{"id":95620,"date":"2020-10-01T07:45:10","date_gmt":"2020-10-01T05:45:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/1-obuchenie-polzovatelej-osnovam-ib-borba-s-fishingom"},"modified":"2020-10-01T07:45:10","modified_gmt":"2020-10-01T05:45:10","slug":"1-obuchenie-polzovatelej-osnovam-ib-borba-s-fishingom","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/1-obuchenie-polzovatelej-osnovam-ib-borba-s-fishingom","title":{"rendered":"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/75034c513ef3ce93bc27afe604afdba1.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\u00cen zilele noastre, un administrator de re\u021bea sau un inginer de securitate informatic\u0103 \u00ee\u0219i dedic\u0103 mult timp \u0219i efort pentru a proteja perimetrul re\u021belei companiei de diverse amenin\u021b\u0103ri, \u00eenv\u0103\u021b\u00e2nd tot mai multe sisteme de prevenire \u0219i monitorizare a evenimentelor, dar chiar \u0219i asta nu \u00eei garanteaz\u0103 o protec\u021bie complet\u0103. Ingineria social\u0103 este folosit\u0103 activ de infractori \u0219i poate avea consecin\u021be grave.<\/p>\n<p>C\u00e2t de des te-ai prins g\u00e2ndindu-te: \u201eAr fi bine s\u0103 facem o verificare a personalului privind abilit\u0103\u021bile \u00een securitatea informa\u021bional\u0103\u201d? Din p\u0103cate, g\u00e2ndurile se lovesc de un zid al ne\u00een\u021belegerii sub forma unui num\u0103r mare de sarcini sau a lipsei de timp \u00een ziua de lucru. Ne propunem s\u0103 v\u0103 prezent\u0103m produse \u0219i tehnologii moderne \u00een domeniul automatiz\u0103rii form\u0103rii personalului, care nu vor necesita preg\u0103tiri \u00eendelungate pentru desf\u0103\u0219urarea pilotilor sau implementarea, dar despre toate acestea, pe r\u00e2nd.<\/p>\n<h2>Fundament teoretic<\/h2>\n<p>\u00cen prezent, peste 80% din fi\u0219ierele malware sunt distribuite prin email (informa\u021bii preluate din rapoartele speciali\u0219tilor Check Point din ultimul an, prin intermediul serviciului Intelligence Reports).<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/db65c5e2a78dc046e46a006af473516a.JPG\" style=\"display:block;margin: 0 auto;\" \/>Raportul pentru ultimele 30 de zile privind vectorul atacurilor pentru r\u0103sp\u00e2ndirea fi\u0219ierelor malware (Rusia) \u2014 Check Point<\/p>\n<p>Acest lucru sugereaz\u0103 c\u0103 con\u021binutul din mesajele de email este suficient de vulnerabil pentru a fi exploatat de infractori. Dac\u0103 analiz\u0103m cele mai populare formate de fi\u0219iere malware din ata\u0219amente (EXE, RTF, DOC), se observ\u0103 c\u0103 acestea con\u021bin, de obicei, elemente automate de execu\u021bie a codului (scripturi, macrocomenzi).<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/a6d1d2d8f374250104e156381b002ea1.JPG\" style=\"display:block;margin: 0 auto;\" \/>Raportul anual despre formatele fi\u0219ierelor \u00een mesajele malware primite \u2014 Check Point<\/p>\n<p>Cum putem combate acest vector de atacuri? Verificarea emailurilor implic\u0103 utilizarea instrumentelor de securitate:&nbsp;<\/p>\n<ul>\n<li>\n<p><strong>Antivirus<\/strong> \u2014 detectarea semn\u0103turilor amenin\u021b\u0103rilor.<\/p>\n<\/li>\n<li>\n<p><strong>Emulare<\/strong> \u2014 sandbox, prin care ata\u0219amentele sunt deschise \u00eentr-un mediu izolat.<\/p>\n<\/li>\n<li>\n<p><strong>Con\u0219tientizarea con\u021binutului <\/strong>\u2014 extragerea elementelor active din documente. Utilizatorul prime\u0219te un document cur\u0103\u021bat (de obicei, \u00een format PDF).<\/p>\n<\/li>\n<li>\n<p><strong>AntiSpam<\/strong> \u2014 verificarea reputa\u021biei domeniului destinatarului\/expeditorului.<\/p>\n<\/li>\n<\/ul>\n<p>\u0218i, teoretic, aceasta este suficient, dar exist\u0103 o alt\u0103 resurs\u0103 la fel de valoroas\u0103 pentru companie \u2014 datele corporative \u0219i personale ale angaja\u021bilor. \u00cen ultimii ani, popularitatea urm\u0103toarei forme de fraud\u0103 pe internet a crescut semnificativ:<\/p>\n<p><strong><u>Phishing<\/u><\/strong> (eng. phishing, from fishing \u2014 catching fish, extracting) \u2014 a type of internet fraud. Its goal is to obtain users' identification data. This includes stealing passwords, credit card numbers, bank account details, and other confidential information.<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/64ed74d70fe7a573c5e14cc03ebef33a.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Criminals are improving phishing attack methods, redirecting DNS requests from popular sites, launching entire campaigns using social engineering to send emails.&nbsp;<\/p>\n<p>Thus, to protect your corporate email from phishing, it is recommended to apply two approaches, and their combined use leads to the best results:<\/p>\n<ol>\n<li>\n<p><strong>Technical protection tools<\/strong>. As mentioned earlier, various technologies are used to verify and forward only legitimate emails.<\/p>\n<\/li>\n<li>\n<p><strong>Theoretical training of personnel<\/strong>. This involves comprehensive testing of personnel to identify potential victims. Subsequently, they undergo retraining, and statistics are constantly recorded.&nbsp;&nbsp;&nbsp;<\/p>\n<\/li>\n<\/ol>\n<h2>Trust but verify<\/h2>\n<p>Today we will discuss the second approach to preventing phishing attacks, namely automated training of personnel aimed at increasing the overall security level of corporate and personal data. Why can this be so dangerous?<\/p>\n<p><strong><u>Inginerie social\u0103 <\/u><\/strong>\u2014 manipularea psihologic\u0103 a oamenilor cu scopul de a-i determina s\u0103 \u00eentreprind\u0103 anumite ac\u021biuni sau de a dezv\u0103lui informa\u021bii confiden\u021biale (\u00een contextul securit\u0103\u021bii informa\u021biei).<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/97f19afc49a5101d20cebabe040073a1.JPG\" style=\"display:block;margin: 0 auto;\" \/>A typical phishing attack deployment scenario<\/p>\n<p>Let's refer to an engaging flowchart that briefly displays the process of executing a phishing campaign. It includes various stages:<\/p>\n<ol>\n<li>\n<p>Collection of primary data.<\/p>\n<p>In the 21st century, it is difficult to find a person who is not registered in any social network or various thematic forums. Naturally, many of us leave detailed information about ourselves: current job, group for colleagues, phone, email, etc. Add to this personalized information about a person's interests, and you will have data to create a phishing template. Even if individuals with such information are not found, there is always a company website where one can gather all the desired information (domain email, contacts, connections).<\/p>\n<\/li>\n<li>\n<p>Launching the campaign.<\/p>\n<p>Dup\u0103 ce va fi preg\u0103tit \"terenul\", folosind instrumente gratuite sau pl\u0103tite, pute\u021bi lansa propria campanie de phishing \u021bintit\u0103. Pe parcursul desf\u0103\u0219ur\u0103rii campaniei, ve\u021bi acumula statistici: e-mailuri livrate, e-mailuri deschise, clicuri pe linkuri, introduceri de date de autentificare etc.<\/p>\n<\/li>\n<\/ol>\n<h2>Produse pe pia\u021b\u0103<\/h2>\n<p>Phishing-ul poate fi utilizat at\u00e2t de c\u0103tre atacatori, c\u00e2t \u0219i de angaja\u021bii departamentului de securitate IT al companiei, cu scopul de a desf\u0103\u0219ura un audit constant al comportamentului angaja\u021bilor. Ce ne ofer\u0103 pia\u021ba solu\u021biilor gratuite \u0219i comerciale pentru sistemele de formare automatizat\u0103 a angaja\u021bilor companiei:<\/p>\n<ol>\n<li>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/getgophish.com\/\">GoPhish<\/a><\/noindex> \u2014 proiect open-source care permite desf\u0103\u0219urarea unei campanii de phishing pentru a verifica competen\u021ba IT a angaja\u021bilor dumneavoastr\u0103. Avantajele sunt simplitatea desf\u0103\u0219ur\u0103rii \u0219i cerin\u021bele minime de sistem. Printre dezavantaje se num\u0103r\u0103 lipsa \u0219abloanelor de trimitere gata preg\u0103tite, lipsa testelor \u0219i a materialelor educa\u021bionale pentru personal.<\/p>\n<\/li>\n<li>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.knowbe4.com\/\">KnowBe4<\/a><\/noindex> \u2014 o platform\u0103 cu un num\u0103r mare de produse disponibile pentru testarea personalului.<\/p>\n<\/li>\n<li>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/phishman.ru\/\">Phishman<\/a><\/noindex> \u2014 un sistem automatizat de testare \u0219i formare a angaja\u021bilor. Are diverse versiuni de produse care suport\u0103 de la 10 la mai mult de 1000 de angaja\u021bi. Cursurile de formare includ teorie \u0219i atribu\u021bii practice, av\u00e2nd posibilitatea de a identifica nevoile pe baza statisticilor ob\u021binute dup\u0103 campania de phishing. Solu\u021bia este comercial\u0103 cu op\u021biunea de utilizare \u00een regim de prob\u0103.<\/p>\n<\/li>\n<li>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.antiphish.ru\/\">Anti-phishing<\/a><\/noindex> \u2014 un sistem automatizat de formare \u0219i control al securit\u0103\u021bii. Produsul comercial ofer\u0103 desf\u0103\u0219urarea atacurilor de instruire periodice, formarea angaja\u021bilor etc. Ca variant\u0103 demo, produsul ofer\u0103 o campanie care include desf\u0103\u0219urarea \u0219abloanelor \u0219i desf\u0103\u0219urarea a trei atacuri de instruire.<\/p>\n<\/li>\n<\/ol>\n<p>Solu\u021biile men\u021bionate anterior sunt doar o parte din produsele disponibile pe pia\u021ba form\u0103rii automate a personalului. Desigur, fiecare are propriile avantaje \u0219i dezavantaje. Ast\u0103zi ne vom familiariza cu <noindex><a rel=\"nofollow\" href=\"https:\/\/getgophish.com\/\">GoPhish<\/a><\/noindex>, simul\u00e2nd un atac de phishing, vom explora op\u021biunile disponibile. <\/p>\n<h2>GoPhish<\/h2>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/cd95681b345ce85d131272c66032a68e.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>A\u0219adar, a venit timpul pentru practic\u0103. GoPhish a fost ales nu \u00eent\u00e2mpl\u0103tor: este un instrument prietenos cu utilizatorul, av\u00e2nd urm\u0103toarele caracteristici:<\/p>\n<ol>\n<li>\n<p>Instalare \u0219i desf\u0103\u0219urare simplificat\u0103.<\/p>\n<\/li>\n<li>\n<p>Suport pentru REST API. Permite formarea de cereri din <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.getgophish.com\/api-documentation\/\">documentation<\/a><\/noindex> \u0219i aplicarea de scenarii automatizate.&nbsp;<\/p>\n<\/li>\n<li>\n<p>Interfa\u021b\u0103 grafic\u0103 prietenoas\u0103 pentru gestionare.<\/p>\n<\/li>\n<li>\n<p>Compatibilitate \u00eentre platforme.<\/p>\n<\/li>\n<\/ol>\n<p>Echipa de dezvoltare a preg\u0103tit un excelent <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.getgophish.com\/user-guide\/installation\">ghid<\/a><\/noindex> ghid pentru desf\u0103\u0219urarea \u0219i configurarea GoPhish. \u00cen realitate, tot ce trebuie s\u0103 face\u021bi este s\u0103 merge\u021bi la <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/gophish\/gophish\">repository<\/a><\/noindex>, s\u0103 desc\u0103rca\u021bi arhiva ZIP pentru sistemul de operare corespunz\u0103tor, s\u0103 rula\u021bi fi\u0219ierul binar intern, dup\u0103 care instrumentul va fi instalat.<\/p>\n<p><u>NOT\u0102 IMPORTANT\u0102!<\/u><\/p>\n<p>\u00cen final, ar trebui s\u0103 ob\u021bine\u021bi \u00een terminal informa\u021bii despre portalul desf\u0103\u0219urat, precum \u0219i datele pentru autentificare (valabil pentru versiuni mai recente de 0.10.1). Nu uita\u021bi s\u0103 salva\u021bi parola!<\/p>\n<pre><code class=\"bash\">msg=\"Please login with the username admin and the password \"<\/code><\/pre>\n<h2>Configurarea GoPhish<\/h2>\n<p>Dup\u0103 instalare, va fi creat un fi\u0219ier de configurare (config.json) \u00een directorul aplica\u021biei. Vom descrie parametrii pentru modificarea acestuia:<\/p>\n<p><strong>Cheia<\/strong><\/p>\n<p><strong>Valoare (implicit)<\/strong><\/p>\n<p><strong>Descriere<\/strong><\/p>\n<p><em>admin_server.listen_url<\/em><\/p>\n<p>127.0.0.1:3333<\/p>\n<p>Adresa IP a serverului GoPhish <\/p>\n<p><em>admin_server.use_tls<\/em><\/p>\n<p>false<\/p>\n<p>Se folose\u0219te TLS pentru conectarea la serverul GoPhish <\/p>\n<p><em>admin_server.cert_path<\/em><\/p>\n<p>example.crt<\/p>\n<p>Calea c\u0103tre certificatul SSL pentru portalul de administrare GoPhish<\/p>\n<p><em>admin_server.key_path<\/em><\/p>\n<p>example.key<\/p>\n<p>Calea c\u0103tre cheia privat\u0103 SSL<\/p>\n<p><em>phish_server.listen_url<\/em><\/p>\n<p>0.0.0.0:80<\/p>\n<p>Adresa IP \u0219i portul pentru g\u0103zduirea paginii de phishing (implicit este g\u0103zduit pe acela\u0219i server GoPhish pe portul 80)<\/p>\n<p>&#8212;&gt; Accesa\u021bi portalul de gestionare. \u00cen cazul nostru:  <em>https:\/\/127.0.0.1:3333<\/em><\/p>\n<p>&#8212;&gt; Vi se va propune s\u0103 schimba\u021bi o parol\u0103 destul de lung\u0103 cu una mai simpl\u0103 sau invers.<\/p>\n<p>Crearea unui profil pentru expeditor<\/p>\n<p>Accesa\u021bi tab-ul \"Sending Profiles\" \u0219i introduce\u021bi datele utilizatorului de la care se va realiza expedierea mesajelor:<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/7932413b0fd342dff9f952e4aa8a76f8.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><strong>Unde:<\/strong><\/p>\n<p><em><u>Name<\/u><\/em><\/p>\n<p>Numele expeditorului<\/p>\n<p><em><u>From<\/u><\/em><\/p>\n<p>Email-ul expeditorului<\/p>\n<p><em><u>Host<\/u><\/em><\/p>\n<p>Adresa IP a serverului de e-mail care va asculta e-mailurile primite.<\/p>\n<p><em><u>Nume utilizator<\/u><\/em><\/p>\n<p>Login-ul contului utilizatorului de pe serverul de e-mail.<\/p>\n<p><em><u>Parol\u0103<\/u><\/em><\/p>\n<p>Parola contului utilizatorului de pe serverul de e-mail.<\/p>\n<p>De asemenea, pute\u021bi trimite un mesaj de test pentru a v\u0103 asigura de succesul livr\u0103rii. Salva\u021bi set\u0103rile folosind butonul \u201eSave profile\u201d.<\/p>\n<p>Crearea unui grup de destinatari<\/p>\n<p>Apoi, trebuie s\u0103 form\u0103m un grup de destinatari pentru \"scrisori de fericire\". Accesa\u021bi  &nbsp; \"User &amp; Groups\" \u2192 \"New Group\". Exist\u0103 dou\u0103 moduri de ad\u0103ugare: manual sau prin importul unui fi\u0219ier CSV.<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/15728f9314b0ca24e4709137595b7cda.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Pentru a doua metod\u0103, este necesar s\u0103 existe c\u00e2mpurile obligatorii:<\/p>\n<ul>\n<li>\n<p>First Name<\/p>\n<\/li>\n<li>\n<p>Last Name<\/p>\n<\/li>\n<li>\n<p>Email<\/p>\n<\/li>\n<li>\n<p>Position<\/p>\n<\/li>\n<\/ul>\n<p>Ca exemplu:<\/p>\n<pre><code>First Name,Last Name,Position,Email\nRichard,Bourne,CEO,rbourne@morningcatch.ph\nBoyd,Jenius,Systems Administrator,bjenius@morningcatch.ph\nHaiti,Moreo,Sales &amp; Marketing,hmoreo@morningcatch.ph<\/code><\/pre>\n<\/p>\n<p>Crearea unui \u0219ablon de e-mail de phishing<\/p>\n<p>Dup\u0103 ce am identificat un poten\u021bial atacator \u0219i victimele posibile, este necesar s\u0103 cre\u0103m un \u0219ablon cu un mesaj. Pentru aceasta, accesa\u021bi sec\u021biunea \u201eEmail Templates\u201d \u2192 \u201eNew Templates\u201d.<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/1f867bbec9d2b08811ba4452bc27b7c8.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\u00cen formarea \u0219ablonului se utilizeaz\u0103 o abordare tehnic\u0103 \u0219i creativ\u0103, trebuie s\u0103 specific\u0103m mesajul din partea serviciului, care va fi cunoscut utilizatorilor-victime sau va provoca o reac\u021bie din partea acestora. Op\u021biuni posibile:<\/p>\n<p><em><u>Name<\/u><\/em> <\/p>\n<p>Numele \u0219ablonului<\/p>\n<p><em><u>Subiect<\/u><\/em><\/p>\n<p>Subiectul email-ului<\/p>\n<p><em><u>Text \/ HTML<\/u><\/em> <\/p>\n<p>C\u00e2mp pentru introducerea textului sau codului HTML<\/p>\n<p>Gophish suport\u0103 importul scrisorilor, dar noi vom crea una proprie. Pentru aceasta, imit\u0103m scenariul: utilizatorul companiei prime\u0219te un email cu o ofert\u0103 de schimbare a parolei de la adresa sa de email corporativ. Apoi, vom analiza reac\u021bia acestuia \u0219i vom observa \u201ecaptura\u201d noastr\u0103.<\/p>\n<p>\u00cen \u0219ablon vom folosi variabile \u00eencorporate. Pute\u021bi consulta mai \u00een detaliu despre acestea \u00een sec\u021biunea men\u021bionat\u0103 anterior <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.getgophish.com\/user-guide\/installation\">ghid<\/a><\/noindex> \u00een sec\u021biunea <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.getgophish.com\/user-guide\/template-reference\">Template Reference<\/a><\/noindex>.<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/86973c1e490bfcb2c7b86bd775c025f5.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Pentru \u00eenceput, s\u0103 \u00eenc\u0103rc\u0103m urm\u0103torul text:<\/p>\n<pre><code>{{.FirstName}},\n\nParola pentru {{.Email}} a expirat. V\u0103 rug\u0103m s\u0103 v\u0103 reseta\u021bi parola aici.\n\nMul\u021bumim,\nEchipa IT<\/code><\/pre>\n<p>\u00cen mod automat, va fi inserat numele utilizatorului (conform punctului anterior \u2018New Group\u2019) \u0219i va fi men\u021bionat\u0103 adresa sa de email.<\/p>\n<p>Apoi, trebuie s\u0103 specific\u0103m linkul c\u0103tre resursa noastr\u0103 de phishing. Pentru aceasta, eviden\u021biem cuv\u00e2ntul \"here\" din text \u0219i alegem op\u021biunea &#171;Link&#187; din panoul de control.<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/ded21d192d8829c73d90169aa8e3315e.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Ca URL, vom specifica variabila \u00eencorporat\u0103 {{.URL}}, pe care o vom completa mai t\u00e2rziu. Aceasta va fi \u00eencorporat\u0103 automat \u00een textul email-ului de phishing.<\/p>\n<p>\u00cenainte de a salva \u0219ablonul, nu uita\u021bi s\u0103 activa\u021bi op\u021biunea &#171;Add Tracking Image&#187;. Aceasta va ad\u0103uga un element media de 1&#215;1 pixel, care va urm\u0103ri deschiderea e-mailului de c\u0103tre utilizator.<\/p>\n<p>Deci, a mai r\u0103mas pu\u021bin, dar \u00eenainte s\u0103 rezum\u0103m pa\u0219ii obligatorii dup\u0103 autentificare pe portalul Gophish:&nbsp;<\/p>\n<ol>\n<li>\n<p>Crea\u021bi un profil al expeditorului;<\/p>\n<\/li>\n<li>\n<p>Crea\u021bi un grup de distribu\u021bie, unde s\u0103 specifica\u021bi utilizatorii;<\/p>\n<\/li>\n<li>\n<p>Crea\u021bi un \u0219ablon de email de phishing.<\/p>\n<\/li>\n<\/ol>\n<p>S\u0103 fim de acord, configurarea nu a durat mult timp \u0219i suntem deja aproape gata s\u0103 lans\u0103m campania noastr\u0103. R\u0103m\u00e2ne s\u0103 ad\u0103ug\u0103m pagina de phishing.<\/p>\n<p>Crearea paginii de phishing<\/p>\n<p>Accesa\u021bi tab-ul &nbsp;\"Landing Pages\".<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/1306ce51563f606801744aff82120c17.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Ni se va oferi posibilitatea de a indica numele obiectului. Exist\u0103 op\u021biunea de a importa site-ul surs\u0103. \u00cen exemplul nostru, am \u00eencercat s\u0103 indic un portal web func\u021bional al serverului de email. Prin urmare, acesta a fost importat sub form\u0103 de cod HTML (chiar dac\u0103 nu complet). \u00cen continuare, exist\u0103 op\u021biuni interesante pentru captarea datelor introduse de utilizator:<\/p>\n<ul>\n<li>\n<p>Captarea Datelor Trimise. Dac\u0103 pagina specificat\u0103 a site-ului con\u021bine diverse formulare pentru introducere, toate datele vor fi \u00eenregistrate.<\/p>\n<\/li>\n<li>\n<p>Capture Passwords &#8212; capturarea parolelor introduse. Datele sunt salvate \u00een baza de date GoPhish f\u0103r\u0103 criptare, a\u0219a cum sunt.<\/p>\n<\/li>\n<\/ul>\n<p>\u00cen plus, putem utiliza op\u021biunea \u201eRedirect to\u201d, care va redirec\u021biona utilizatorul c\u0103tre pagina specificat\u0103 dup\u0103 introducerea datelor de autentificare. V\u0103 reamintesc c\u0103 am stabilit un scenariu \u00een care utilizatorului i se cere s\u0103 \u00ee\u0219i schimbe parola pentru emailul corporativ. Acesta este prezentat cu o pagin\u0103 falsificat\u0103 de autentificare a email-ului, dup\u0103 care utilizatorul poate fi trimis c\u0103tre orice resurs\u0103 disponibil\u0103 a companiei.<\/p>\n<p>Nu uita\u021bi s\u0103 salva\u021bi pagina completat\u0103 \u0219i s\u0103 trece\u021bi la sec\u021biunea &#171;New Campaign&#187;.<\/p>\n<h2>Lansarea capturii GoPhish<\/h2>\n<p>Am specificat toate datele necesare. \u00cen tab-ul &#171;New Campaign&#187; vom crea o nou\u0103 campanie.<\/p>\n<p>Lansarea campaniei<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/dcb86ba80285f0663b15ffd6d2652a47.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Unde:<\/p>\n<p><em><u>Name<\/u><\/em> <\/p>\n<p>Numele campaniei<\/p>\n<p><em><u>\u0218ablon Email<\/u><\/em><\/p>\n<p>\u0218ablonul mesajului<\/p>\n<p><em><u>Landing Page<\/u><\/em><\/p>\n<p>Pagin\u0103 de phishing<\/p>\n<p><em><u>URL<\/u><\/em><\/p>\n<p>IP-ul serverului dumneavoastr\u0103 GoPhish (trebuie s\u0103 aib\u0103 acces re\u021bea la&nbsp;hostul victimei)<\/p>\n<p><em><u>Data Lans\u0103rii<\/u><\/em><\/p>\n<p>Data de start a campaniei<\/p>\n<p><em><u>Trimite Email-uri By<\/u><\/em><\/p>\n<p>Data de finalizare a campaniei (trimiterea este distribuit\u0103 uniform)<\/p>\n<p><em><u>Profil de Trimitere<\/u><\/em><\/p>\n<p>Profilul expeditorului<\/p>\n<p><em><u>Grupuri<\/u><\/em><\/p>\n<p>Grupa de destinatari<\/p>\n<\/p>\n<p>Dup\u0103 start, putem consulta \u00eentotdeauna statisticile, care indic\u0103: mesaje trimise, mesaje deschise, clicuri pe linkuri, date l\u0103sate pentru transfer \u00een spam.<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/9043fc4d7358c7ff4bd5a344c772fe62.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Din statistici vedem c\u0103 1 mesaj a fost trimis, s\u0103 verific\u0103m e-mailul din partea&nbsp;recep\u021bionarului:<\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/129fbb8f438d2e19efb927747203e752.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\u00centr-adev\u0103r, victima a primit cu succes un email phishing cu cererea de a face clic pe link pentru a-\u0219i schimba parola contului corporativ. Execut\u0103m ac\u021biunile solicitate, suntem trimi\u0219i pe pagina Landing Pages, ce spun statisticile? <\/p>\n<p><img decoding=\"async\" alt=\"1. Formarea utilizatorilor \u00een principiile securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului\" src=\"\/wp-content\/uploads\/2020\/10\/f7efae1c10c1fb941ae651c93478c74e.JPG\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\u00cen cele din urm\u0103, utilizatorul nostru a accesat linkul de phishing, unde ar fi putut l\u0103sa datele contului s\u0103u. <\/p>\n<p><em>Not\u0103 a autorului: <\/em>procesul de introducere a datelor nu a fost \u00eenregistrat din cauza utiliz\u0103rii unui model de testare, dar aceast\u0103 op\u021biune exist\u0103. \u00cen acest caz, con\u021binutul nu este criptat \u0219i este stocat \u00een baza de date GoPhish, lua\u021bi \u00een considerare asta. <\/p>\n<h2>\u00cen concluzie<\/h2>\n<p>Ast\u0103zi am abordat o tem\u0103 relevant\u0103 privind desf\u0103\u0219urarea unei forme automatizate de instruire a angaja\u021bilor pentru a-i proteja de atacurile de phishing \u0219i a-i educa \u00een domeniul IT. Ca o solu\u021bie accesibil\u0103, a fost implementat Gophish, care s-a dovedit eficient \u00een raportul dintre timpul de desf\u0103\u0219urare \u0219i rezultat. Cu ajutorul acestui instrument accesibil, ve\u021bi putea verifica angaja\u021bii dvs. \u0219i elabora rapoarte privind comportamentul lor. Dac\u0103 acest produs v-a st\u00e2rnit interesul, v\u0103 oferim asisten\u021b\u0103 \u00een desf\u0103\u0219urarea sa \u0219i \u00een realizarea unui audit al angaja\u021bilor dvs. (<u>sales@tssolution.ru<\/u>).<\/p>\n<p>Cu toate acestea, nu ne vom opri la revizuirea unei singure solu\u021bii \u0219i inten\u021bion\u0103m s\u0103 continu\u0103m un ciclu \u00een care vom vorbi despre solu\u021bii Enterprise pentru automatizarea procesului de instruire \u0219i controlul securit\u0103\u021bii angaja\u021bilor. R\u0103m\u00e2ne\u021bi al\u0103turi de noi \u0219i fi\u021bi vigilen\u021bi!<\/p>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/521252\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0438\u043b\u0438 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0418\u0411 \u0442\u0440\u0430\u0442\u0438\u0442 \u0443\u0439\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0438 \u0441\u0438\u043b, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440 \u0441\u0435\u0442\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u043e\u0442 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437, \u043e\u0441\u0432\u0430\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u043d\u043e\u0432\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439, \u043d\u043e \u0434\u0430\u0436\u0435 \u044d\u0442\u043e \u043d\u0435 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u0435\u0442 \u0435\u043c\u0443 \u043f\u043e\u043b\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438. \u0421\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0438 \u043c\u043e\u0436\u0435\u0442 \u043d\u0435\u0441\u0442\u0438 \u0437\u0430 \u0441\u043e\u0431\u043e\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f. \u041a\u0430\u043a \u0447\u0430\u0441\u0442\u043e \u0432\u044b \u043b\u043e\u0432\u0438\u043b\u0438 \u0441\u0435\u0431\u044f \u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95621,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-95620","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/1-obuchenie-polzovatelej-osnovam-ib-borba-s-fishingom\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd471. \u041e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0441\u043d\u043e\u0432\u0430\u043c \u0418\u0411. \u0411\u043e\u0440\u044c\u0431\u0430 \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u043c | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/1-obuchenie-polzovatelej-osnovam-ib-borba-s-fishingom\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-01T05:45:10+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-01T05:45:10+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd471. Instruirea utilizatorilor \u00een domeniul securit\u0103\u021bii informa\u021biei. Combaterea phishing-ului | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/1-obuchenie-polzovatelej-osnovam-ib-borba-s-fishingom","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd471. \u041e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0441\u043d\u043e\u0432\u0430\u043c \u0418\u0411. \u0411\u043e\u0440\u044c\u0431\u0430 \u0441 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u043c | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/1-obuchenie-polzovatelej-osnovam-ib-borba-s-fishingom","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-01T05:45:10+00:00","article:modified_time":"2020-10-01T05:45:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95620","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:02:17","updated":"2022-09-27 14:57:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95620","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=95620"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95620\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/95621"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=95620"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=95620"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=95620"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}