{"id":88098,"date":"2020-07-12T13:42:23","date_gmt":"2020-07-12T11:42:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/5-kiberatak-kotorye-legko-mozhno-bylo-predotvratit"},"modified":"2020-07-12T13:42:23","modified_gmt":"2020-07-12T11:42:23","slug":"5-kiberatak-kotorye-legko-mozhno-bylo-predotvratit","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/5-kiberatak-kotorye-legko-mozhno-bylo-predotvratit","title":{"rendered":"5 kyber\u00fatokov, ktor\u00fdm sa dalo \u013eahko pred\u00eds\u0165","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ahoj, Habr! Dnes v\u00e1m chceme poveda\u0165 o nov\u00fdch kybernetick\u00fdch \u00fatokoch, ktor\u00e9 ned\u00e1vno objavili na\u0161e analytick\u00e9 centr\u00e1 kybernetickej ochrany. Pod katom sa dozviete o ve\u013ekej strate \u00fadajov v\u00fdrobcom krem\u00edkov\u00fdch \u010dipov, pr\u00edbehu o vypnut\u00ed siet\u00ed v celom meste, nie\u010do o nebezpe\u010denstve upozornen\u00ed Google, \u0161tatistiku o hackersk\u00fdch \u00fatokoch na zdravotn\u00fd syst\u00e9m USA a odkaze na kan\u00e1l Acronis na YouTube.<\/p>\n

\"5<\/a><\/noindex>
\n<\/a><\/noindex>
\nOkrem ochrany va\u0161ich \u00fadajov sa v Acronis zaober\u00e1me aj monitorovan\u00edm hrozieb, vyv\u00edjame opravy pre nov\u00e9 zranite\u013enosti a pripravujeme odpor\u00fa\u010dania na zabezpe\u010denie r\u00f4znych syst\u00e9mov. Na tento \u00fa\u010del bola ned\u00e1vno vytvoren\u00e1 glob\u00e1lna sie\u0165 centier bezpe\u010dnosti Acronis Cyber Protection Operations Centers (CPOCs). V t\u00fdchto centr\u00e1ch prebieha neust\u00e1la anal\u00fdza trafficu, aby sa odhalili nov\u00e9 druhy malv\u00e9ru, v\u00edrusov a kryptojacking. <\/p>\n

Dnes chceme hovori\u0165 o v\u00fdsledkoch pr\u00e1ce CPOCs, ktor\u00e9 teraz pravidelne publikujeme na kan\u00e1le Acronis na YouTube. Tu je 5 najnov\u0161\u00edch spr\u00e1v o incidentoch, ktor\u00fdm by sa dalo vyhn\u00fa\u0165 pri existencii aspo\u0148 element\u00e1rnej ochrany proti ransomv\u00e9ru a phishingu.<\/p>\n

Ransomv\u00e9r Black Kingdom sa nau\u010dil kompromitova\u0165 pou\u017e\u00edvate\u013eov Pulse VPN <\/h3>\n

\n

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

VPN poskytovate\u013e Pulse Secure, ktor\u00e9ho rie\u0161enia vyu\u017e\u00edva 80% firiem zo zoznamu Fortune 500, sa stal obe\u0165ou ransomv\u00e9rov\u00fdch \u00fatokov zo skupiny Black Kingdom. Vyu\u017e\u00edvaj\u00fa zranite\u013enos\u0165 syst\u00e9mu, ktor\u00e1 umo\u017e\u0148uje pre\u010d\u00edta\u0165 s\u00fabor a extrahova\u0165 z neho \u00fadaje o \u00fa\u010dte. Potom sa ukradnut\u00e9 meno a heslo pou\u017e\u00edvaj\u00fa na pr\u00edstup do skompromitovanej siete.<\/p>\n

Aj ke\u010f Pulse Secure u\u017e vydal z\u00e1platu, ktor\u00e1 odstra\u0148uje t\u00fato zranite\u013enos\u0165, firmy, ktor\u00e9 e\u0161te neaktualizovali, s\u00fa v z\u00f3nach zv\u00fd\u0161en\u00e9ho rizika. <\/p>\n

Ako uk\u00e1zali testy, rie\u0161enia vyu\u017e\u00edvaj\u00face umel\u00fa inteligenciu na detekciu hrozieb, ako napr\u00edklad Acronis Active Protection, nedovolili Black Kingdom infikova\u0165 po\u010d\u00edta\u010de koncov\u00fdch pou\u017e\u00edvate\u013eov. Tak\u017ee ak m\u00e1 firma tak\u00fa ochranu alebo syst\u00e9m s integrovan\u00fdm mechanizmom kontroly aktualiz\u00e1ci\u00ed (napr\u00edklad Acronis Cyber Protect), nemus\u00edte ma\u0165 obavy o Black Kingdom.<\/p>\n

\u00datok ransomv\u00e9rom na Knoxville viedol k vypnutiu siete<\/h3>\n

\n

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

12. j\u00fana 2020 bola v meste Knoxville (USA, \u0161t\u00e1t Tennessee) vykonan\u00e1 mas\u00edvna ransomware \u00fatok, ktor\u00fd viedol k vypnutiu po\u010d\u00edta\u010dov\u00fdch siet\u00ed. Medzi in\u00fdm, \u00farady stratili schopnos\u0165 reagova\u0165 na incidenty okrem n\u00fadzov\u00fdch situ\u00e1ci\u00ed a ohrozenia zdravia \u013eud\u00ed. A dokonca aj nieko\u013eko dn\u00ed po ukon\u010den\u00ed \u00fatoku bola na mestskom webe st\u00e1le zverejnen\u00e1 inform\u00e1cia, \u017ee online slu\u017eby s\u00fa nedostupn\u00e9. <\/p>\n

Po\u010diato\u010dn\u00e9 vy\u0161etrovanie uk\u00e1zalo, \u017ee \u00fatok bol v\u00fdsledkom rozsiahlej phishingovej kampane, ktor\u00e1 posielala falo\u0161n\u00e9 e-maily zamestnancom mestsk\u00fdch slu\u017eieb. Pri tom boli pou\u017eit\u00e9 ransomwarov\u00e9 programy ako Maze, DoppelPaymer alebo NetWalker. Rovnako ako v predch\u00e1dzaj\u00facom pr\u00edpade, keby mestsk\u00e9 \u00farady pou\u017eili prostriedky na ochranu pred ransomware, tak\u00fdto \u00fatok by nebol mo\u017en\u00e9 uskuto\u010dni\u0165, preto\u017ee ochrann\u00e9 syst\u00e9my s AI okam\u017eite deteguj\u00fa varianty pou\u017eit\u00fdch \u0161ifrova\u010dov.<\/p>\n

MaxLinear ozn\u00e1mila \u00fatok pomocou Maze a \u00fanik d\u00e1t<\/h3>\n

\n

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

V\u00fdrobca integrovan\u00fdch syst\u00e9mov na \u010dipe, MaxLinear potvrdil, \u017ee siete firmy boli napadnut\u00e9 ransomwarem Maze. Pribli\u017ene 1 TB d\u00e1t bolo ukradnut\u00fdch, vr\u00e1tane osobn\u00fdch \u00fadajov a finan\u010dn\u00fdch inform\u00e1ci\u00ed zamestnancov. Organiz\u00e1tori \u00fatoku u\u017e zverejnili 10 GB z t\u00fdchto d\u00e1t.<\/p>\n

V d\u00f4sledku toho musela MaxLinear odpoji\u0165 v\u0161etky siete firmy a naja\u0165 poradcov na vykonanie vy\u0161etrovania. Na pr\u00edklade tohto \u00fatoku si op\u00e4\u0165 pripomenieme: Maze je dostato\u010dne zn\u00e1my a dobre rozpoznate\u013en\u00fd variant ransomwaru. V pr\u00edpade pou\u017eitia ochrann\u00fdch syst\u00e9mov by MaxLinear mohla u\u0161etri\u0165 zna\u010dn\u00e9 mno\u017estvo pe\u0148az\u00ed a vyhn\u00fa\u0165 sa po\u0161kodeniu reput\u00e1cie spolo\u010dnosti.<\/p>\n

Malv\u00e9r \"prenikol\" cez falo\u0161n\u00e9 upozornenia Google Alerts <\/h3>\n

\n

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

P\u00e1chatelia za\u010dali vyu\u017e\u00edva\u0165 Google Alerts na rozosielanie falo\u0161n\u00fdch upozornen\u00ed na \u00faniky \u00fadajov. V d\u00f4sledku toho, dost\u00e1vaj\u00fac znepokojiv\u00e9 spr\u00e1vy, vystra\u0161en\u00ed pou\u017e\u00edvatelia prech\u00e1dzali na falo\u0161n\u00e9 str\u00e1nky a s\u0165ahovali malv\u00e9r v n\u00e1deji, \u017ee \"vyrie\u0161ia probl\u00e9m\".
\nMalv\u00e9rov\u00e9 upozornenia funguj\u00fa v Chrome a Firefox. Av\u0161ak URL filtrovanie, vr\u00e1tane slu\u017eby Acronis Cyber Protect, nedovolilo pou\u017e\u00edvate\u013eom v chr\u00e1nen\u00fdch sie\u0165ach prech\u00e1dza\u0165 na infikovan\u00e9 odkazy. <\/p>\n

Americk\u00fd ministerstvo zdravotn\u00edctva ozn\u00e1milo 393 poru\u0161en\u00ed po\u017eadavk\u016f na bezpe\u010dnost HIPAA za minul\u00fd rok<\/h3>\n

\n

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Ministerstvo zdravotn\u00edctva a soci\u00e1lnych slu\u017eieb USA (Department of Health and Human Services \u2014 HHS) ozn\u00e1milo 393 \u00fanikov d\u00f4vern\u00fdch inform\u00e1ci\u00ed o zdrav\u00ed pacientov, ktor\u00e9 viedli k poru\u0161eniam po\u017eiadaviek z\u00e1kona o prenosite\u013enosti a zodpovednosti zdravotn\u00e9ho poistenia (HIPAA) v obdob\u00ed od j\u00fana 2019 do j\u00fana 2020. Z toho 142 incidentov bolo v\u00fdsledkom phishingov\u00fdch \u00fatokov na District Medical Group a Marinette Wisconsin, z ktor\u00fdch sa vytratilo 10190 a 27137 elektronick\u00fdch zdravotn\u00fdch z\u00e1znamov.<\/p>\n

\u017dia\u013e, prax uk\u00e1zala, \u017ee aj \u0161peci\u00e1lne vy\u0161kolen\u00ed a pripraven\u00ed pou\u017e\u00edvatelia, ktor\u00fdm opakovane vysvet\u013eovali o nepr\u00edpustnosti otv\u00e1rania odkazov alebo pr\u00edloh z podozriv\u00fdch e-mailov, m\u00f4\u017eu by\u0165 obete. A bez automatizovan\u00fdch syst\u00e9mov na blokovanie podozrivej \u010dinnosti a URL filtrovania na zabr\u00e1nenie prechodu na falo\u0161n\u00e9 str\u00e1nky je ve\u013emi \u0165a\u017ek\u00e9 chr\u00e1ni\u0165 sa pred sofistikovan\u00fdmi \u00fatokmi, ktor\u00e9 vyu\u017e\u00edvaj\u00fa ve\u013emi presved\u010div\u00e9 d\u00f4vody, d\u00f4veryhodn\u00e9 e-mailov\u00e9 ko\u0161e a vysok\u00fa \u00farove\u0148 soci\u00e1lneho in\u017einierstva. <\/p>\n

Ak m\u00e1te z\u00e1ujem o spr\u00e1vy o najnov\u0161\u00edch hrozb\u00e1ch, m\u00f4\u017eete sa prihl\u00e1si\u0165 na kan\u00e1l Acronis YouTube, kde hovor\u00edme o najnov\u0161\u00edch v\u00fdsledkoch monitorovania CPOC t\u00e9m\u011b\u0159 v re\u00e1lnom \u010dase. M\u00f4\u017eete sa tie\u017e prihl\u00e1si\u0165 na n\u00e1\u0161 blog na Habr.com, preto\u017ee tu budeme zverej\u0148ova\u0165 najzauj\u00edmavej\u0161ie aktualiz\u00e1cie a v\u00fdsledky v\u00fdskumu.<\/p>\n

Len registrovan\u00ed pou\u017e\u00edvatelia sa m\u00f4\u017eu z\u00fa\u010dastni\u0165 prieskumu. Prihl\u00e1ste sa<\/a><\/noindex>, pros\u00edm.<\/p>\n

Dostali ste ve\u013emi presved\u010div\u00e9 phishingov\u00e9 e-maily za posledn\u00fd rok?<\/h2>\n