{"id":55586,"date":"2020-01-23T00:00:00","date_gmt":"2020-01-22T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/slozhno-uyazvimo-nedonastroeno-kiberugrozy-2020"},"modified":"2020-02-18T14:03:43","modified_gmt":"2020-02-18T11:03:43","slug":"slozhno-uyazvimo-nedonastroeno-kiberugrozy-2020","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/slozhno-uyazvimo-nedonastroeno-kiberugrozy-2020","title":{"rendered":"I komplikuar, i pambrojtur, i paqart\u00eb: k\u00ebrc\u00ebnimet kibernetike 2020","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"I
\n
\nTeknologjit po zhvillohen dhe po komplikohet vit pas viti, dhe s\u00eb bashku me to po p\u00ebrmir\u00ebsohen metodologjit\u00eb e sulmeve. Realiteti modern k\u00ebrkon aplikacione online, sh\u00ebrbime cloud dhe platforma p\u00ebr virtualizim, prandaj nuk \u00ebsht\u00eb m\u00eb e mundur t\u00eb fshihesh pas nj\u00eb firewalle korporate \u2014 dhe t\u00eb mos i hedh\u00ebsh syt\u00eb n\u00eb \"internetin e rreziksh\u00ebm\". T\u00eb gjitha k\u00ebto, s\u00eb bashku me p\u00ebrhapjen e IoT\/IIoT, zhvillimin e fintech dhe rritjen e popullaritetit t\u00eb pun\u00ebs n\u00eb distanc\u00eb, kan\u00eb ndryshuar p\u00ebrgjithmon\u00eb peizazhin e k\u00ebrc\u00ebnimeve. Le t\u00eb flasim p\u00ebr k\u00ebrc\u00ebnimet kibernetike q\u00eb na pret viti 2020.<\/i>
\n<\/a><\/noindex><\/p>\n

Eksplorimi i vulnerabiliteteve 0day do t\u00eb paraqitet m\u00eb par\u00eb se l\u00ebshimi i patch-\u00ebve. <\/h3>\n

\nNd\u00ebrlikimi i sistemeve software po rritet, prandaj ato p\u00ebrfundimisht p\u00ebrmbajn\u00eb gabime. Zhvilluesit publikojn\u00eb rregullime, por p\u00ebr k\u00ebt\u00eb problemi duhet fillimisht identifikuar, duke shpenzuar koh\u00eb nga ekipet ngjitur \u2014 po ashtu testuesve q\u00eb jan\u00eb t\u00eb detyruar t\u00eb kryejn\u00eb teste. Por koh\u00eb p\u00ebr shum\u00eb ekipe mungon katastrofikisht. Rezultati \u00ebsht\u00eb nj\u00eb l\u00ebshim padashur i patch-it, dhe ndonj\u00ebher\u00eb shfaqja e nj\u00eb patch-i q\u00eb funksionon vet\u00ebm pjes\u00ebrisht. <\/p>\n

Patch-i i l\u00ebshuar n\u00eb 2018 p\u00ebr vulnerabilitetin 0day n\u00eb motorin Microsoft Jet doli t\u00eb ishte i paplot\u00eb<\/a><\/noindex>, dmth nuk e zgjidhi problemin plot\u00ebsisht.
\nN\u00eb 2019, Cisco l\u00ebshoi patch-e p\u00ebr vulnerabilitetet CVE-2019-1652 dhe CVE-2019-1653 n\u00eb firmware t\u00eb router-\u00ebve, t\u00eb cilat nuk korrigjuan gabimet<\/a><\/noindex>.
\nN\u00eb shtator 2019, hulumtuesit shk encontraron vulnerabilitetin 0day n\u00eb Dropbox p\u00ebr Windows dhe e njoftuan k\u00ebt\u00eb zhvilluesit<\/a><\/noindex>, por ata nuk e rregulluan gabimin brenda 90 dit\u00ebve. <\/p>\n

Hackerat Blackhat dhe Whitehat jan\u00eb p\u00ebrqendruar n\u00eb k\u00ebrkimin e vulnerabiliteteve, prandaj probabiliteti q\u00eb ata t\u00eb zbulojn\u00eb problemin t\u00eb par\u00ebt \u00ebsht\u00eb shum\u00eb m\u00eb i lart\u00eb. Disa prej tyre k\u00ebrkojn\u00eb t\u00eb fitojn\u00eb shp\u00ebrblime n\u00ebp\u00ebrmjet programeve Bug Bounty, nd\u00ebrsa t\u00eb tjer\u00eb ndjekin q\u00ebllime t\u00eb qarta keqb\u00ebr\u00ebse. <\/p>\n

M\u00eb shum\u00eb sulme me p\u00ebrdorimin e deepfakes<\/h3>\n

\nRrjetet nervore dhe inteligjenca artificiale po zhvillohen, duke krijuar mund\u00ebsi t\u00eb reja p\u00ebr mashtrim. Pasi video-t false me p\u00ebrfshirjen e famsh\u00ebmve u shfaq\u00ebn, tashm\u00eb ka sulme konkrete me d\u00ebme serioze financiare. <\/p>\n

N\u00eb mars 2019, pkriminel\u00ebt i grabit\u00ebn kompanis\u00eb energjitike 243,000 dollar\u00eb amerikane me nj\u00eb telefonat\u00eb.<\/a><\/noindex>. \"Kryeshefi i kompanis\u00eb\" i dha udh\u00ebzim drejtuesit t\u00eb deg\u00ebs t\u00eb transferoj\u00eb para te kontraktori nga Hungaria. Z\u00ebri i CEO-s\u00eb u falsifikua me ndihm\u00ebn e inteligjenc\u00ebs artificiale. <\/i><\/p>\n

Duke marr\u00eb parasysh zhvillimin e shpejt\u00eb t\u00eb teknologjis\u00eb s\u00eb krijimit t\u00eb dipfek\u00ebve, mund t\u00eb pritet q\u00eb kriminel\u00ebt kibernetik\u00eb t\u00eb integrojn\u00eb krijimin e audio dhe video t\u00eb rreme n\u00eb sulmet BEC dhe skemat e mashtrimeve me mb\u00ebshtetje teknike p\u00ebr t\u00eb rritur besimin e p\u00ebrdoruesve. <\/p>\n

Objekti kryesor i dipfek\u00ebve do t\u00eb jen\u00eb menaxher\u00ebt e lart\u00eb, pasi regjistrimet e bisedave dhe fjalimeve t\u00eb tyre jan\u00eb n\u00eb dispozicion t\u00eb lir\u00eb. <\/p>\n

Sulmet ndaj bankave p\u00ebrmes fintech<\/h3>\n

\nMiratimi i direktiv\u00ebs evropiane p\u00ebr sh\u00ebrbimet e pagesave PSD2 b\u00ebri t\u00eb mundur zhvillimin e llojeve t\u00eb reja t\u00eb sulmeve ndaj bankave dhe klient\u00ebve t\u00eb tyre. K\u00ebtu p\u00ebrfshihen fushatat e phishingut ndaj p\u00ebrdoruesve t\u00eb aplikacioneve fintech, sulme DDoS ndaj startup-eve fintech, dhe vjedhja e t\u00eb dh\u00ebnave nga banka p\u00ebrmes API t\u00eb hapura. <\/p>\n

Sulme t\u00eb komplikuara p\u00ebrmes ofruesve t\u00eb sh\u00ebrbimeve<\/h3>\n

\nKompani po zvog\u00eblojn\u00eb gjithnj\u00eb e m\u00eb shum\u00eb specializimin e tyre duke i dh\u00ebn\u00eb jasht\u00eb aktivitetet q\u00eb nuk jan\u00eb n\u00eb profilin e tyre. Punonj\u00ebsit e tyre fitojn\u00eb besim te ofruesit q\u00eb menaxhojn\u00eb kontabilitetin, ofrojn\u00eb mb\u00ebshtetje teknike ose sigurin\u00eb. Si rezultat, p\u00ebr t\u00eb sulmuar nj\u00eb kompani \u00ebsht\u00eb e mjaftueshme t\u00eb kompromentosh nj\u00eb nga ofruesit e sh\u00ebrbimeve, q\u00eb t\u00eb integrohet kodi i d\u00ebmsh\u00ebm n\u00eb infrastruktur\u00ebn e cakut, p\u00ebr t\u00eb vjedhur para ose informacion. <\/p>\n

N\u00eb gusht 2019, haker\u00ebt dep\u00ebrtuan n\u00eb infrastruktur\u00ebn e dy kompanive IT q\u00eb ofronin sh\u00ebrbime ruajtjeje dhe kopjimi t\u00eb t\u00eb dh\u00ebnave, dhe p\u00ebrmes saj integruam nj\u00eb malware n\u00eb disa qindra kabinete dentare n\u00eb territorin e SHBA. <\/a><\/noindex>
\nKompania IT, q\u00eb sh\u00ebrben Administrat\u00ebn e Policis\u00eb s\u00eb New York-ut, p\u00ebr disa or\u00eb \u00e7oi jasht\u00eb p\u00ebrdorimi baz\u00ebn e t\u00eb dh\u00ebnave t\u00eb shenjave t\u00eb gishtave, duke lidhur n\u00eb rrjetin e policis\u00eb nj\u00eb mini-kompjuter t\u00eb infektuar Intel NUC.<\/a><\/noindex><\/i><\/p>\n

Meqen\u00ebse zinxhir\u00ebt e furnizimit po b\u00ebhen gjithmon\u00eb e m\u00eb t\u00eb gjat\u00eb, ka m\u00eb shum\u00eb pika t\u00eb dob\u00ebta, p\u00ebrdor\u00ebs t\u00eb cilave mund t\u00eb shfryt\u00ebzohen p\u00ebr t\u00eb sulmuar thesar m\u00eb t\u00eb madh.
\nNj\u00eb fakt tjet\u00ebr q\u00eb do t\u00eb leht\u00ebsoj\u00eb sulmet p\u00ebrmes zinxhirit t\u00eb furnizimit do t\u00eb jet\u00eb p\u00ebrhapja masive e vendeve t\u00eb pun\u00ebs t\u00eb larg\u00ebta. Freelanceri q\u00eb punojn\u00eb p\u00ebrmes Wi-Fi publik ose nga sht\u00ebpia jan\u00eb pre e leht\u00eb, duke u lidhur me disa kompani serioze, k\u00ebshtu q\u00eb pajisjet e tyre t\u00eb kompromentuara b\u00ebhen nj\u00eb baz\u00eb e p\u00ebrshtatshme p\u00ebr p\u00ebrgatitjen dhe realizimin e fazave t\u00eb ardhshme t\u00eb nj\u00eb sulmi kibernetik. <\/p>\n

P\u00ebrdorimi i gjer\u00eb i IoT\/IIoT p\u00ebr spiunazh dhe shantazh<\/h3>\n

\nRritja e shpejt\u00eb e numrit t\u00eb pajisjeve IoT, si televizor\u00ebt inteligjent\u00eb, kolonat \"e zgjuara\" dhe asistent\u00ebt e ndrysh\u00ebm vokal\u00eb, s\u00eb bashku me shumic\u00ebn e dob\u00ebsive q\u00eb identifikohen n\u00eb to, do t\u00eb krijoj\u00eb shum\u00eb mund\u00ebsi p\u00ebr p\u00ebrdorimin e tyre t\u00eb paautorizuar.
\nKompromentimi i pajisjeve inteligjente dhe njohja e z\u00ebrit t\u00eb njer\u00ebzve p\u00ebrmes AI-t\u00eb mund\u00ebson identifikimin e objektit t\u00eb v\u00ebzhgimit, duke e kthyer k\u00ebto pajisje n\u00eb nj\u00eb mjet p\u00ebr shantazh ose spiunazh korporativ. <\/p>\n

Nj\u00eb tjet\u00ebr drejtim n\u00eb t\u00eb cilin do t\u00eb vazhdojn\u00eb t\u00eb p\u00ebrdoren pajisjet IoT do t\u00eb jet\u00eb krijimi i bot-neteve p\u00ebr sh\u00ebrbime t\u00eb ndryshme kibernetike t\u00eb d\u00ebmshme: d\u00ebrgimin e spam-it, anonimizimin dhe realizimin sulmeve DDoS<\/a><\/noindex>.
\nNumri i sulmeve ndaj objekteve t\u00eb infrastruktur\u00ebs kritike t\u00eb pajisura me komponent\u00eb internetit industrial t\u00eb gj\u00ebrave<\/a><\/noindex>. Objektivi mund t\u00eb jet\u00eb, p\u00ebr shembull, shantazhi p\u00ebr nj\u00eb shp\u00ebrblim n\u00ebn k\u00ebrc\u00ebnimin e ndalimit t\u00eb funksionimit t\u00eb biznesit. <\/p>\n

Sa m\u00eb shum\u00eb mjete re, aq m\u00eb shum\u00eb rreziqe<\/h3>\n

\nMigrimi masiv i infrastruktur\u00ebs IT n\u00eb mjete re do t\u00eb sjell\u00eb objekte t\u00eb reja p\u00ebr sulme. Gabimet gjat\u00eb deploy-it dhe konfigurimit t\u00eb server\u00ebve cloud p\u00ebrdoren me sukses nga kriminel\u00ebt. Numri i shp\u00ebrthimeve q\u00eb lidhen me konfigurimet e pasigurta t\u00eb DB-ve n\u00eb cloud rritet \u00e7do vit. <\/p>\n

N\u00eb tetor 2019, u zbulua n\u00eb hap\u00ebsir\u00eb publik nj\u00eb server ElasticSearch q\u00eb p\u00ebrmbante 4 miliard\u00eb regjistrime me t\u00eb dh\u00ebnat personale.<\/a><\/noindex>
\nN\u00eb fund t\u00eb n\u00ebntorit 2019 n\u00eb cloud Microsoft Azure u gjet n\u00eb hap\u00ebsir\u00eb publik nj\u00eb baz\u00eb t\u00eb dh\u00ebnash t\u00eb kompanis\u00eb True Dialog, q\u00eb p\u00ebrmbante pothuajse 1 miliard regjistrimesh<\/a><\/noindex>, n\u00eb t\u00eb cilat ishin emrat e plot\u00eb t\u00eb abonent\u00ebve, adresat e emailit dhe numrat e telefonit, si dhe tekstet e mesazheve SMS. <\/i><\/p>\n

Shp\u00ebrthimet e t\u00eb dh\u00ebnave t\u00eb publikuara n\u00eb mjete re jo vet\u00ebm q\u00eb do t\u00eb d\u00ebmtojn\u00eb reputacionin e kompanive, por do t\u00eb \u00e7ojn\u00eb gjithashtu n\u00eb vendosjen e gjobave dhe sanksioneve.<\/p>\n

Kufizimet e pap\u00ebrshtatshme t\u00eb aksesit, menaxhimi i gabuar i lejeve dhe neglizhenca n\u00eb mbajtjen e regjistrave jan\u00eb vet\u00ebm disa nga gabimet q\u00eb kompanit\u00eb do t\u00eb b\u00ebjn\u00eb n\u00eb konfigurimin e rrjeteve t\u00eb tyre \"n\u00eb re\". Me migrimin n\u00eb re, ky proces do t\u00eb p\u00ebrfshij\u00eb gjithnj\u00eb e m\u00eb shum\u00eb ofrues sh\u00ebrbimesh t\u00eb jasht\u00ebm me kompetenca t\u00eb ndryshme n\u00eb fush\u00ebn e siguris\u00eb, duke ofruar mund\u00ebsi t\u00eb tjera p\u00ebr sulme. <\/p>\n

P\u00ebrkeq\u00ebsimi i problemeve t\u00eb virtualizimit<\/h3>\n

\nKontenjerizimi i sh\u00ebrbimeve leht\u00ebson zhvillimin, mb\u00ebshtetje dhe implementimin e softuerit, por nj\u00ebkoh\u00ebsisht krijon rreziqe t\u00eb tjera. Vulnerabilitetet n\u00eb imazhet e njohura t\u00eb konteiner\u00ebve do t\u00eb vazhdojn\u00eb t\u00eb jen\u00eb nj\u00eb problem p\u00ebr t\u00eb gjith\u00eb ata q\u00eb i p\u00ebrdorin. <\/p>\n

Kompani do t\u00eb ken\u00eb gjithashtu p\u00ebr t\u00eb p\u00ebrballuar vulnerabilitetet n\u00eb komponente t\u00eb ndryshme t\u00eb arkitektur\u00ebs s\u00eb konteiner\u00ebve nga gabimet n\u00eb ambientin e ekzekutimit deri te orkestrator\u00ebt dhe ambientet e nd\u00ebrtimit. Sulmuesit do t\u00eb k\u00ebrkojn\u00eb dhe p\u00ebrdorin \u00e7do dob\u00ebsi p\u00ebr t\u00eb komprometuar procesin DevOps. <\/p>\n

Nj\u00eb tjet\u00ebr tendenc\u00eb q\u00eb lidhet me virtualizimin \u00ebsht\u00eb kompjuterizimi pa server. Sipas parashikimeve t\u00eb Gartner, n\u00eb vitin 2020, m\u00eb shum\u00eb se 20% e kompanive do t\u00eb p\u00ebrdorin k\u00ebt\u00eb teknologji<\/a><\/noindex>. K\u00ebto platforma ofrojn\u00eb zhvilluesve mund\u00ebsin\u00eb p\u00ebr t\u00eb ekzekutuar kodin si nj\u00eb sh\u00ebrbim, duke eliminuar nevoj\u00ebn p\u00ebr t\u00eb paguar p\u00ebr server\u00eb ose kontener\u00eb t\u00eb t\u00ebr\u00eb. Megjithat\u00eb, kalimi n\u00eb kompjuterizimin pa server nuk ofron imunitet nga problemet e siguris\u00eb. <\/p>\n

Pikat e hyrjes p\u00ebr sulmet n\u00eb aplikacionet pa server do t\u00eb jen\u00eb bibliotekat e plasaritura dhe t\u00eb kompromentuara dhe mjedisi i keqkonfiguruar. Sulmuesit do t'i p\u00ebrdorin ato p\u00ebr t\u00eb mbledhur informacion t\u00eb ndjesh\u00ebm dhe p\u00ebr t\u00eb hyr\u00eb n\u00eb rrjetet e kompanive. <\/p>\n

Si t\u00eb p\u00ebrballojm\u00eb k\u00ebrc\u00ebnimet n\u00eb vitin 2020<\/h3>\n

\nDuke marr\u00eb parasysh rritjen e kompleksitetit t\u00eb ndikimeve t\u00eb kibernetik\u00ebs, kompanit\u00eb do t'i nevojitet t\u00eb zgjerohen n\u00eb bashk\u00ebpunimin me profesionist\u00ebt e siguris\u00eb p\u00ebr t\u00eb ulur rreziqet n\u00eb t\u00eb gjith\u00eb sektor\u00ebt e infrastruktur\u00ebs s\u00eb tyre. Kjo do t'u ofroj\u00eb mbrojt\u00ebsve dhe zhvilluesve informacione t\u00eb tjera dhe do t\u00eb kontrollojn\u00eb m\u00eb mir\u00eb pajisjet e lidhura n\u00eb rrjet dhe do t\u00eb eliminojn\u00eb dob\u00ebsit\u00eb e tyre. <\/p>\n

Peizazhi n\u00eb ndryshim t\u00eb vazhduesh\u00ebm t\u00eb k\u00ebrc\u00ebnimeve do t\u00eb k\u00ebrkoj\u00eb implementimin e mbrojtjes shum\u00ebkat\u00ebshe, t\u00eb bazuar n\u00eb mekanizmat e siguris\u00eb si: <\/p>\n