{"id":96242,"date":"2020-10-09T19:42:33","date_gmt":"2020-10-09T17:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza"},"modified":"2020-10-09T19:42:33","modified_gmt":"2020-10-09T17:42:33","slug":"dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","title":{"rendered":"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>(mul\u021bumiri lui Sergey G. Brester pentru ideea titlului <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/users\/sebres\/\" class=\"user_link\">sebres<\/a><\/noindex>)<\/p>\n<p>Colegi, scopul acestui articol este de a \u00eemp\u0103rt\u0103\u0219i experien\u021ba unui an de testare a unui nou tip de solu\u021bii IDS bazate pe tehnologii de Decep\u021bie. <\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/f641b6735cf846d12a0081c7709662e7.png\" style=\"display:block;margin: 0 auto;\" \/><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Pentru a men\u021bine coeren\u021ba materialului, consider c\u0103 este necesar s\u0103 \u00eencepem cu premisele. A\u0219adar, problema este:<\/p>\n<ol>\n<li>Atacurile direc\u021bionate sunt cel mai periculos tip de atacuri, de\u0219i propor\u021bia lor \u00een totalul amenin\u021b\u0103rilor este mic\u0103. <\/li>\n<li>Nu s-a g\u0103sit \u00eenc\u0103 un mijloc de ap\u0103rare a perimetrului garantat eficient (sau un complex de astfel de mijloace). <\/li>\n<li>De obicei, atacurile direc\u021bionate se desf\u0103\u0219oar\u0103 \u00een mai multe etape. Trecerea de la perimetru este doar una dintre etapele ini\u021biale, care (pute\u021bi s\u0103 m\u0103 ''bate\u021bi'' cu pietre) nu implic\u0103 daune mari pentru ''victim\u0103'', dac\u0103, desigur, nu este vorba despre atacuri DEoS (Destruction of service) (ransomware \u0219i altele). Daunele reale \u00eencep mai t\u00e2rziu, c\u00e2nd activele capturate sunt folosite pentru pivotare \u0219i dezvoltarea unui atac ''\u00een ad\u00e2ncime'', iar noi nu am observat asta. <\/li>\n<li>Av\u00e2nd \u00een vedere c\u0103 \u00eencepem s\u0103 suferim pierderi reale doar atunci c\u00e2nd infractorii ajung efectiv la obiectivele atacului (servere de aplica\u021bii, SGBD-uri, stocare de date, repositoare, elemente de infrastructur\u0103 critic\u0103), este logic c\u0103 una dintre sarcinile serviciului de securitate informa\u021bional\u0103 este \u00eentreruperea atacurilor \u00eenainte de a se produce acel eveniment nefericit. Dar pentru a opri ceva, trebuie mai \u00eent\u00e2i s\u0103 afl\u0103m despre acel lucru. \u0218i cu c\u00e2t mai devreme \u2013 cu at\u00e2t mai bine. <\/li>\n<li>Prin urmare, pentru gestionarea cu succes a riscurilor (adic\u0103, reducerea daunelor din atacurile direc\u021bionate) este esen\u021bial s\u0103 existe instrumente care s\u0103 asigure un TTD minim (time to detect \u2013 timpul de la imersie p\u00e2n\u0103 la descoperirea atacului). \u00cen func\u021bie de industrie \u0219i regiune, aceast\u0103 perioad\u0103 dureaz\u0103 \u00een medie 99 de zile \u00een SUA, 106 zile \u00een regiunea EMEA, 172 de zile \u00een regiunea APAC (M-Trends 2017, A View From the Front Lines, Mandiant). <\/li>\n<li>Ce ofer\u0103 pia\u021ba?\n<ul>\n<li>\u201eSandbox-uri\u201d. O alt\u0103 m\u0103sur\u0103 de control preventiv, care este departe de ideal. Exist\u0103 o mul\u021bime de tehnici eficiente de detec\u021bie \u0219i ocolire a sandbox-urilor sau a solu\u021biilor de whitelisting. b\u0103ie\u021bii din \u201elatura \u00eentunecat\u0103\u201d sunt aici \u00een continuare cu un pas \u00eenainte. \n<\/li>\n<li>UEBA (sisteme de profilare a comportamentului \u0219i detectare a anomaliilor) teoretic poate fi foarte eficient. Dar, din punctul meu de vedere, aceasta este o perspectiv\u0103 pentru viitorul \u00eendep\u0103rtat. Practic, este \u00eenc\u0103 foarte costisitor, nesigur \u0219i necesit\u0103 o infrastructur\u0103 IT \u0219i de securitate informa\u021bional\u0103 foarte matur\u0103 \u0219i stabil\u0103, unde exist\u0103 deja toate instrumentele care vor genera date pentru analiza comportamental\u0103.\n<\/li>\n<li>SIEM este un instrument bun pentru investiga\u021bii, dar nu poate identifica \u0219i prezenta la timp ceva nou, original, deoarece regulile de corelare sunt acelea\u0219i semn\u0103turi. <\/li>\n<\/ul>\n<p>\n <\/li>\n<li>\u00cen consecin\u021b\u0103, a ap\u0103rut nevoia unui astfel de instrument care s\u0103:\n<ul>\n<li>func\u021bioneze cu succes \u00een condi\u021bii de perimetru deja compromis,\n<\/li>\n<li>detecteze atacuri reu\u0219ite \u00eentr-un mod aproape \u00een timp real, indiferent de instrumentele \u0219i vulnerabilit\u0103\u021bile utilizate,<\/li>\n<li>s\u0103 nu depind\u0103 de semn\u0103turi\/reguli\/scenarii\/politici\/profiluri \u0219i alte chestiuni statice,<\/li>\n<li>s\u0103 nu necesite mari volume de date \u0219i surse pentru analiz\u0103,<\/li>\n<li>s\u0103 permit\u0103 identificarea atacurilor nu ca un anumit risc-scor \u00een urma lucr\u0103rii \u2018cea mai bun\u0103 din lume, brevetat\u0103 \u0219i, prin urmare, \u00eenchis\u0103 matematic\u0103\u2019, care necesit\u0103 investiga\u021bii suplimentare, ci practic ca un eveniment binar \u2013 \u2018Da, suntem ataca\u021bi\u2019 sau \u2018Nu, totul este \u00een regul\u0103\u2019,<\/li>\n<li>s\u0103 fie universal, eficient scalabil \u0219i realmente implementabil \u00een orice mediu heterogen, indiferent de topologia fizic\u0103 \u0219i logic\u0103 a re\u021belei folosite.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>\nLa acest rol aspir\u0103 acum, a\u0219a-numitele, solu\u021bii de decep\u021bie. Adic\u0103 solu\u021bii bazate pe vechea conceptie a honeypot-urilor, dar cu un nivel complet diferit de implementare. Aceast\u0103 tem\u0103 este clar \u00een ascensiune acum.<\/p>\n<p>Rezultatele <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gartner.com\/newsroom\/id\/3744917\">Gartner Security&amp;Risc management summit 2017<\/a><\/noindex> Solu\u021biile de decep\u021bie sunt \u00een top 3 strategii \u0219i instrumente recomandate pentru utilizare. <\/p>\n<p>Conform raportului <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tag-cyber.com\/Annual\/2017\/\">TAG Cybersecurity Annual 2017<\/a><\/noindex> Decep\u021bia este unul dintre direc\u021biile principale de dezvoltare a solu\u021biilor IDS (Sisteme de Detectare a Intrusurilor).<\/p>\n<p>O \u00eentreag\u0103 sec\u021biune din ultimul <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/security\/security-reports.html\">raport Cisco despre starea securit\u0103\u021bii IT<\/a><\/noindex>, dedicat\u0103 SCADA, se bazeaz\u0103 pe datele unuia dintre liderii acestei pie\u021be, TrapX Security (Israel), ale c\u0103ror solu\u021bii au func\u021bionat deja un an \u00een zona noastr\u0103 de testare. <\/p>\n<p>TrapX Deception Grid permite construirea \u0219i operarea centralizat\u0103 a IDS-uri distribuite masive, f\u0103r\u0103 a cre\u0219te povara licen\u021belor \u0219i cerin\u021bele pentru resurse hardware. De fapt, TrapX este un constructor care permite creare din elementele unei infrastructuri IT existente a unui mare mecanism de detectare a atacurilor la nivel de \u00eentreprindere, un fel de \u201esistem de alarm\u0103\u201d distribuit. <\/p>\n<h3>Structura Solu\u021biei<\/h3>\n<p>\n\u00cen laboratorul nostru, studiem \u0219i test\u0103m constant diverse inova\u021bii \u00een domeniul securit\u0103\u021bii IT. \u00cen prezent, aici sunt desf\u0103\u0219urate aproximativ 50 de servere virtuale, inclusiv componentele TrapX Deception Grid.<\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/9c9c21101020c1005edc938a3a7ca393.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nA\u0219adar, de sus \u00een jos:<\/p>\n<ol>\n<li>TSOC (TrapX Security Operation Console) \u2013 creierul sistemului. Aceasta este consola central\u0103 de control, prin care se realizeaz\u0103 configurarea, desf\u0103\u0219urarea solu\u021biei \u0219i toat\u0103 activitatea zilnic\u0103. Deoarece este un serviciu web, poate fi desf\u0103\u0219urat oriunde \u2013 la margine, \u00een cloud sau la un furnizor MSSP. <\/li>\n<li>TrapX Appliance (TSA) \u2013 server virtual, la care conect\u0103m, printr-un port trunk, subre\u021belele pe care dorim s\u0103 le cuprindem \u00een monitorizare. De asemenea, aici \u201etr\u0103iesc\u201d de fapt toate senzorii no\u0219tri de re\u021bea.\n<p>\u00cen laboratorul nostru este desf\u0103\u0219urat un TSA (mwsapp1), dar de fapt pot fi multe. Acest lucru poate fi necesar \u00een re\u021bele mari, unde \u00eentre segmente nu exist\u0103 conectivitate L2 (un exemplu tipic \u2013 \u201eHolding \u0219i filialele\u201d sau \u201eSediul central al b\u0103ncii \u0219i sucursalele\u201d) sau dac\u0103 \u00een re\u021bea exist\u0103 segmente izolate, de exemplu, SCADA. \u00cen fiecare astfel de filial\u0103\/segment se poate desf\u0103\u0219ura propriul TSA \u0219i \u00eel putem conecta la un TSOC unic, pe care toate informa\u021biile vor fi procesate centralizat. Aceast\u0103 arhitectur\u0103 permite construirea de sisteme de monitorizare distribuite f\u0103r\u0103 a necesita o reorganizare radical\u0103 a re\u021belei sau \u00eenc\u0103lcarea segment\u0103rii existente.<\/p>\n<p>De asemenea, pe TSA putem trimite o copie a traficului de ie\u0219ire prin TAP\/SPAN. \u00cen cazul \u00een care se descoper\u0103 conexiuni cu botneturi cunoscute, servere de comand\u0103, sesiuni TOR, vom ob\u021bine \u0219i rezultatul \u00een consol\u0103. Acest lucru este gestionat de Network Intelligence Sensor (NIS). \u00cen mediu nostru, aceast\u0103 func\u021bionalitate este realizat\u0103 pe firewall, de aceea nu am utilizat-o aici. <\/li>\n<li>Aplicatii Capcane (Full OS) \u2013 honeypoturi tradi\u021bionale bazate pe servere Windows. Nu este necesar s\u0103 fie multe, deoarece sarcina principal\u0103 a acestor servere este de a oferi servicii IT pentru nivelul urm\u0103tor de senzori sau de a detecta atacuri asupra aplica\u021biilor de afaceri care pot fi desf\u0103\u0219urate \u00een medii Windows. \u00cen laboratorul nostru, avem instalat un astfel de server (FOS01)\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/8de44215efff4a49f3b773da10185a73.png\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li>Capcane emulate \u2013 componenta principal\u0103 a solu\u021biei, care ne permite s\u0103 cre\u0103m un c\u00e2mp minat foarte dens pentru atacatori, folosind o singur\u0103 ma\u0219in\u0103 virtual\u0103 \u0219i s\u0103 satur\u0103m re\u021beaua \u00eentreprinderii, toate VLAN-urile sale, cu senzorii no\u0219tri. Atacatorul vede un astfel de senzor, sau un gazd\u0103 fantom\u0103, ca un adev\u0103rat PC sau server Windows, server Linux sau alt dispozitiv pe care alegem s\u0103 i-l ar\u0103t\u0103m.\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/306c21046c5baadd591b66cdfe153ec2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPentru a fi de folos \u0219i din curiozitate, am desf\u0103\u0219urat \u201ec\u00e2te una din fiecare specie\u201d \u2013 PC-uri Windows \u0219i servere de diferite versiuni, servere Linux, bancomate cu Windows embedded, SWIFT Web Access, imprimante de re\u021bea, switch-uri Cisco, camere IP Axis, MacBook-uri, dispozitive PLC \u0219i chiar o lamp\u0103 inteligent\u0103. \u00cen total \u2013 13 gazde. \u00cen general, vendorul recomand\u0103 desf\u0103\u0219urarea acestor senzori \u00een propor\u021bie de minim 10% din num\u0103rul real de gazde. Limita superioar\u0103 este reprezintat\u0103 de spa\u021biul de adrese disponibil. <\/p>\n<p>Un aspect foarte important este c\u0103 fiecare astfel de gazd\u0103 nu este o ma\u0219in\u0103 virtual\u0103 complet\u0103, care necesit\u0103 resurse \u0219i licen\u021be. Este o \u201e\u00een\u0219el\u0103ciune\u201d, o emulare, un proces pe TSA, care are un set de parametri \u0219i o adres\u0103 IP. Prin urmare, chiar \u0219i cu un singur TSA, putem satura re\u021beaua cu sute de astfel de gazde fantom\u0103, care vor func\u021biona ca senzori \u00een sistemul de alarm\u0103. Aceast\u0103 tehnologie permite scalarea economic\u0103 eficient\u0103 a conceptului de \u201ehoneypots\u201d la nivelul oric\u0103rei \u00eentreprinderi mari \u0219i distribuite. <\/p>\n<p>Aceste gazde, din perspectiva atacatorului, sunt atr\u0103g\u0103toare, deoarece con\u021bin vulnerabilit\u0103\u021bi \u0219i par a fi \u021binte relativ u\u0219oare. Atacatorul vede serviciile disponibile pe aceste gazde \u0219i poate interac\u021biona cu ele, atac\u00e2ndu-le, folosind instrumente \u0219i protocoale standard (smb\/wmi\/ssh\/telnet\/web\/dnp\/bonjour\/Modbus etc.). Totu\u0219i, utilizarea acestor gazde pentru a dezvolta un atac sau a lansa propriul cod nu este posibil\u0103.\n<\/li>\n<li>Combina\u021bia acestor dou\u0103 tehnologii (FullOS \u0219i capcanele emulate) permite atingerea unei probabilit\u0103\u021bi statistice ridicate ca atacatorul s\u0103 se confrunte, mai devreme sau mai t\u00e2rziu, cu un element al re\u021belei noastre de semnalizare. Dar cum putem face ca aceast\u0103 probabilitate s\u0103 fie aproape de 100%?\n<p>\u00cen lupt\u0103 intr\u0103 a\u0219a-numitele tokenuri (Deception tokens). Datorit\u0103 lor, putem include \u00een compunerea IDS-ului nostru distribuit toate PC-urile \u0219i serverele disponibile \u00een cadrul \u00eentreprinderii. Tokenurile sunt plasate pe PC-urile reale ale utilizatorilor. Este important de \u00een\u021beles c\u0103 tokenurile nu sunt agen\u021bi care consum\u0103 resurse \u0219i pot provoca conflicte. Tokenurile sunt elemente informative pasive, o specie de \u201efirimituri\u201d pentru atacator, care \u00eel ghideaz\u0103 \u00een capcan\u0103. De exemplu, discurile de re\u021bea conectate, marcajele c\u0103tre panouri de administrare false \u00een browser \u0219i parolele salvate pentru acestea, sesiunile salvate ssh\/rdp\/winscp, capcanele noastre cu comentarii \u00een fi\u0219ierele hosts, parolele salvate \u00een memorie, acreditivul unor utilizatori inexisten\u021bi, fi\u0219ierele office, deschiderea c\u0103rora va activa sistemul \u0219i multe altele. Astfel, plas\u0103m atacatorul \u00eentr-un mediu distorsionat, saturat cu acele vectore de atac care, de fapt, nu reprezint\u0103 o amenin\u021bare pentru noi, ci, dimpotriv\u0103. \u0218i el nu are posibilitatea s\u0103 determine unde se afl\u0103 informa\u021bia adev\u0103rat\u0103 \u0219i unde cea fals\u0103. Astfel, nu doar c\u0103 asigur\u0103m o detec\u021bie rapid\u0103 a atacului, ci \u0219i \u00eencetinim considerabil desf\u0103\u0219urarea acestuia. <\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/812409dca0c8bc991c7e9812f16d77cf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Exemplu de creare a unei capcane de re\u021bea \u0219i configurarea tokenurilor. Interfa\u021b\u0103 prietenoas\u0103 \u0219i f\u0103r\u0103 necesitatea de modific\u0103ri manuale ale configura\u021biilor, scripturilor etc.<\/i><\/p>\n<p>\u00cen mediul nostru, am configurat \u0219i plasat o serie de astfel de tokenuri pe FOS01 sub Windows Server 2012R2 \u0219i pe un PC de test sub Windows 7. Pe aceste ma\u0219ini este activat RDP \u0219i periodic 'le expunem' \u00een DMZ, unde sunt de asemenea plasate \u0219i c\u00e2teva dintre senzorii no\u0219tri (capcane emulate). Astfel, ob\u021binem un flux constant de incidente, a\u0219a-zis, \u00een mod natural. <\/p>\n<p>A\u0219adar, o scurt\u0103 statistic\u0103 pentru un an:<\/p>\n<p>56 208 \u2013 incidente \u00eenregistrate,<br \/>\n2 912 \u2013 gazde surs\u0103 de atacuri detectate. <\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/0b2404084a997ba5fe4ad33303501612.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Hart\u0103 interactiv\u0103, clicabil\u0103 a atacurilor<\/i><\/p>\n<p>\u00cen acest sens, solu\u021bia nu genereaz\u0103 un mega-log sau un fir de evenimente pe care trebuie s\u0103 te str\u0103duie\u0219ti s\u0103-l \u00een\u021belegi. \u00cen schimb, solu\u021bia clasific\u0103 singur\u0103 evenimentele \u00een func\u021bie de tipurile lor \u0219i permite echipei de securitate s\u0103 se concentreze mai \u00eent\u00e2i pe cele mai periculoase \u2013 atunci c\u00e2nd atacatorul \u00eencearc\u0103 s\u0103 ridice sesiuni de control (interaction) sau c\u00e2nd \u00een traficul nostru apar payload-uri binare (infection). <\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/d0ad109bae7dc0fb80182d43be713d4e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nToate informa\u021biile despre evenimente sunt citibile \u0219i, din punctul meu de vedere, sunt prezentate \u00eentr-un mod u\u0219or de \u00een\u021beles, chiar \u0219i pentru utilizatorii cu cuno\u0219tin\u021be de baz\u0103 \u00een domeniul securit\u0103\u021bii informa\u021biei. <\/p>\n<p>Majoritatea incidentelor \u00eenregistrate sunt \u00eencerc\u0103ri de scanare a hosturilor noastre sau conexiuni unice. <\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/ea87b3592b2d3727815050b9fd1f708e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSau \u00eencerc\u0103ri de a for\u021ba parole pentru RDP.<\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/645b5984d1ffaf31758fb23e9a23c9eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDar au existat \u0219i cazuri mai interesante, mai ales c\u00e2nd atacatorii au \u201ereu\u0219it\u201d s\u0103 sparg\u0103 o parol\u0103 pentru RDP \u0219i au ob\u021binut acces \u00een re\u021beaua local\u0103. <\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/3cde5beadaa306d32c382f66bd67ec33.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAtacatorul \u00eencearc\u0103 s\u0103 execute cod folosind psexec.<\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/1356ef44f3581b37c3163ce454fecf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAtacatorul a g\u0103sit o sesiune salvat\u0103, care l-a dus \u00eentr-o capcan\u0103 sub forma unui server Linux. Imediat dup\u0103 conectare, cu un set de comenzi deja preg\u0103tit, a \u00eencercat s\u0103 \u0219tearg\u0103 toate fi\u0219ierele de jurnal \u0219i variabilele de sistem corespunz\u0103toare.<\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/6d8994cd3bb2268e45540e5bbcdc74a4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAtacatorul \u00eencearc\u0103 s\u0103 efectueze o injec\u021bie SQL pe o capcan\u0103 care imit\u0103 SWIFT Web Access.<\/p>\n<p>Pe l\u00e2ng\u0103 aceste atacuri \u201enaturale\u201d, am efectuat \u0219i o serie de teste proprii. Unul dintre cele mai ilustrative este testarea timpului de detectare a unui vierme de re\u021bea \u00een re\u021bea. Pentru aceasta, am folosit un instrument de la GuardiCore numit <noindex><a rel=\"nofollow\" href=\"http:\/\/www.guardicore.com\/infectionmonkey\/\">Infection Monkey<\/a><\/noindex>. Acesta este un vierme de re\u021bea care poate infecta Windows \u0219i Linux, dar f\u0103r\u0103 o \u201e\u00eenc\u0103rc\u0103tur\u0103\u201d util\u0103. <br \/>\nAm desf\u0103\u0219urat un centru de comand\u0103 local, pe una dintre ma\u0219ini am lansat primul exemplar al viermului \u0219i am primit primul avertisment \u00een consola TrapX \u00een mai pu\u021bin de o minut\u0103 \u0219i jum\u0103tate. TTD 90 de secunde comparativ cu 106 zile \u00een medie... <\/p>\n<p>Datorit\u0103 posibilit\u0103\u021bii de integrare cu alte tipuri de solu\u021bii, putem trece de la detectarea rapid\u0103 a amenin\u021b\u0103rilor la r\u0103spunsul automat la acestea. <\/p>\n<p>De exemplu, integrarea cu sistemele NAC (Controlul Accesului \u00een Re\u021bea) sau cu CarbonBlack va permite deconectarea automat\u0103 a PC-urilor compromise de la re\u021bea. <\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/4364d6374b57e5741e33f8981b4cb0ad.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIntegrarea cu sandbox-uri permite transmiterea automat\u0103 pentru analiz\u0103 a fi\u0219ierelor implicate \u00een atac. <\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/c66b8051d0dbd31c1215329d1b55930b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Integrarea cu McAfee<\/h3>\n<p>\nDe asemenea, solu\u021bia are un sistem \u00eencorporat de corelare a evenimentelor.<\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/d4030212690f3ee1f1a641c49bc90960.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDar capacit\u0103\u021bile acesteia nu ne-au mul\u021bumit, a\u0219a c\u0103 am integrat-o cu HP ArcSight.<\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/f08d607c5b4abf8dc354f65ed2591ebc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGestionarea amenin\u021b\u0103rilor detectate \u201e\u00een comun\u201d este ajutat\u0103 de sistemul de ticketing \u00eencorporat.<\/p>\n<p><img decoding=\"async\" alt=\"O vulnerabilitate ca instrument de securitate \u2013 2 sau cum s\u0103 prindem APT \u201e\u00een capcan\u0103\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/0e78fa59b2f2b114fa9bdf572f37ea96.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDeoarece solu\u021bia a fost dezvoltat\u0103 \u201ede la start\u201d pentru nevoile institu\u021biilor guvernamentale \u0219i sectorului corporativ mare, exist\u0103, desigur, un model de acces bazat pe roluri, integrare cu AD, un sistem avansat de rapoarte \u0219i trigeri (notific\u0103ri de evenimente), orchestrare pentru structuri mari de holdin sau furnizori MSSP. <\/p>\n<h3>\u00cen loc de rezumat<\/h3>\n<p>\nDac\u0103 exist\u0103 un astfel de sistem de monitorizare, care, figurativ vorbind, ne acoper\u0103 spatele, atunci compromiterea perimetrului este doar \u00eenceputul. Cel mai important este c\u0103 apare o oportunitate real\u0103 de a lupta \u00eempotriva incidentelor de securitate a informa\u021biei, nu de a ne ocupa de consecin\u021bele acestora.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/softline\/blog\/413893\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G. Brester sebres) \u041a\u043e\u043b\u043b\u0435\u0433\u0438, \u0446\u0435\u043b\u044c\u044e \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0433\u043e\u0434\u0438\u0447\u043d\u043e\u0439 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 IDS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Deception-\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439. \u0427\u0442\u043e\u0431\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u0441\u0447\u0438\u0442\u0430\u044e \u043d\u0443\u0436\u043d\u044b\u043c \u043d\u0430\u0447\u0430\u0442\u044c \u0441 \u043f\u0440\u0435\u0434\u043f\u043e\u0441\u044b\u043b\u043e\u043a. \u0418\u0442\u0430\u043a, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0442\u0438\u043a\u0430: \u041d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u2013 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0432\u0438\u0434 \u0430\u0442\u0430\u043a, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432 \u043e\u0431\u0449\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0433\u0440\u043e\u0437 \u0438\u0445 \u0443\u0434\u0435\u043b\u044c\u043d\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0414\u044b\u0440\u0430 \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2013 2, \u0438\u043b\u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u044c APT \u00ab\u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T17:42:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T17:42:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitatea ca instrument de securitate \u2013 2, sau cum s\u0103 prindem APT \u201e\u00een \u00een\u0219el\u0103ciune\u201d | ProHoster","description":"(mul\u021bumiri lui Sergey G. pentru idee)","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u044b\u0440\u0430 \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2013 2, \u0438\u043b\u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u044c APT \u00ab\u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb | ProHoster","og:description":"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T17:42:33+00:00","article:modified_time":"2020-10-09T17:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:47:24","updated":"2022-10-03 07:10:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/96242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=96242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/96242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/96243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=96242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=96242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=96242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}