{"id":96228,"date":"2020-10-09T19:42:19","date_gmt":"2020-10-09T17:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit"},"modified":"2020-10-09T19:42:19","modified_gmt":"2020-10-09T17:42:19","slug":"nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","title":{"rendered":"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/b57d6aa03463566d8f17c4b51246a07e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Companiile de antivirus, exper\u021bii \u00een securitate \u0219i pur \u0219i simplu entuzia\u0219tii creeaz\u0103 \u00een internet sisteme-bait \u2014 honeypots, pentru a \"prinde\" o nou\u0103 variant\u0103 de virus sau a descoperi tehnici neobi\u0219nuite ale hackerilor. Honeypot-urile \u00eent\u00e2lnesc at\u00e2t de des, \u00eenc\u00e2t infractorii cibernetici au dezvoltat un fel de imunitate: ei identific\u0103 rapid c\u0103 este o capcan\u0103 \u0219i o ignor\u0103 pur \u0219i simplu. Pentru a studia tacticile hackerilor moderni, am creat un honeypot realist, care timp de \u0219apte luni a fost activ pe internet, atr\u0103g\u00e2nd cele mai diverse atacuri. Despre cum a fost am povestit \u00een studiul nostru \"<noindex><a rel=\"nofollow\" href=\"https:\/\/documents.trendmicro.com\/assets\/white_papers\/wp-caught-in-the-act-running-a-realistic-factory-honeypot-to-capture-real-threats.pdf\">Prins \u00een Ac\u021biune: Ghid pentru Un Honeypot de Fabrica Realist pentru Capturarea Amenin\u021b\u0103rilor Reale<\/a><\/noindex>\u00bb. Unele fapte din studiu \u2014 \u00een aceast\u0103 postare. <\/i><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Dezvoltarea honeypot-ului: checklist<\/h3>\n<p>\nPrincipala sarcin\u0103 \u00een crearea super-capcanei noastre a fost s\u0103 nu permitem hackerilor interesa\u021bi s\u0103 ne dezv\u0103luie. Pentru aceasta a fost necesar s\u0103 desf\u0103\u0219ur\u0103m o lucrare considerabil\u0103: <\/p>\n<ol>\n<li>S\u0103 cre\u0103m o legend\u0103 realist\u0103 despre companie, incluz\u00e2nd numele \u0219i fotografiile angaja\u021bilor, numere de telefon \u0219i e-mailuri.<\/li>\n<li>S\u0103 concepem \u0219i s\u0103 implement\u0103m un model de infrastructur\u0103 industrial\u0103 care s\u0103 corespund\u0103 legendei activit\u0103\u021bii companiei noastre. <\/li>\n<li>S\u0103 decidem ce servicii de re\u021bea vor fi disponibile extern, dar s\u0103 nu exager\u0103m cu deschiderea unor porturi vulnerabile, astfel \u00eenc\u00e2t s\u0103 nu par\u0103 o capcan\u0103 pentru naivi. <\/li>\n<li>S\u0103 organiz\u0103m vizibilitatea unei scurgeri de informa\u021bii despre un sistem vulnerabil \u0219i s\u0103 r\u0103sp\u00e2ndim aceste date dintre poten\u021bialii atacatori.<\/li>\n<li>S\u0103 implement\u0103m o observa\u021bie discret\u0103 asupra ac\u021biunilor hackerilor \u00een infrastructura capcanei. <\/li>\n<\/ol>\n<p>\n\u0218i acum, s\u0103 le lu\u0103m pe r\u00e2nd.<\/p>\n<h3><b>Cre\u0103m legenda<\/b><\/h3>\n<p>\nInfractorii cibernetici s-au obi\u0219nuit deja cu \u00eent\u00e2lnirea a numeroase honeypot-uri, astfel \u00eenc\u00e2t cei mai avansa\u021bi dintre ei efectueaz\u0103 o cercetare am\u0103nun\u021bit\u0103 a fiec\u0103rui sistem vulnerabil pentru a se asigura c\u0103 nu este o capcan\u0103. Din acela\u0219i motiv, ne-am str\u0103duit s\u0103 nu ob\u021binem doar realismul honeypot-ului din perspectiva designului \u0219i a aspectelor tehnice, ci \u0219i s\u0103 cre\u0103m impresia unei companii reale.<\/p>\n<p>Pun\u00e2ndu-ne \u00een locul unui hacker cool ipotetic, am dezvoltat un algoritm de verificare care ar putea distinge un sistem real de o capcan\u0103. Acesta includea c\u0103utarea adreselor IP ale companiei \u00een sisteme de reputa\u021bie, cercetarea retrograd\u0103 a istoriei adreselor IP, c\u0103utarea numelui \u0219i a cuvintelor cheie legate de companie, precum \u0219i de partenerii s\u0103i \u0219i multe alte aspecte. \u00cen cele din urm\u0103, legenda a fost destul de conving\u0103toare \u0219i atr\u0103g\u0103toare.<\/p>\n<p>Am decis s\u0103 pozi\u021bion\u0103m fabrica-capcan\u0103 ca un mic boutique de prototipare industrial\u0103, care lucreaz\u0103 pentru clien\u021bi foarte mari \u0219i anonimi din segmentele militar \u0219i aeronautic. Acest lucru ne sc\u0103pa de complica\u021biile legale legate de utilizarea unei m\u0103rci existente.<\/p>\n<p>Apoi, a trebuit s\u0103 venim cu o viziune, o misiune \u0219i un nume pentru organiza\u021bie. Am decis c\u0103 compania noastr\u0103 va fi un startup cu un num\u0103r mic de angaja\u021bi, fiecare dintre ei fiind un fondator. Aceasta ad\u0103uga credibilitate legendei despre specializarea afacerii noastre, care \u00eei permite s\u0103 lucreze cu proiecte delicate pentru clien\u021bi mari \u0219i importan\u021bi. Voiam ca firma noastr\u0103 s\u0103 par\u0103 vulnerabil\u0103 din punct de vedere al securit\u0103\u021bii cibernetice, dar \u00een acela\u0219i timp s\u0103 fie evident c\u0103 lucr\u0103m cu active importante \u00een sistemele \u021bint\u0103.<\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/cefb9d754e08689bc4cedc91efa53bdc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Captura de ecran a site-ului honeypot MeTech. Sursa: Trend Micro<\/i><\/p>\n<p>Pentru numele companiei, am ales cuv\u00e2ntul MeTech. Site-ul a fost f\u0103cut pe baza unei \u0219abloane gratuite. Imaginile le-am luat din b\u0103nci de imagini, folosind cele mai pu\u021bin populare \u0219i ajust\u00e2ndu-le pentru a le face mai pu\u021bin recognoscibile. <\/p>\n<p>Voiam ca firma s\u0103 arate real\u0103, a\u0219a c\u0103 a trebuit s\u0103 ad\u0103ug\u0103m angaja\u021bi cu abilit\u0103\u021bi profesionale corespunz\u0103toare profilului de activitate. Le-am inventat nume \u0219i personalit\u0103\u021bi, iar apoi am \u00eencercat s\u0103 select\u0103m imagini din b\u0103nci de imagini \u00een func\u021bie de apartenen\u021ba etnic\u0103. <\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/3b7fa0a8287500349c0a25aa464fee2a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i><i>Captura de ecran a site-ului honeypot MeTech. Sursa: Trend Micro<\/i><\/i><\/p>\n<p>Pentru a nu fi descoperi\u021bi, am c\u0103utat fotografii de grup de bun\u0103 calitate, din care s\u0103 putem alege fe\u021bele necesare. Totu\u0219i, am renun\u021bat la aceast\u0103 op\u021biune, deoarece posibilul hacker ar putea folosi c\u0103utarea invers\u0103 a imaginilor \u0219i ar putea descoperi c\u0103 \u201eangaja\u021bii\u201d no\u0219tri tr\u0103iesc doar \u00een b\u0103nci de imagini. \u00cen cele din urm\u0103, am folosit fotografii ale unor persoane inexistent, create cu ajutorul re\u021belelor neuronale.<\/p>\n<p>Profilurile angaja\u021bilor publicate pe site con\u021bineau informa\u021bii importante despre competen\u021bele lor tehnice, \u00eens\u0103 am evitat men\u021bionarea unor institu\u021bii de \u00eenv\u0103\u021b\u0103m\u00e2nt \u0219i ora\u0219e specifice.<br \/>\nPentru a crea c\u0103su\u021be po\u0219tale, am utilizat serverul furnizorului de hosting, apoi am \u00eenchiriat c\u00e2teva numere de telefon din SUA \u0219i le-am integrat \u00eentr-o central\u0103 virtual\u0103 cu meniu vocal \u0219i r\u0103spuns automat.<\/p>\n<h3><b>Infrastructura honeypotului<\/b><\/h3>\n<p>\nPentru a evita expunerea, am decis s\u0103 folosim o combina\u021bie de echipamente industriale reale, computere fizice \u0219i ma\u0219ini virtuale protejate. A\u0219a cum ne-am anticipat, am verificat rezultatul eforturilor noastre cu ajutorul motorului de c\u0103utare Shodan, care a ar\u0103tat c\u0103 honeypotul p\u0103rea o adev\u0103rat\u0103 sistem industrial.<\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/77ff6f72dacafcf9326161f2150c91b8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Rezultatul scan\u0103rii honeypotului cu Shodan. Sursa: Trend Micro<\/i><\/p>\n<p>Ca \u00abhardware\u00bb pentru capcana noastr\u0103, am folosit patru PLC-uri:<\/p>\n<ul>\n<li> Siemens S7-1200,<\/li>\n<li>dou\u0103 AllenBradley MicroLogix 1100,<\/li>\n<li>Omron CP1L.<\/li>\n<\/ul>\n<p>\nAceste PLC-uri au fost alese pentru popularitatea lor pe pia\u021ba mondial\u0103 a sistemelor de control. De asemenea, fiecare dintre ace\u0219ti controlere folose\u0219te propriul protocol, ceea ce ne-a permis s\u0103 verific\u0103m care dintre PLC-uri ar fi atacate mai des \u0219i dac\u0103 ar interesa pe cineva \u00een general. <\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/f575a4cabd0b38f1af43b8d20cc0a8d4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Echipamentele \u00abfabricii\u00bb noastre capcan\u0103. Sursa: Trend Micro<\/i><\/p>\n<p>Nu am pur \u0219i simplu instalat echipamentele \u0219i le-am conectat la internet. Fiecare controler a fost programat s\u0103 execute diverse sarcini, printre care:<\/p>\n<ul>\n<li>amestecare,<\/li>\n<li>controlul aragazului \u0219i al benzii transportoare,<\/li>\n<li>paletizare cu ajutorul unui manipulator robotizat.<\/li>\n<\/ul>\n<p>\n\u0218i pentru ca procesul de produc\u021bie s\u0103 fie realist, am programat logica pentru a modifica aleatoriu parametrii de feedback, simul\u00e2nd pornirea \u0219i oprirea motoarelor, activarea \u0219i dezactivarea aragazului.<\/p>\n<p>\u00cen fabrica noastr\u0103 erau trei computere virtuale \u0219i unul fizic. Computerele virtuale erau folosite pentru a gestiona fabrica, robotul paletizator \u0219i ca sta\u021bie de lucru pentru inginerul programator PLC. Computerul fizic func\u021biona ca server de fi\u0219iere.<\/p>\n<p>Pe l\u00e2ng\u0103 monitorizarea atacurilor asupra PLC-urilor, am dorit s\u0103 urm\u0103rim starea programelor \u00eenc\u0103rcate pe dispozitivele noastre. Pentru aceasta, am creat o interfa\u021b\u0103 care permitea identificarea rapid\u0103 a modului \u00een care au fost modificate st\u0103rile mecanismelor noastre virtuale de execu\u021bie \u0219i a configur\u0103rilor. Chiar din etapa de planificare, am descoperit c\u0103 este mult mai simplu s\u0103 realiz\u0103m acest lucru printr-un software de control dec\u00e2t prin programarea direct\u0103 a logicii controlerului. Am deschis accesul la interfa\u021ba de control a dispozitivelor honeypot-ului nostru prin VNC f\u0103r\u0103 parol\u0103.<\/p>\n<p>Robo\u021bii industriali sunt un component cheie al produc\u021biei inteligente moderne. \u00cen acest sens, am decis s\u0103 ad\u0103ug\u0103m un robot \u0219i un post de lucru pentru controlul acestuia \u00een echipamentul fabricii noastre de capcan\u0103. Pentru a face fabrica mai realist\u0103, pe postul de lucru de control am instalat un software real pe care inginerii \u00eel folosesc pentru programarea grafic\u0103 a logicii robotului. De asemenea, av\u00e2nd \u00een vedere c\u0103 robo\u021bii industriali se afl\u0103 de obicei \u00eentr-o re\u021bea intern\u0103 izolat\u0103, am decis s\u0103 l\u0103s\u0103m accesul neprotejat prin VNC doar la postul de lucru de control.<\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/157e4891ccf19fb93d3b925309543c9d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Mediul RobotStudio cu modelul 3D al robotului nostru. Sursa: Trend Micro<\/i><\/p>\n<p>Pe virtuala cu postul de lucru de control al robotului, am instalat mediul de programare RobotStudio de la ABB Robotics. Configur\u00e2nd RobotStudio, am deschis \u00een acesta un fi\u0219ier de simulare cu robotul nostru astfel \u00eenc\u00e2t imaginea sa 3D s\u0103 fie vizibil\u0103 pe ecran. Drept rezultat, Shodan \u0219i alte motoare de c\u0103utare, descoperind un server VNC neprotejat, vor ob\u021bine aceast\u0103 imagine de pe ecran \u0219i o vor ar\u0103ta celor care caut\u0103 robo\u021bi industriali cu acces deschis la control. <\/p>\n<p>Sensul unei astfel de aten\u021bii la detalii a fost de a crea un \u021bel atr\u0103g\u0103tor \u0219i c\u00e2t mai realist pentru atacatori, care, descoperindu-l, s\u0103 revin\u0103 la el din nou \u0219i din nou.<\/p>\n<p><b><\/p>\n<h3>Postul de lucru al inginerului<\/h3>\n<p><\/b><br \/>\nPentru programarea logicii PLC-ului, am ad\u0103ugat un computer ingineresc \u00een infrastructur\u0103. Pe acesta am instalat software industrial pentru programarea PLC-ului:<\/p>\n<ul>\n<li>TIA Portal pentru Siemens,<\/li>\n<li>MicroLogix pentru controlerul Allen-Bradley,<\/li>\n<li>CX-One pentru Omron.<\/li>\n<\/ul>\n<p>\nAm decis c\u0103 locul de munc\u0103 pentru inginer nu va fi accesibil din afara re\u021belei. \u00cen schimb, am setat aceea\u0219i parol\u0103 pentru contul de administrator ca \u0219i pentru sistemele de management ale robotului \u0219i fabrica de management disponibile online. Aceast\u0103 configura\u021bie este destul de comun\u0103 \u00een multe companii.<br \/>\nDin p\u0103cate, \u00een ciuda tuturor eforturilor noastre, niciun atacator nu a reu\u0219it s\u0103 ajung\u0103 la sistemul de management al inginerului.<\/p>\n<h3>Server de fi\u0219iere<\/h3>\n<p>\nAcesta a fost necesar ca un momeal\u0103 pentru infractorii informatici \u0219i ca un mediu pentru a ne salva propriile \u201elucr\u0103ri\u201d \u00een fabrica capcan\u0103. Acest lucru ne-a permis s\u0103 schimb\u0103m fi\u0219iere cu honeypot-ul nostru prin intermediul dispozitivelor USB, f\u0103r\u0103 a l\u0103sa urme \u00een re\u021beaua capcan\u0103. Ca sistem de operare pentru serverul de fi\u0219iere, am instalat Windows 7 Pro, \u00een care am creat un folder public, accesibil pentru citire \u0219i scriere oricui.<\/p>\n<p>La \u00eenceput, nu am f\u0103cut nicio ierarhie de foldere \u0219i documente pe serverul de fi\u0219iere. Cu toate acestea, mai t\u00e2rziu am descoperit c\u0103 atacatorii studiaz\u0103 activ acest folder, a\u0219a c\u0103 am decis s\u0103-l umplem cu diferite fi\u0219iere. Pentru aceasta, am scris un script Python care crea un fi\u0219ier de dimensiune aleatorie cu una dintre extensiile specificate, form\u00e2nd un nume bazat pe un dic\u021bionar. <\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/5c1ec2c139d04200849443771b48872a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Script pentru generarea de nume de fi\u0219iere atractive. Surs\u0103: Trend Micro<\/i><\/p>\n<p>Dup\u0103 rularea scriptului, am ob\u021binut rezultatul dorit sub forma unui folder plin de fi\u0219iere cu nume foarte interesante. <\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/a1842a978ecb400e4390274e202af6f0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Rezultatul execu\u021biei scriptului. Surs\u0103: Trend Micro<\/i><\/p>\n<p><b><\/p>\n<h3>Mediu pentru monitorizare<\/h3>\n<p><\/b><br \/>\nDup\u0103 ce am depus at\u00e2t de multe eforturi pentru a crea o companie realist\u0103, pur \u0219i simplu nu ne-am putut permite s\u0103 gre\u0219im \u00een mediul pentru monitorizarea \u201evizitatorilor\u201d no\u0219tri. Era necesar s\u0103 primim toate datele \u00een timp real astfel \u00eenc\u00e2t atacatorii s\u0103 nu observe c\u0103 erau supraveghea\u021bi. <\/p>\n<p>Am realizat acest lucru folosind patru adaptoare USB-Ethernet, patru divizoare Ethernet SharkTap, Raspberry Pi 3 \u0219i un disc extern mare. Diagrama re\u021belei noastre ar\u0103ta astfel: <\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/2288c39fa3c4ceee6f5f30dd012de269.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Diagrama re\u021belei honeypot-ului cu echipamentul pentru monitorizare. Surs\u0103: Trend Micro<\/i><\/p>\n<p>Am amplasat trei divizoare SharkTap astfel \u00eenc\u00e2t s\u0103 monitoriz\u0103m tot traficul extern c\u0103tre PLC-uri, disponibile doar din re\u021beaua intern\u0103. Al patrulea SharkTap a urm\u0103rit traficul vizitatorilor la ma\u0219ina virtual\u0103 vulnerabil\u0103. <\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/9440a392352b104c27056ee00bc3b2a9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Divizor Ethernet SharkTap \u0219i router Sierra Wireless AirLink RV50. Surs\u0103: Trend Micro<\/i><\/p>\n<p>Raspberry Pi a realizat capturi de trafic zilnice. Conexiunea la internet a fost organizat\u0103 printr-un router mobil Sierra Wireless AirLink RV50, adesea folosit \u00een \u00eentreprinderile industriale. <\/p>\n<p>Din p\u0103cate, acest router nu permitea blocarea selectiv\u0103 a atacurilor care nu se conformau planurilor noastre, a\u0219a c\u0103 am ad\u0103ugat \u00een re\u021bea un firewall Cisco ASA 5505 \u00een modul transparent, pentru a efectua bloc\u0103rile cu un impact minim asupra re\u021belei. <\/p>\n<p><b><\/p>\n<h3>Analiza traficului<\/h3>\n<p><\/b><br \/>\nTshark \u0219i tcpdump sunt potrivite pentru a rezolva rapid \u00eentreb\u0103rile curente, dar \u00een cazul nostru capacit\u0103\u021bile lor au fost insuficiente, deoarece aveam multe gigaocte\u021bi de trafic, analiza c\u0103rora era efectuat\u0103 de mai multe persoane. Am utilizat analiza open-source Moloch, dezvoltat\u0103 de AOL. Func\u021bionalitatea sa este comparabil\u0103 cu Wireshark, dar ofer\u0103 mai multe op\u021biuni pentru colaborare, descrierea \u0219i etichetarea pachetelor, exportul \u0219i alte sarcini.<\/p>\n<p>Deoarece nu doream s\u0103 proces\u0103m datele colectate pe computerele honeypot, dump-urile PCAP erau exportate zilnic \u00een stocarea AWS, din care le-am importat pe ma\u0219ina cu Moloch. <\/p>\n<h3><b>\u00cenregistrarea ecranului <\/b><\/h3>\n<p>\nPentru a documenta ac\u021biunile hackerilor \u00een honeypot-ul nostru, am scris un script care, la un interval prestabilit, realiza capturi de ecran ale ma\u0219inii virtuale \u0219i, compar\u00e2nd cu captura anterioar\u0103, determina dac\u0103 se \u00eent\u00e2mpl\u0103 ceva sau nu. La identificarea activit\u0103\u021bii, scriptul activa \u00eenregistrarea ecranului. Aceast\u0103 abordare s-a dovedit cea mai eficient\u0103. De asemenea, am \u00eencercat s\u0103 analiz\u0103m traficul VNC din dump-ul PCAP pentru a \u00een\u021belege ce modific\u0103ri au avut loc \u00een sistem, dar, \u00een final, \u00eenregistrarea ecranului pe care am realizat-o s-a dovedit mai simpl\u0103 \u0219i mai ilustrativ\u0103. <\/p>\n<p><b><\/p>\n<h3>Monitorizarea sesiunilor VNC<\/h3>\n<p><\/b><br \/>\nPentru aceasta, am folosit Chaosreader \u0219i VNCLogger. Ambele utilitare extrag din dump-ul PCAP ap\u0103s\u0103rile de taste, dar VNCLogger se ocup\u0103 mai corect de tastele de tip Backspace, Enter, Ctrl.<\/p>\n<p>VNCLogger are dou\u0103 dezavantaje. Primul: poate extrage tastele doar \u201eascult\u00e2nd\u201d traficul pe interfa\u021b\u0103, a\u0219a c\u0103 a trebuit s\u0103 simul\u0103m pentru ea o sesiune VNC folosind tcpreplay. Al doilea dezavantaj al VNCLogger este comun cu Chaosreader: ambele nu arat\u0103 con\u021binutul clipboard-ului. Pentru aceasta a fost necesar s\u0103 folosim Wireshark. <\/p>\n<p><b><\/p>\n<h3>Atragem hackerii<\/h3>\n<p><\/b><br \/>\nAm creat un honeypot pentru a fi atacat. Pentru a realiza acest lucru, am simulat o scurgere de informa\u021bii menit\u0103 s\u0103 atrag\u0103 aten\u021bia poten\u021bialilor hackeri. Pe honeypot au fost deschise urm\u0103toarele porturi: <\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/0defa27d76010837c00aa7b97e993ac0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nPortul RDP a trebuit \u00eenchis la scurt timp dup\u0103 ce a \u00eenceput func\u021bionarea, deoarece num\u0103rul uria\u0219 de trafic de scanare a cauzat probleme de performan\u021b\u0103 \u00een re\u021beaua noastr\u0103.<br \/>\nTerminalele VNC au func\u021bionat ini\u021bial \u00een modul \u201edoar vizualizare\u201d f\u0103r\u0103 parol\u0103, iar apoi \u201edin gre\u0219eal\u0103\u201d le-am comutat \u00een modul de acces complet. <\/p>\n<p>Pentru a atrage atacatorii, am publicat dou\u0103 post\u0103ri cu informa\u021bii \u201escurse\u201d despre un sistem industrial disponibil pe PasteBin.<\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/2db7cc5aa60da13a6bf70a6f5e88a934.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Una dintre post\u0103rile publicate pe PasteBin pentru a atrage atacuri. Sursa: Trend Micro<\/i><\/p>\n<p><b><\/p>\n<h3>Atacuri<\/h3>\n<p><\/b><br \/>\nHoneypotul a fost online timp de aproximativ \u0219apte luni. Prima atac a avut loc la o lun\u0103 dup\u0103 ce honeypotul a fost activat. <\/p>\n<p><b>Scanere<\/b><\/p>\n<p>A existat mult trafic din partea scanerelor unor companii cunoscute \u2014 ip-ip, Rapid, Shadow Server, Shodan, ZoomEye \u0219i altele. A fost at\u00e2t de mult, \u00eenc\u00e2t a trebuit s\u0103 le excludem <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/lir\/ipv4\/\"   title=\"adrese IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"676\">adrese IP<\/a> din analiz\u0103: 610 din 9452 sau 6,45% din toate IP-urile unice apar\u021bineau unor scanere complet legale.<\/p>\n<p><b>Fraudatori<\/b><\/p>\n<p>Unul dintre cele mai mari riscuri cu care ne-am confruntat a fost utilizarea sistemului nostru \u00een scopuri criminale: pentru a cump\u0103ra smartphone-uri pe numele abonatului, a \u00eencasat mile de la companiile aeriene folosind carduri cadou \u0219i alte forme de fraud\u0103.<\/p>\n<p><b>Mineri<\/b><\/p>\n<p>Unul dintre primii vizitatori ai sistemului nostru s-a dovedit a fi un miner. Acesta a \u00eenc\u0103rcat un software pentru minerit Monero. Nu ar fi c\u00e2\u0219tigat mult pe sistemul nostru specific din cauza performan\u021bei sc\u0103zute. Totu\u0219i, dac\u0103 ar fi s\u0103 uneasc\u0103 eforturile mai multor zeci sau chiar sute de astfel de sisteme, ar putea rezulta o sum\u0103 destul de bun\u0103. <\/p>\n<p><b>Ransomware <\/b><\/p>\n<p>\u00cen timpul activit\u0103\u021bii honeypot-ului, ne-am confruntat de dou\u0103 ori cu adev\u0103rate ransomware-uri. \u00cen primul caz, a fost vorba despre Crysis. Operatorii s\u0103i au p\u0103truns \u00een sistem prin VNC, dar apoi au instalat TeamViewer, cu ajutorul c\u0103ruia au continuat ac\u021biunile. A\u0219tept\u00e2nd mesajul de r\u0103scump\u0103rare care solicita 10.000 de dolari \u00een BTC, am \u00eenceput o coresponden\u021b\u0103 cu infractorii, rug\u00e2ndu-i s\u0103 ne decripteze unul dintre fi\u0219iere. Ace\u0219tia ne-au \u00eendeplinit cererea \u0219i au reiterat solicitarea de r\u0103scump\u0103rare. Am reu\u0219it s\u0103 negociem p\u00e2n\u0103 la 6.000 de dolari, dup\u0103 care am reinstalat sistemul pe o ma\u0219in\u0103 virtual\u0103, deoarece am ob\u021binut toate informa\u021biile necesare. <\/p>\n<p>Al doilea ransomware a fost Phobos. Hackerul care l-a instalat a petrecut o or\u0103 examin\u00e2nd sistemul de fi\u0219iere al honeypot-ului \u0219i scan\u00e2nd re\u021beaua, dup\u0103 care a instalat ransomware-ul. <br \/>\nA treia atac\u0103 a ransomware-ului s-a dovedit a fi una fals\u0103. Un misterios \u201ehacker\u201d a desc\u0103rcat pe sistemul nostru fi\u0219ierul haha.bat, dup\u0103 care am observat cum \u00eencearc\u0103 s\u0103-l fac\u0103 s\u0103 func\u021bioneze. Una dintre \u00eencerc\u0103ri a fost s\u0103 schimbe numele fi\u0219ierului haha.bat \u00een haha.rnsmwr. <\/p>\n<p><img decoding=\"async\" alt=\"Irezistibil de atractiv: cum am creat un honeypot care nu poate fi descoperit\" src=\"\/wp-content\/uploads\/2020\/10\/cab8571ce84fd25eed10d3f14ed3bff6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>\u201eHackerul\u201d \u00eembun\u0103t\u0103\u021be\u0219te \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0441\u0442 bat-fail-ului schimb\u00e2nd extensia acestuia \u00een .rnsmwr. Sursa: Trend Micro<\/i><\/p>\n<p>C\u00e2nd fi\u0219ierul bat a \u00eenceput \u00een sf\u00e2r\u0219it s\u0103 ruleze, \u201ehackerul\u201d l-a editat, cresc\u00e2nd r\u0103scump\u0103rarea de la 200 la 750 de dolari. Dup\u0103 aceasta, a \u201ecriptat\u201d toate fi\u0219ierele, a l\u0103sat un mesaj de r\u0103scump\u0103rare pe birou \u0219i a disp\u0103rut, schimb\u00e2nd parolele pe VNC-ul nostru. <\/p>\n<p>Dup\u0103 c\u00e2teva zile, hackerul s-a \u00eentors \u0219i, pentru a-\u0219i reaminti de sine, a pornit un bat care deschidea multe feronide cu site-uri pentru adul\u021bi. Se pare c\u0103 prin aceasta \u00eencerca s\u0103 atrag\u0103 aten\u021bia asupra cererii sale.<\/p>\n<p><b><\/p>\n<h3>Concluzii<\/h3>\n<p><\/b><br \/>\n\u00cen timpul studiului, s-a constatat c\u0103 imediat dup\u0103 publicarea informa\u021biilor despre vulnerabilitate, honeypot-ul a atras aten\u021bia, iar activitatea a crescut din zi \u00een zi. Pentru ca momeala s\u0103 atrag\u0103 aten\u021bia, a fost nevoie s\u0103 permite multe \u00eenc\u0103lc\u0103ri ale securit\u0103\u021bii companiei noastre fictive. Din p\u0103cate, o astfel de situa\u021bie nu este deloc rar\u0103 \u00een r\u00e2ndul multor companii reale care nu au angaja\u021bi IT \u0219i de securitate informa\u021bional\u0103.<\/p>\n<p>\u00cen general, organiza\u021biile ar trebui s\u0103 aplice principiul celor mai mici privilegii, \u00een timp ce noi am implementat exact opusul pentru a atrage atacatori. Cu c\u00e2t am observat mai mult atacurile, cu at\u00e2t acestea deveneau mai sofisticate comparativ cu metodele standard de testare a penetr\u0103rii.<\/p>\n<p>\u0218i cel mai important: toate aceste atacuri ar fi e\u0219uat dac\u0103 m\u0103surile de securitate adecvate ar fi fost implementate \u00een timpul configur\u0103rii re\u021belei. Organiza\u021biile trebuie s\u0103 se asigure c\u0103 echipamentele \u0219i componentele infrastructurii industriale nu sunt accesibile din internet, a\u0219a cum am f\u0103cut special \u00een capcana noastr\u0103. <\/p>\n<p>De\u0219i nu am \u00eenregistrat niciun atac asupra ARM-ului inginerului, \u00een ciuda utiliz\u0103rii acelea\u0219i parole de administrator local pe toate calculatoarele, este recomandat s\u0103 se evite aceast\u0103 practic\u0103 pentru a minimaliza posibilele intruziuni. O securitate slab\u0103 reprezint\u0103 un invita\u021bie suplimentar\u0103 pentru atacurile asupra sistemelor industriale, care deja atrag de mult aten\u021bia infractorilor cibernetici.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/trendmicro\/blog\/490406\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u044b \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b-\u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u2014 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u044b, \u0447\u0442\u043e\u0431\u044b \u00ab\u043f\u043e\u0439\u043c\u0430\u0442\u044c \u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb \u0441\u0432\u0435\u0436\u0443\u044e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0442\u0430\u043a\u0442\u0438\u043a\u0443. \u0425\u0430\u043d\u0438\u043f\u043e\u0442\u044b \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e, \u0447\u0442\u043e \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u0432\u044b\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0441\u044f \u0441\u0432\u043e\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0439 \u0438\u043c\u043c\u0443\u043d\u0438\u0442\u0435\u0442: \u043e\u043d\u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u044e\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434 \u043d\u0438\u043c\u0438 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044e\u0442 \u0435\u0451. \u0427\u0442\u043e\u0431\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0442\u0430\u043a\u0442\u0438\u043a\u0443 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u044b\u0439 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041d\u0435\u0432\u044b\u0440\u0430\u0437\u0438\u043c\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u0435\u043d: \u043a\u0430\u043a \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0438\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T17:42:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T17:42:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Incredibil de atr\u0103g\u0103tor: cum am creat un honeypot care nu poate fi descoperit | ProHoster","description":"Antivirusuri.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435\u0432\u044b\u0440\u0430\u0437\u0438\u043c\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u0435\u043d: \u043a\u0430\u043a \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0438\u0442\u044c | ProHoster","og:description":"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T17:42:19+00:00","article:modified_time":"2020-10-09T17:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2026-02-08 20:24:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/96228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=96228"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/96228\/revisions"}],"predecessor-version":[{"id":157867,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/96228\/revisions\/157867"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/96229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=96228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=96228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=96228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}