Fungidzira mamiriro ezvinhu aya. Cold Gumiguru mangwanani, dhizaini Institute munzvimbo yedunhu reimwe yematunhu eRussia. Mumwe munhu anobva kudhipatimendi reHR anoenda kune rimwe remapeji evacancy pawebhusaiti yechikoro, yakatumirwa mazuva mashoma apfuura, uye anoona mufananidzo wekatsi ipapo. Mangwanani anokurumidza kupera kuva anofinha...
Muchinyorwa chino, Pavel Suprunyuk, mukuru wehunyanzvi wedhipatimendi rekuongorora uye kubvunzana kuBoka-IB, anotaura nezve nzvimbo yekurwiswa kwevanhu mumapurojekiti anoongorora kuchengetedzwa kunoshanda, maitiro asina kujairika avanogona kutora, uye maitiro ekudzivirira kubva mukurwiswa kwakadaro. Munyori anojekesa kuti chinyorwa ndechekuongorora, zvisinei, kana paine chinhu chinofarira vaverengi, Boka-IB nyanzvi dzinopindura zviri nyore mibvunzo mune zvakataurwa.
Chikamu 1. Sei zvakakomba kudaro?
Ngatidzokere kukitsi yedu. Mushure menguva yakati, dhipatimendi reHR rinodzima foto (iyo skrini pano nepazasi inodzokororwa zvishoma kuti isaburitse mazita chaiwo), asi inodzokera nekuomesa musoro, inobviswa zvakare, uye izvi zvinoitika kakawanda. Dhipatimendi reHR rinonzwisisa kuti katsi ine vavariro dzakakomba, haadi kubva, uye vanodaidza rubatsiro kubva kune web programmer - munhu akagadzira saiti uye anoinzwisisa, uye iye zvino anoibata. Mugadziri anoenda kune saiti, anodzima zvakare katsi inogumbura, anoona kuti yakatumirwa pachinzvimbo chedhipatimendi reHR pachayo, obva aita fungidziro yekuti password yedhipatimendi reHR yakadonhedza kune dzimwe hooligan dzepamhepo, ndokuchichinja. Katsi haichaoneki zvakare.
Chii chaizvo chakaitika? Zvichienderana neboka remakambani aisanganisira iyo Institute, Boka-IB nyanzvi dzakaita bvunzo yekupinda mufomati iri padyo neRed Teaming (nemamwe mazwi, uku kutevedzera kurwiswa kwakanangana nekambani yako uchishandisa nzira dzepamusoro uye maturusi kubva arsenal yemapoka ehacker). Takataura zvakadzama nezveRed Teaming . Izvo zvakakosha kuti uzive kuti kana uchiitisa bvunzo yakadai, huwandu hwakanyanya hwekurwiswa husati hwabvumirana hunogona kushandiswa, kusanganisira social engineering. Zviri pachena kuti kuiswa kwekati pachayo kwakanga kusiri chinangwa chekupedzisira chezvaiitika. Uye pane zvinotevera:
- Webhusaiti yeInstitute yakaitwa pane sevha mukati metiweki yeInstitute pachayo, uye kwete pamaseva echitatu-bato;
- Kudonha muakaundi yedhipatimendi reHR kwakawanikwa (iyo email log faira iri pamudzi wesaiti). Zvakanga zvisingagoneke kutonga saiti neakaundi iyi, asi zvaive zvichikwanisika kugadzirisa mapeji ebasa;
- Nekuchinja mapeji, unogona kuisa zvinyorwa zvako muJavaScript. Kazhinji ivo vanoita kuti mapeji awirirane, asi mumamiriro ezvinhu aya, iwo manyoro anogona kuba kubva kubhurawuza yemushanyi izvo zvakasiyanisa dhipatimendi reHR kubva kumugadziri wepurogiramu, uye mugadziri wepurogiramu kubva kumuenzi ari nyore - mucherechedzo wechikamu pasaiti. Katsi iyi yaive nhanho yekurwisa uye mufananidzo wekukwezva kutarisa. Mumutauro weHTML webhusaiti, zvaiita seizvi: kana mufananidzo wako wazara, JavaScript yakatoitwa uye ID yako yechikamu, pamwe nedata nezve browser yako uye IP kero, yakatobiwa.
- Iine yakabiwa sedhisheni yedhijitari ID, zvinokwanisika kuwana mukana wakazara kune saiti, tambira mapeji anogoneka muPHP, uye nekudaro kuwana mukana kune server inoshanda sisitimu, uyezve kune yemuno network pachayo, yaive yakakosha yepakati chinangwa che. chirongwa.
Kurwiswa kwacho kwakabudirira zvishoma: ID yechikamu chemutungamiriri yakabiwa, asi yakasungirirwa kukero yeIP. Hatina kukwanisa kutenderedza izvi; hatina kukwanisa kusimudza ropafadzo dzesaiti yedu kuti tive neropafadzo dzemaneja, asi takavandudza mafungiro edu. Mhedzisiro yekupedzisira yakazowanikwa mune chimwe chikamu che network perimeter.
Chikamu 2. Ndiri kukunyorera - chii chimwe? Iniwo ndinofona ndichitenderera muhofisi mako, ndichidonhedza maflash drive.
Zvakaitika mumamiriro ezvinhu nekatsi muenzaniso weinjiniya yemagariro, zvisinei kwete zvechinyakare. Muchokwadi, pakanga paine zvimwe zviitiko munyaya iyi: pakange paine katsi, uye chikoro, uye dhipatimendi revashandi, uye programmer, asi pakanga painewo maemail aine mibvunzo inojekesa iyo yainzi "vanokwikwidza" vakanyorera kudhipatimendi revashandi pachavo uye ivo pachavo. kumugadziri wepurogiramu kuitira kuvadenha kuti vaende kune saiti peji.
Kutaura nezvetsamba. Yakajairika email, ingangove mota huru yekuita zvemagariro engineering, haina kurasikirwa nekukosha kwayo kwemakumi emakore uye dzimwe nguva inotungamira kune yakanyanya kujairika mhedzisiro.
Tinowanzo taura nyaya inotevera pazviitiko zvedu, sezvo iri kuratidza zvakanyanya.
Kazhinji, zvichibva pamhedzisiro yemapurojekiti einjiniya yemagariro, isu tinogadzira zviverengero, izvo, sezvatinoziva, chinhu chakaoma uye chinofinha. Vazhinji muzana vevakagamuchira vakavhura zvakanamirwa kubva mutsamba, saka vazhinji vakatevera chinongedzo, asi vatatu ava vakanyatsoisa zita ravo rekushandisa uye password. Mune imwe purojekiti, takagamuchira anopfuura zana muzana emapassword akaiswa - ndiko kuti, akawanda akabuda pane atakatumira.
Zvakaitika seizvi: tsamba yekubira yakatumirwa, inonzi kubva kuCISO yesangano rehurumende, nechikumbiro che "kukurumidza kuedza shanduko mubasa retsamba." Tsamba yacho yakasvika kumukuru wedhipatimendi guru raibata norutsigiro rwokugadzira zvinhu. Maneja wacho aishingaira zvikuru mukuita mirayiridzo yaibva kuvakuru vakuru uye akaitumira kune vose vaiva pasi. Iyo call centre pachezvayo yakazoita yakakura chaizvo. Kazhinji, mamiriro ezvinhu apo mumwe munhu anotumira "anonakidza" maemail ephishing kune vavanoshanda navo uye ivowo vanobatwa chinhu chinowanzoitika. Kwatiri, iyi ndiyo mhinduro yakanakisisa pamusoro pehutano hwekunyora tsamba.
Gare gare vakazoziva nezvedu (tsamba yacho yakatorwa mubhokisi retsamba rakakanganiswa):
Kubudirira kwekurwiswa kwacho kwakakonzerwa nekuti kutumira tsamba kwakashandisa zvikanganiso zvehunyanzvi muhurongwa hwetsamba dzemutengi. Yakagadzirwa nenzira yekuti zvaigoneka kutumira chero tsamba pachinzvimbo chechero mutumi wesangano pachayo pasina mvumo, kunyangwe kubva paInternet. Ndiko kuti, unogona kunyepedzera kuve CISO, kana musoro wetsigiro yehunyanzvi, kana mumwe munhu. Uyezve, iyo mail interface, ichicherechedza mavara kubva kune "yayo" domain, yakanyatsoisa mufananidzo kubva mubhuku rekero, iyo yakawedzera hunhu kune anotumira.
Muchokwadi, kurwiswa kwakadaro hakusi tekinoroji yakaoma kunzwisisa; iko kushandisa kwakabudirira kwechikanganiso chakakosha mumaseti etsamba. Inogara ichiongororwa pane yakasarudzika IT uye ruzivo rwekuchengetedza zviwanikwa, asi zvakadaro, kuchine makambani ane zvese izvi zviripo. Sezvo pasina munhu anoda kunyatsoongorora misoro yebasa yeSMTP mail protocol, tsamba inowanzotariswa kuti haina βngoziβ pachishandiswa zvidhori zveyambiro mutsamba yekutumira, izvo zvisingawanzo kuratidza mufananidzo wose.
Sezvineiwo, kusagadzikana kwakafanana kunoshandawo kune rimwe divi: anorwisa anogona kutumira email pachinzvimbo chekambani yako kune wechitatu-bato anogamuchira. Semuenzaniso, anogona kuita zvemanyepo invoice yekubhadharira nguva dzose panzvimbo yako, achiratidza zvimwe zvinhu panzvimbo pako. Kunze kwekupokana nekubiridzira uye nyaya dzekubuda-mari, iyi ingangove imwe yenzira dziri nyore dzekuba mari kuburikidza nesocial engineering.
Pamusoro pekuba mapassword kuburikidza ne phishing, yemhando yepamusoro sociotechnical kurwisa iri kutumira zvinotemerwa. Kana mari iyi ikakunda matanho ese ekuchengetedza, ayo makambani emazuva ano anowanzo kuve nezvakawanda, nzira yekupinda iri kure ichagadzirwa pakombuta yemunhu akabatwa. Kuratidza mhedzisiro yekurwiswa, iyo inokonzeresa yekudzora kure inogona kuvandudzwa kusvika kune yakakosha ruzivo rwakavanzika. Zvinokosha kuziva kuti kuwanda kwekurwisa kunoshandiswa nevezvenhau kutyisidzira munhu wese kunotanga seizvi.
Mudhipatimendi redu rekuongorora, kunakidzwa, tinoverengera huwandu hwehuwandu: chii chakakwana kukosha kwezvinhu zvemakambani kwatakawana Domain Administrator kuwana, kunyanya kuburikidza phishing uye kutumira zvinogoneka? Gore rino yakasvika mabhiriyoni zana nemakumi mashanu emaeuro.
Zviri pachena kuti kutumira maemail anotsamwisa uye kutumira mapikicha ekitsi pamawebhusaiti handiyo chete nzira dzesocial engineering. Mumienzaniso iyi takaedza kuratidza akasiyana siyana ekurwisa mafomu uye nemhedzisiro yawo. Pamusoro pemabhii, munhu anogona kurwisa anogona kufona kuti awane ruzivo rwakakodzera, kuparadzira midhiya (semuenzaniso, madhiraivha) ane mafaera anogona kuitiswa muhofisi yekambani inotarirwa, kuwana basa semudzidzi, kuwana mukana wekuita kune network yemuno. pasi pechiratidziro cheCCTV camera installer. Zvese izvi, nenzira, mienzaniso kubva kumapurojekiti edu akapedzwa zvakabudirira.
Chikamu 3. Kudzidzisa chiedza, asi asina kudzidza irima
Mubvunzo unomuka unomuka: zvakanaka, zvakanaka, kune social engineering, inoita kunge ine ngozi, asi makambani anofanira kuitei nezvese izvi? Captain Obvious anouya kuzonunura: unofanirwa kuzvidzivirira, uye nenzira yakazara. Chimwe chikamu chedziviriro chichave chakanangana neatove ekare ekuchengetedza matanho, senge tekinoroji nzira dzekudzivirira ruzivo, kutarisa, sangano uye pamutemo rutsigiro rwemaitiro, asi chikamu chikuru, mukuona kwedu, chinofanira kutungamirwa kutungamira basa nevashandi se weakest link. Mushure mezvose, zvisinei kuti iwe unosimbisa sei teknolojia kana kunyora mitemo yakaoma, pachava nekugara kune mushandisi achawana nzira itsva yekuputsa zvose. Uyezve, hapana mirairo kana tekinoroji ichaenderana nekubhururuka kwehunyanzvi hwemushandisi, kunyanya kana akakurudzirwa neanorwisa anokwanisa.
Chokutanga pane zvose, zvakakosha kudzidzisa mushandisi: tsanangura kuti kunyange mubasa rake remazuva ose, mamiriro ezvinhu ane chokuita nehutano hwemagariro evanhu angamuka. Kune vatengi vedu isu tinowanzo itisa pamusoro pehutsanana hwedhijitari - chiitiko chinodzidzisa hunyanzvi hwekupikisa kurwisa kazhinji.
Ini ndinogona kuwedzera kuti imwe yeakanakisa kudzivirira matanho angave asiri ekuziva nemusoro mitemo yekuchengetedza ruzivo zvachose, asi kuongorora mamiriro ezvinhu nenzira yakadzikira zvishoma:
- Ndiani interlocutor wangu?
- Ko chirevo chake kana chikumbiro chakabva kupi (izvi hazvina kumboitika, uye zvino zvaonekwa)?
- Chii chisina kujairika pachikumbiro ichi?
Kunyange rudzi rusina kujairika rwemavara ebhii kana kuti matauriro asina kujairika kune anotumira anogona kuita kuti pave nokusava nechokwadi kunomisa kurwisa. Mirayiridzo yakanyorwa inodiwawo, asi inoshanda zvakasiyana uye haigoni kutsanangura zvose zvinogoneka. Semuenzaniso, vatariri vekuchengetedza ruzivo vanonyora mavari kuti haugone kuisa password yako pane yechitatu-bato zviwanikwa. Ko kana "yako", "yekambani" network sosi yakakumbira password? Mushandisi anofunga: "Kambani yedu yatova nemasevhisi gumi nemaviri ane account imwe chete, wadii kuva neimwe?" Izvi zvinotungamirira kune mumwe mutemo: basa rakanyatsorongeka rinobatawo zvakananga kuchengeteka: kana dhipatimendi rakavakidzana rinogona kukumbira ruzivo kubva kwauri nekunyora chete uye kuburikidza nemaneja wako chete, munhu "kubva kune waunovimba naye wekambani" zvirokwazvo haazoiti. kukwanisa kuzvikumbira nefoni - izvi ndezvenyu zvichave zvisina maturo. Iwe unofanirwa kungwarira zvakanyanya kana wako anopindira achida kuita zvese izvozvi, kana "ASAP", sezvo zviri fashoni kunyora. Kunyange mubasa remazuva ose, mamiriro ezvinhu aya kazhinji haana hutano, uye pakatarisana nekurwiswa kunobvira, iyo inokonzera simba. Hapana nguva yekutsanangura, mhanyisa faira rangu!
Isu tinocherekedza kuti vashandisi vanogara vakanangwa sengano dzekurwiswa kwesociotechnical nemisoro ine chekuita nemari mune imwe nzira kana imwe: zvipikirwa zvekusimudzira, zvido, zvipo, pamwe neruzivo runofungidzirwa kuti runyerekupe uye kunetsana. Mune mamwe mazwi, banal "zvivi zvinouraya" zviri kushanda: nyota yepurofiti, makaro uye kuda kuziva zvakanyanya.
Kudzidziswa kwakanaka nguva dzose kunofanira kusanganisira kudzidzira. Apa ndipo panogona kuuya nyanzvi dzekuongorora kupinda. Mubvunzo unotevera ndewokuti: chii uye tichaedza sei? Isu paBoka-IB tinokurudzira nzira inotevera: nekukurumidza sarudza tarisiro yekuyedza: kungave kuongorora kugadzirira kwekurwiswa kwevashandisi chete, kana kutarisa kuchengetedzwa kwekambani yese. Uye edza uchishandisa nzira dzeinjiniya dzemagariro, kutevedzera kurwiswa chaiko - ndiko kuti, kubira kwakafanana, kutumira zvinyorwa zvinogoneka, mafoni uye mamwe matekiniki.
Muchiitiko chekutanga, kurwiswa kwakanyatsogadzirirwa pamwe chete nevamiriri vevatengi, kunyanya neIT yayo uye ruzivo rwekuchengetedza ruzivo. Ngano, zvishandiso uye maitiro ekurwisa anowirirana. Mutengi pachake anopa mapoka ekutarisa uye mazita evashandisi ekurwiswa, ayo anosanganisira ese anodiwa anobatika. Kunze kunogadzirwa pamatanho ekuchengetedza, sezvo mameseji uye mitoro inotakurika inofanirwa kusvika kune anogamuchira, nekuti muchirongwa chakadaro chete maitiro evanhu ndiwo anofarira. Sarudzo, iwe unogona kusanganisira mamakisi mukurwiswa, izvo mushandisi anogona kufungidzira kuti uku kurwiswa - semuenzaniso, iwe unogona kuita akati wandei zvikanganiso zvezviperengo mumameseji kana kusiya zvisirizvo mukukopa maitiro emakambani. Pakupera kweprojekiti, iyo yakafanana "nhamba dzakaoma" dzinowanikwa: izvo zvinotarisisa mapoka zvakapindura kumamiriro ezvinhu uye kusvika papi.
Muchiitiko chechipiri, kurwiswa kunoitwa ne zero ruzivo rwekutanga, uchishandisa nzira ye "black box". Isu takazvimiririra tinounganidza ruzivo nezve kambani, vashandi vayo, network perimeter, gadzira ngano dzekurwisa, sarudza nzira, tsvaga nhanho dzekuchengetedza dzinoshandiswa mukambani yakanangana, gadzirisa maturusi, uye gadzira mamiriro. Nyanzvi dzedu dzinoshandisa nzira mbiri dzakavhurika sosi yehungwaru (OSINT) uye Boka-IB's chigadzirwa - Threat Intelligence, sisitimu iyo, kana ichigadzirira phishing, inogona kuita semuunganidzi weruzivo nezvekambani kwenguva yakareba, kusanganisira yakasarudzika ruzivo . Zvechokwadi, kuitira kuti kurwiswa kurege kuva kushamisika kusingafadzi, zvinyorwa zvayo zvinobvumiranawo nemutengi. Inoita kunge iri yakazara-yakazara bvunzo yekupinda, asi ichave yakavakirwa pasocial engineering. Iyo inonzwisisika sarudzo mune iyi kesi ndeyekukudziridza kurwisa mukati metiweki, kusvika pakuwana kodzero dzepamusoro muhurongwa hwemukati. Nenzira, nenzira yakafanana isu tinoshandisa sociotechnical kurwisa mukati , uye mune dzimwe bvunzo dzekupinda. Nekuda kweizvozvo, mutengi anogashira yakazvimiririra yakazara chiono chekuchengetedza kwavo kurwisa imwe mhando yesociotechnical kurwiswa, pamwe nekuratidzira kwekubudirira (kana, zvinopesana, kusashanda) kweiyo yakavakirwa mutsara wekudzivirira kubva kunze kwekutyisidzira.
Tinokurudzira kuita dzidziso iyi kaviri pagore. Chekutanga, mune chero kambani kune kutendeuka kwevashandi uye chiitiko chekare chinokanganwika zvishoma nezvishoma nevashandi. Chechipiri, nzira uye matekiniki ekurwiswa ari kugara achichinja uye izvi zvinotungamira kune kudikanwa kwekugadzirisa kuchengetedzwa kwemaitiro uye maturusi ekudzivirira.
Kana tikataura nezve tekinoroji matanho ekudzivirira kubva mukurwiswa, zvinotevera zvinobatsira zvakanyanya:
- Kuvepo kwezvinosungirwa zviviri-chinhu chechokwadi pamasevhisi anoburitswa paInternet. Kuburitsa masevhisi akadai muna 2019 pasina Single Sign On system, pasina dziviriro kubva papassword brute simba uye pasina mbiri-zvinhu tsigiro mukambani yemazana akati wandei vanhu zvakafanana nekufona kwakavhurika kuti "ndipwanye." Kudzivirirwa kwakanyatsoitwa kuchaita kuti kushandiswa nekukurumidza kwemapassword akabiwa kusagoneke uye kunopa nguva yekubvisa mhedzisiro yekurwiswa kwe phishing.
- Kudzora kutonga kwekupinda, kuderedza kodzero dzevashandisi mumasisitimu, uye kutevedzera nhungamiro yegadziriro yakachengeteka yechigadzirwa inoburitswa nemugadziri mukuru wega wega. Izvi zvinowanzogara zviri nyore muzvisikwa, asi zvinoshanda zvakanyanya uye zvakaoma kuita zviyero, izvo munhu wese, kune imwe dhigirii kana imwe, anoregeredza nekuda kwekumhanya. Uye mamwe akakosha zvekuti pasina iwo hapana nzira yekudzivirira inoponesa.
- Yakanyatsovakwa email kusefa mutsara. Antispam, yakazara scanning yezvakanamatira kodhi ine hutsinye, kusanganisira kuyedza kwesimba kuburikidza nemabhokisi ejecha. Kurwiswa kwakanyatsogadzirirwa kunoreva kuti iyo inosungirirwa inosungirirwa haizoonekwe nemidziyo yeantivirus. Bhokisi rejecha, pane zvinopesana, richaedza zvinhu zvose pacharo, uchishandisa mafaira nenzira imwechete iyo munhu anoshandisa. Nekuda kweizvozvo, chinogoneka chine hutsinye chinozoratidzwa neshanduko dzakaitwa mukati mebhokisi rejecha.
- Nzira dzekudzivirira pakurwiswa kwakanangwa. Sezvatocherechedzwa, classic antivirus maturusi haaone mafaera ane hutsinye muchiitiko chekurwiswa kwakanyatsogadzirirwa. Zvigadzirwa zvepamberi zvinofanirwa kutarisisa otomatiki kuwanda kwezviitiko zviri kuitika panetiweki - zvese padanho remunhu anotambira uye pamwero wetraffic mukati metiweki. Panyaya yekurwiswa, macheni akasarudzika ezviitiko anooneka anogona kuteverwa nekumiswa kana iwe uchitarisa wakatarisana nezviitiko zverudzi urwu.
Chinyorwa chekutanga mumagazini "Ruzivo Chengetedzo / Ruzivo Ruzivo" #6, 2019.
Source: www.habr.com