easc\u0103 toate m\u0103surile de protec\u021bie, care sunt de obicei multe pentru companiile moderne, se formeaz\u0103 un canal de acces de la distan\u021b\u0103 pe computerul victimei. Pentru a demonstra consecin\u021bele atacului, controlul ob\u021binut de la distan\u021b\u0103 poate fi extins p\u00e2n\u0103 la accesul la informa\u021bii confiden\u021biale extrem de importante. De remarcat este c\u0103 majoritatea atacurilor care ne sunt prezentate de media \u00eencepe astfel. <\/p>\n<blockquote><p>\u00cen departamentul nostru de audit, din curiozitate, facem o estimare aproximativ\u0103 a statisticilor: care este valoarea total\u0103 a activelor companiilor c\u0103rora le-am avut acces la nivelul \u201eAdministrator de domeniu\u201d \u00een principal prin phishing \u0219i prin trimiterea de ata\u0219amente executabile? Anul acesta, aceasta a atins aproximativ 150 miliarde de euro.\n<\/p><\/blockquote>\n<p> Este clar c\u0103 trimiterea de e-mailuri provocatoare \u0219i postarea de fotografii cu pisici pe site-uri nu sunt singurele metode de inginerie social\u0103. \u00cen aceste exemple am \u00eencercat s\u0103 ar\u0103t\u0103m diversitatea formelor de atac \u0219i consecin\u021bele lor. \u00cen afar\u0103 de e-mailuri, un atacator poten\u021bial poate suna pentru a ob\u021bine informa\u021biile dorite, poate r\u0103sp\u00e2ndi suporturi (de exemplu, stick-uri USB) cu fi\u0219iere executabile \u00een biroul companiei \u021bint\u0103, se poate angaja ca stagiar sau poate ob\u021bine acces fizic la re\u021beaua local\u0103 sub pretextul installer-ului camerelor de supraveghere. Toate acestea, de altfel, sunt exemple din proiectele noastre finalizate cu succes.<\/p>\n<h2>Partea 3. \u00cenv\u0103\u021b\u0103tura este lumin\u0103, iar ne\u0219tiutorii sunt \u00eentuneric<\/h2>\n<p>\nSe na\u0219te o \u00eentrebare rezonabil\u0103: bine, exist\u0103 inginerie social\u0103, arat\u0103 periculos, dar ce ar trebui s\u0103 fac\u0103 companiile \u00een leg\u0103tur\u0103 cu asta? Captain Obvious vine \u00een ajutor: trebuie s\u0103 te protejezi, \u0219i asta \u00een mod complex. O parte din protec\u021bie va fi direc\u021bionat\u0103 c\u0103tre m\u0103surile de securitate deja clasice, cum ar fi mijloacele tehnice de protec\u021bie a informa\u021biilor, monitorizarea, asigurarea organizatoric\u0103-legal\u0103 a proceselor, dar, \u00een opinia noastr\u0103, cea mai mare parte ar trebui s\u0103 se concentreze pe munca direct\u0103 cu angaja\u021bii ca fiind cea mai slab\u0103 verig\u0103. Pentru c\u0103, indiferent c\u00e2t de mult \u00ee\u0219i \u00eent\u0103re\u0219te tehnica, nu exist\u0103 reglementare suficient de sever\u0103 care s\u0103 \u00eempiedice un utilizator s\u0103 g\u0103seasc\u0103 o nou\u0103 modalitate de a compromite totul. Iar reglement\u0103rile \u0219i tehnica nu vor putea \u021bine pasul cu crea\u021bia utilizatorului, mai ales dac\u0103 acesta este \u00eendrumat de un infractor calificat.<\/p>\n<blockquote><p> \u00cen primul r\u00e2nd, este important s\u0103 instrue\u0219ti utilizatorul: s\u0103-i explici c\u0103 chiar \u0219i \u00een munca sa de rutin\u0103 pot ap\u0103rea situa\u021bii legate de ingineria social\u0103. Pentru clien\u021bii no\u0219tri, adesea desf\u0103\u0219ur\u0103m <noindex><a rel=\"nofollow\" href=\"https:\/\/www.group-ib.ru\/cyber-education.html\">cursuri<\/a><\/noindex> de igien\u0103 digital\u0103 \u2014 un eveniment care \u00eenva\u021b\u0103 abilit\u0103\u021bile de baz\u0103 pentru a contracara atacurile \u00een general.\n<\/p><\/blockquote>\n<p> Pot ad\u0103uga c\u0103 una dintre cele mai bune m\u0103suri de protec\u021bie nu va fi memorarea regulilor de securitate a informa\u021biilor, ci o evaluare pu\u021bin deta\u0219at\u0103 a situa\u021biei: <\/p>\n<ol>\n<li>Cine este interlocutorul meu? <\/li>\n<li>De unde a ap\u0103rut propunerea sau cererea sa (nu a existat niciodat\u0103 a\u0219a ceva, \u0219i iat\u0103 c\u0103 a ap\u0103rut)? <\/li>\n<li>Ce este neobi\u0219nuit \u00een aceast\u0103 solicitare? <\/li>\n<\/ol>\n<p>\nChiar \u0219i un tip neobi\u0219nuit de font sau un stil de vorbire care nu corespunde expeditorului pot declan\u0219a o serie de \u00eendoieli care opresc atacul. Instruc\u021biunile scrise sunt, de asemenea, necesare, dar acestea func\u021bioneaz\u0103 diferit, neput\u00e2nd specifica toate situa\u021biile posibile. De exemplu, administratorii de securitate cibernetic\u0103 men\u021bioneaz\u0103 c\u0103 nu trebuie s\u0103 introduci parola ta pe resurse externe. Dar ce se \u00eent\u00e2mpl\u0103 dac\u0103 parola este solicitat\u0103 de o resurs\u0103 de re\u021bea \u201eproprie\u201d, \u201ecorporativ\u0103\u201d? Utilizatorul se g\u00e2nde\u0219te: \u201e\u00cen compania noastr\u0103 exist\u0103 deja dou\u0103zeci de servicii cu un singur cont, de ce s\u0103 nu apar\u0103 unul \u00een plus?\u201d De aici deriv\u0103 o alt\u0103 regul\u0103: un flux de lucru bine structurat influen\u021beaz\u0103 direct \u0219i securitatea: dac\u0103 un departament vecin poate solicita informa\u021bii doar \u00een scris \u0219i numai prin intermediul \u0219efului t\u0103u, o persoan\u0103 \u201edin partea partenerului de \u00eencredere al companiei\u201d nu va putea solicita aceste informa\u021bii prin telefon \u2014 pentru tine va fi un nonsens. Este bine s\u0103 fii precaut, mai ales dac\u0103 interlocutorul t\u0103u cere s\u0103 faci totul imediat sau \u201eASAP\u201d, cum se spune. Chiar \u0219i \u00een munc\u0103 obi\u0219nuit\u0103, o astfel de situa\u021bie nu este s\u0103n\u0103toas\u0103, iar \u00een condi\u021biile unor atacuri poten\u021biale \u2014 este un declan\u0219ator puternic. Nu este timp de explicat, ruleaz\u0103 fi\u0219ierul meu!<\/p>\n<p>Observ\u0103m c\u0103 utilizatorii sunt adesea vizati \u00een cadrul atacurilor sociotehnice cu teme legate de bani sub diverse forme: promisiuni de m\u0103riri, privilegii, cadouri, precum \u0219i informa\u021bii despre zvonuri \u0219i intrigi aparent locale. Cu alte cuvinte, func\u021bioneaz\u0103 p\u0103catele capitale: l\u0103comia, avari\u021bia \u0219i curiozitatea excesiv\u0103. <\/p>\n<p>O bun\u0103 formare ar trebui \u00eentotdeauna s\u0103 includ\u0103 practic\u0103. Aici pot interveni speciali\u0219tii \u00een teste de penetrabilitate. Urm\u0103toarea \u00eentrebare este: ce \u0219i cum vom testa? Noi, la Group-IB, propunem urm\u0103toarea abordare \u2014 s\u0103 alegem imediat focalizarea test\u0103rii: fie s\u0103 evalu\u0103m preg\u0103tirea utilizatorilor pentru atacuri, fie s\u0103 verific\u0103m securitatea companiei \u00een ansamblu. Iar testarea prin metode de inginerie social\u0103, imit\u00e2nd atacuri reale \u2014 adic\u0103 prin phishing, trimiterea de documente executabile, apeluri telefonice \u0219i alte tehnici.<\/p>\n<p>\u00cen primul caz, atacul este preg\u0103tit cu aten\u021bie \u00eempreun\u0103 cu reprezentan\u021bii clientului, \u00een principal cu speciali\u0219tii s\u0103i IT \u0219i de securitate informa\u021bional\u0103. Se concord\u0103 legendele, instrumentele \u0219i tehnicile atacurilor. Clientul furnizeaz\u0103 singur grupuri de focus \u0219i liste de utilizatori pentru atac, care includ toate contactele necesare. Se fac excep\u021bii pe mijloacele de protec\u021bie, deoarece mesajele \u0219i \u00eenc\u0103rc\u0103turile executabile trebuie neap\u0103rat s\u0103 ajung\u0103 la destinatar, fiindc\u0103 \u00een acest proiect interesul const\u0103 doar \u00een reac\u021bia oamenilor. Op\u021bional, pot fi incluse \u00een atac m\u0103rci care s\u0103 sugereze utilizatorului c\u0103 este vorba despre un atac \u2014 de exemplu, se pot face c\u00e2teva gre\u0219eli ortografice \u00een mesaje sau se pot l\u0103sa inexactit\u0103\u021bi \u00een copierea stilului de marc\u0103. La sf\u00e2r\u0219itul proiectului, ob\u021binem acea \u201estatistic\u0103 brut\u0103\u201d: care grupuri de focus au reac\u021bionat \u0219i \u00een ce m\u0103sur\u0103 la scenarii.<\/p>\n<p>\u00cen al doilea caz, atacul se desf\u0103\u0219oar\u0103 f\u0103r\u0103 cuno\u0219tin\u021be ini\u021biale, prin metoda \u201ecutiei negre\u201d. Colect\u0103m informa\u021bii despre companie, angaja\u021bii s\u0103i, perimetrul re\u021belei, formul\u0103m legende pentru atac, alegem metode, c\u0103ut\u0103m posibile mijloace de protec\u021bie utilizate \u00een compania \u021bint\u0103, adapt\u0103m instrumentele, formul\u0103m scenarii. Speciali\u0219tii no\u0219tri folosesc at\u00e2t metode clasice de cercetare prin surse deschise (OSINT), c\u00e2t \u0219i produsul dezvoltat de noi, Group-IB \u2014 Threat Intelligence, un sistem care, \u00een preg\u0103tirea pentru phishing, poate ac\u021biona ca un agregator de informa\u021bii despre companie pe o perioad\u0103 lung\u0103, folosind inclusiv informa\u021bii \u00eenchise. Desigur, pentru ca atacul s\u0103 nu devin\u0103 o surpriz\u0103 nepl\u0103cut\u0103, detaliile acestuia sunt, de asemenea, convenite cu clientul. Se ob\u021bine un test complet de penetrare, dar la baza acestuia va sta ingineria social\u0103 avansat\u0103. O op\u021biune logic\u0103 \u00eentr-un astfel de caz este dezvoltarea atacului \u00een interiorul re\u021belei, p\u00e2n\u0103 la ob\u021binerea drepturilor depline \u00een sistemele interne. Apropo, aplic\u0103m atacuri sociotehnice similar \u0219i \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/www.group-ib.ru\/red-teaming.html\">Red Teaming<\/a><\/noindex>, \u0219i \u00een unele teste de penetrare. Ca rezultat, clientul va ob\u021bine o viziune independent\u0103 \u0219i complex\u0103 asupra protec\u021biei sale \u00eempotriva anumitor tipuri de atacuri sociotehnice, precum \u0219i o demonstra\u021bie a eficacit\u0103\u021bii (sau, dimpotriv\u0103, ineficacit\u0103\u021bii) liniei de ap\u0103rare stabilite \u00eempotriva amenin\u021b\u0103rilor externe.<\/p>\n<p>Recomand\u0103m s\u0103 desf\u0103\u0219ura\u021bi astfel de instruiri de cel pu\u021bin dou\u0103 ori pe an. \u00cen primul r\u00e2nd, \u00een orice companie exist\u0103 fluctua\u021bii de personal, iar experien\u021ba anterioar\u0103 este uitat\u0103 treptat de angaja\u021bi. \u00cen al doilea r\u00e2nd, metodele \u0219i tehnicile atacurilor se schimb\u0103 constant, ceea ce duce la necesitatea adapt\u0103rii proceselor de securitate \u0219i a mijloacelor de protec\u021bie.<\/p>\n<p>Dac\u0103 vorbim despre m\u0103surile tehnice de protec\u021bie \u00eempotriva atacurilor, urm\u0103toarele sunt cele mai eficiente:<\/p>\n<ul>\n<li>Implementarea obligatorie a autentific\u0103rii cu doi factori pentru serviciile publicate pe internet. Lansarea \u00een 2019 a unor astfel de servicii f\u0103r\u0103 sisteme Single Sign On, f\u0103r\u0103 protec\u021bie \u00eempotriva atacurilor de tip raider \u0219i f\u0103r\u0103 autentificare cu doi factori \u00eentr-o companie cu c\u00e2teva sute de angaja\u021bi este echivalent cu un apel deschis \u201esparge-m\u0103\u201d. O protec\u021bie bine implementat\u0103 va face imposibil\u0103 utilizarea rapid\u0103 a parolelor furate \u0219i va oferi timp pentru remedierea consecin\u021belor unui atac de phishing.<\/li>\n<li>Controlul accesului, minimizarea drepturilor utilizatorilor \u00een sistemele de operare \u0219i respectarea ghidurilor de configurare sigur\u0103 a produselor lansate de fiecare mare produc\u0103tor. Acestea sunt, de obicei, m\u0103suri simple \u00een esen\u021b\u0103, dar foarte eficiente \u0219i complexe \u00een realizarea practic\u0103, pe care to\u021bi, \u00eentr-o m\u0103sur\u0103 sau alta, le neglijeaz\u0103 \u00een favoarea vitezei de lucru. Unele sunt at\u00e2t de necesare, \u00eenc\u00e2t f\u0103r\u0103 ele niciun mijloc de protec\u021bie nu va ajuta.<\/li>\n<li>O linie bine structurat\u0103 de filtrare a e-mailurilor. Antispam, verificarea total\u0103 a ata\u0219amentelor pentru a detecta coduri mali\u021bioase, inclusiv testarea dinamic\u0103 prin medii de simulare. O atac bine preg\u0103tit presupune c\u0103 ata\u0219amentul executabil nu va fi detectat de solu\u021biile antivirus. Mediu de simulare va verifica toate aceste aspecte, utiliz\u00e2nd fi\u0219ierele a\u0219a cum le utilizeaz\u0103 o persoan\u0103. Ca urmare, orice element mali\u021bios va fi dezv\u0103luit prin modific\u0103rile produse \u00een interiorul mediului de simulare.<\/li>\n<li>Mijloace de protec\u021bie \u00eempotriva atacurilor \u021bintite. A\u0219a cum a fost deja men\u021bionat, solu\u021biile antivirus clasice nu vor detecta fi\u0219ierele mali\u021bioase \u00een timpul unui atac bine preg\u0103tit. Cele mai avansate produse trebuie s\u0103 monitorizeze automat ansamblul de evenimente care au loc \u00een re\u021bea \u2014 at\u00e2t la nivelul unui singur gazd\u0103, c\u00e2t \u0219i la nivelul traficului din re\u021bea. \u00cen cazul atacurilor, apar lan\u021buri de evenimente foarte caracteristice, care pot fi urm\u0103rite \u0219i oprite dac\u0103 exist\u0103 o monitorizare concentrat\u0103 pe astfel de evenimente.<\/li>\n<\/ul>\n<p>\nOriginalul articolului <noindex><a rel=\"nofollow\" href=\"http:\/\/lib.itsec.ru\/articles2\/Oborandteh\/obmani-menya--esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta\">publicat<\/a><\/noindex> \u00een revista \u00abInformation Security\/ Informa\u021bia de Securitate\u00bb #6, 2019.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/group-ib\/blog\/483652\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435 \u0441\u0435\u0431\u0435 \u0442\u0430\u043a\u0443\u044e \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e. \u0425\u043e\u043b\u043e\u0434\u043d\u043e\u0435 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0435 \u0443\u0442\u0440\u043e, \u043f\u0440\u043e\u0435\u043a\u0442\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u043d\u043e\u043c \u0446\u0435\u043d\u0442\u0440\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0440\u0435\u0433\u0438\u043e\u043d\u043e\u0432 \u0420\u043e\u0441\u0441\u0438\u0438. \u041a\u0442\u043e-\u0442\u043e \u0438\u0437 \u043e\u0442\u0434\u0435\u043b\u0430 \u043a\u0430\u0434\u0440\u043e\u0432 \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043d\u0430 \u043e\u0434\u043d\u0443 \u0438\u0437 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0432\u0430\u043a\u0430\u043d\u0441\u0438\u0439 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 \u0438\u043d\u0441\u0442\u0438\u0442\u0443\u0442\u0430, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434, \u0438 \u0432\u0438\u0434\u0438\u0442 \u0442\u0430\u043c \u0444\u043e\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e \u043a\u043e\u0442\u0430. \u0423\u0442\u0440\u043e \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043a\u0443\u0447\u043d\u044b\u043c\u2026 \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u041f\u0430\u0432\u0435\u043b \u0421\u0443\u043f\u0440\u0443\u043d\u044e\u043a, \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0434\u0435\u043f\u0430\u0440\u0442\u0430\u043c\u0435\u043d\u0442\u0430 \u0430\u0443\u0434\u0438\u0442\u0430 \u0438 \u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433\u0430 Group-IB, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55145","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043c\u0430\u043d\u0438 \u043c\u0435\u043d\u044f, \u0435\u0441\u043b\u0438 \u0441\u043c\u043e\u0436\u0435\u0448\u044c: \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u043e\u0446\u0438\u043e\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-01-12T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:03:13+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cen\u0219el\u0103-m\u0103, dac\u0103 po\u021bi: tr\u0103s\u0103turile desf\u0103\u0219ur\u0103rii unui pentest socio-tehnic | ProHoster","description":"Imagina\u021bi-v\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043c\u0430\u043d\u0438 \u043c\u0435\u043d\u044f, \u0435\u0441\u043b\u0438 \u0441\u043c\u043e\u0436\u0435\u0448\u044c: \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0441\u043e\u0446\u0438\u043e\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0430 | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/obmani-menya-esli-smozhesh-osobennosti-provedeniya-sotsiotehnicheskogo-pentesta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55145","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:50:02","updated":"2022-09-29 07:35:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=55145"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55145\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=55145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=55145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=55145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}