{"id":86086,"date":"2020-06-21T13:42:19","date_gmt":"2020-06-21T11:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/ransomware-novyj-sposob-organizaczii-utechek-dannyh"},"modified":"2020-06-21T13:42:19","modified_gmt":"2020-06-21T11:42:19","slug":"ransomware-novyj-sposob-organizaczii-utechek-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/ransomware-novyj-sposob-organizaczii-utechek-dannyh","title":{"rendered":"Ransomware \u2014 nj\u00eb m\u00ebnyr\u00eb e re p\u00ebr organizimin e rrjedhjeve t\u00eb t\u00eb dh\u00ebnave","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

D\u00ebrgesat e t\u00eb dh\u00ebnave jan\u00eb nj\u00eb \u00e7\u00ebshtje shqet\u00ebsuese p\u00ebr sh\u00ebrbimin e siguris\u00eb. Tani, kur shumica punon nga sht\u00ebpia, rreziku i rrjedhjeve \u00ebsht\u00eb shum\u00eb m\u00eb i lart\u00eb. P\u00ebr k\u00ebt\u00eb arsye, grupet e njohura t\u00eb krimit kibernetik po i kushtojn\u00eb v\u00ebmendje t\u00eb madhe protokolleve t\u00eb vjetra dhe mjaft t\u00eb mbrojtura t\u00eb aksesit t\u00eb larg\u00ebt. Dhe, \u00e7udit\u00ebrisht, gjithnj\u00eb e m\u00eb shum\u00eb rrjedhje t\u00eb t\u00eb dh\u00ebnave sot lidhen me Ransomware. Si, pse dhe si ndodh \u2014 lexoni m\u00eb posht\u00eb.<\/p>\n

\"Ransomware
\n<\/a><\/noindex>
\nLe t\u00eb fillojm\u00eb me faktin se zhvillimi dhe shp\u00ebrndarja e programeve t\u00eb k\u00ebrkes\u00ebs p\u00ebr para \u2014 p\u00ebr vet\u00eb, \u00ebsht\u00eb nj\u00eb biznes i lavdish\u00ebm kriminal. P\u00ebr shembull, sipas vler\u00ebsimeve t\u00eb FBI-s\u00eb amerikane, grupi Sodinokibi<\/a><\/noindex> p\u00ebr vitin e kaluar fitoi rreth $1 milion n\u00eb muaj. Nd\u00ebrsa kriminel\u00ebt q\u00eb p\u00ebrdorin Ryuk fitonin akoma m\u00eb shum\u00eb \u2014 n\u00eb fillim t\u00eb aktivitetit t\u00eb grupit, t\u00eb ardhurat e tyre arrinin deri n\u00eb $3 milion n\u00eb muaj. Pra, nuk \u00ebsht\u00eb \u00e7udi q\u00eb shum\u00eb drejtor\u00eb t\u00eb siguris\u00eb s\u00eb informacionit (CISO) e shohin Ransomware si nj\u00eb nga pes\u00eb rreziqet kryesore p\u00ebr biznesin.<\/p>\n

Qendra e Siguris\u00eb Acronis Cyber Protection Operation Center (CPOC), e vendosur n\u00eb Singapor, konfirmon rritjen e krimit kibernetik n\u00eb fush\u00ebn e Ransomware. N\u00eb gjysm\u00ebn e dyt\u00eb t\u00eb majit, n\u00eb t\u00eb gjith\u00eb bot\u00ebn u bllokuan 20% m\u00eb shum\u00eb programe t\u00eb k\u00ebrkes\u00ebs p\u00ebr para se zakonisht. Pas nj\u00eb r\u00ebnie t\u00eb vog\u00ebl tani, n\u00eb qershor, ne p\u00ebrs\u00ebri po v\u00ebzhgojm\u00eb nj\u00eb rritje t\u00eb aktivitetit. Dhe ka disa arsye p\u00ebr k\u00ebt\u00eb. <\/p>\n

T\u00eb hysh n\u00eb kompjuterin e viktim\u00ebs
\n<\/h3>\n

\nTeknologjit\u00eb e mbrojtjes po zhvillohen, dhe kriminel\u00ebt duhet t\u00eb ndryshojn\u00eb pak strategjin\u00eb e tyre p\u00ebr t\u00eb hyr\u00eb n\u00eb nj\u00eb sistem specifik. Sulmet e synuara t\u00eb Ransomware vazhdojn\u00eb t\u00eb shp\u00ebrndahen p\u00ebrmes letrave t\u00eb mir\u00ebplanifikuara t\u00eb phishing (k\u00ebtu ka t\u00eb b\u00ebj\u00eb me inxhinierin\u00eb sociale). Megjithat\u00eb, n\u00eb koh\u00ebt e fundit, zhvilluesit e softuer\u00ebve t\u00eb d\u00ebmsh\u00ebm po i kushtojn\u00eb v\u00ebmendje t\u00eb madhe punonj\u00ebsve t\u00eb larg\u00ebt. P\u00ebr t'i sulmuar ata, mund t\u00eb gjejn\u00eb sh\u00ebrbime t\u00eb mbrojtura dob\u00ebt t\u00eb aksesit t\u00eb larg\u00ebt, si RDP ose VPN-server\u00eb me dob\u00ebsi.
\nK\u00ebshtu ata po veprojn\u00eb. N\u00eb darknet jan\u00eb shfaqur madje sh\u00ebrbime ransomware-as-a-service q\u00eb ofrojn\u00eb gjith\u00e7ka t\u00eb nevojshme p\u00ebr t\u00eb sulmuar nj\u00eb organizat\u00eb ose nj\u00eb person t\u00eb zgjedhur. <\/p>\n

Kriminel\u00ebt po k\u00ebrkojn\u00eb \u00e7do mund\u00ebsi p\u00ebr t\u00eb hyr\u00eb n\u00eb rrjetin e korporat\u00ebs dhe p\u00ebr t\u00eb zgjeruar spektrin e sulmit. K\u00ebshtu, nj\u00eb drejtim popullor ka qen\u00eb p\u00ebrpjekjet p\u00ebr t\u00eb infektuar rrjetet e ofruesve t\u00eb sh\u00ebrbimeve. Duke marr\u00eb parasysh se sh\u00ebrbimet n\u00eb cloud jan\u00eb vet\u00ebm duke fituar popullaritet, infektimi i nj\u00eb sh\u00ebrbimi t\u00eb njohur lejon sulmin e dhjet\u00ebra apo madje qindra viktimave n\u00eb nj\u00eb her\u00eb. <\/p>\n

N\u00eb rast t\u00eb sulmit n\u00eb konsolat e internetit p\u00ebr menaxhimin e sistemeve t\u00eb siguris\u00eb ose t\u00eb kopjimeve rezerv\u00eb, sulmuesit mund t\u00eb \u00e7aktivizojn\u00eb mbrojtjen, t\u00eb fshijn\u00eb kopjet rezerv\u00eb dhe gjithashtu t\u00eb sigurojn\u00eb q\u00eb softueri i tyre i d\u00ebmsh\u00ebm t\u00eb shfaqet n\u00eb t\u00eb gjith\u00eb organizat\u00ebn. Padyshim, ekspert\u00ebt rekomandojn\u00eb q\u00eb t\u00eb mbrohen me kujdes t\u00eb gjitha llogarit\u00eb e sh\u00ebrbimeve p\u00ebrmes verifikimit me dy faktor\u00eb. P\u00ebr shembull, t\u00eb gjitha sh\u00ebrbimet n\u00eb cloud t\u00eb Acronis lejojn\u00eb vendosjen e mbrojtjes dyfishe, sepse n\u00eb rast t\u00eb kompromentimit t\u00eb fjal\u00ebkalimit, kriminel\u00ebt mund t\u00eb zhdukin t\u00eb gjitha avantazhet e p\u00ebrdorimit t\u00eb nj\u00eb sistemi t\u00eb plot\u00eb t\u00eb mbrojtjes kibernetike. <\/p>\n

Zgjerimi i spektrit t\u00eb sulmit
\n<\/h3>\n

\nKur synimi i d\u00ebshiruar arrihet, dhe softueri i d\u00ebmsh\u00ebm ndodhet tashm\u00eb brenda rrjetit korporativ, zakonisht p\u00ebrdoren taktika mjaft standarde p\u00ebr p\u00ebrhapjen m\u00eb t\u00eb tejshme. Kriminel\u00ebt studiojn\u00eb situat\u00ebn dhe p\u00ebrpiqen t\u00eb kalojn\u00eb pengesat q\u00eb jan\u00eb krijuar brenda kompanis\u00eb p\u00ebr t'u p\u00ebrgjigjur ndaj k\u00ebrc\u00ebnimeve. Kjo pjes\u00eb e sulmit mund t\u00eb ndodhi n\u00eb m\u00ebnyr\u00eb manuale (se k\u00ebt\u00eb, n\u00ebse ata tashm\u00eb jan\u00eb futur n\u00eb rrjet, do t\u00eb thot\u00eb se \u201cmishi \u00ebsht\u00eb te pika!\u201d). P\u00ebr k\u00ebt\u00eb p\u00ebrdoren mjete t\u00eb njohura si PowerShell, WMI PsExec, si dhe emulatori m\u00eb i ri Cobalt Strike dhe utilitete t\u00eb tjera. Disa grupe kriminale sulmojn\u00eb q\u00ebllimisht menaxher\u00ebt e fjal\u00ebkalimeve p\u00ebr t\u00eb hyr\u00eb thell\u00eb n\u00eb rrjetin korporativ. Nj\u00eb softuer i till\u00eb i d\u00ebmsh\u00ebm si Ragnar s\u00eb fundmi \u00ebsht\u00eb v\u00ebrejtur n\u00eb nj\u00eb imazh virtual t\u00eb mbyllur plot\u00ebsisht t\u00eb VirtualBox, q\u00eb ndihmon n\u00eb fshehjen e pranis\u00eb s\u00eb softuer\u00ebve t\u00eb huaj n\u00eb makin\u00eb. <\/p>\n

K\u00ebshtu, kur hyjn\u00eb n\u00eb rrjetin korporativ, softuer\u00ebt e d\u00ebmsh\u00ebm p\u00ebrpiqen t\u00eb kontrollojn\u00eb nivelin e aksesit t\u00eb p\u00ebrdoruesit dhe t\u00eb aplikojn\u00eb fjal\u00ebkalimet e vjedhura. Mjete t\u00eb tilla si Mimikatz dhe Bloodhound & Co. ndihmojn\u00eb n\u00eb thyerjen e llogarive t\u00eb administrator\u00ebve t\u00eb domainit. Dhe vet\u00ebm at\u00ebher\u00eb, kur sulmuesi mendon se mund\u00ebsit\u00eb e p\u00ebrhapjes jan\u00eb shteruar, programa i k\u00ebrkes\u00ebs p\u00ebr para ngarkohet direkt n\u00eb sistemet e klient\u00ebve. <\/p>\n

Ransomware si mbules\u00eb
\n<\/h3>\n

\nDuke arm\u00ebshm\u00ebria e k\u00ebrc\u00ebnimit t\u00eb humbjes s\u00eb t\u00eb dh\u00ebnave, \u00e7do vit m\u00eb shum\u00eb kompani po implementojn\u00eb at\u00eb q\u00eb quhet \"plani p\u00ebr rim\u00ebk\u00ebmbjen nga katastrofat\". Fal\u00eb k\u00ebsaj, ata nuk shqet\u00ebsohen shum\u00eb p\u00ebr t\u00eb dh\u00ebnat e enkriptuara, dhe n\u00eb rast sulmi nga ransomware, ata nuk fillojn\u00eb t\u00eb mbledhin hara\u00e7, por nisin procesin e rikthimit. Por edhe kriminel\u00ebt nuk flejn\u00eb. N\u00ebn mask\u00ebn e ransomware, ndodhin vjedhje t\u00eb masive t\u00eb t\u00eb dh\u00ebnave. Taktik\u00ebn masive e p\u00ebrdor\u00ebn s\u00eb pari Maze n\u00eb vitin 2019, ndon\u00ebse grupe t\u00eb tjera i kan\u00eb kombinuar sulmet nga koha n\u00eb koh\u00eb. Tani, t\u00eb pakt\u00ebn Sodinokibi, Netfilm, Nemty, Netwalker, Ragnar, Psya, DoppelPaymer, CLOP, AKO dhe Sekhmet jan\u00eb t\u00eb angazhuar n\u00eb vjedhjen e t\u00eb dh\u00ebnave p\u00ebrve\u00e7 enkriptimit.<\/p>\n

Ndonj\u00ebher\u00eb kriminel\u00ebve u arrin\u00eb t\u00eb shkarkojn\u00eb nga kompania dhjet\u00ebra terabajt t\u00eb dh\u00ebnash, t\u00eb cilat mund t\u00eb ishin zbuluar nga mjete t\u00eb monitorimit t\u00eb rrjetit (n\u00ebse do t\u00eb ishin instaluar dhe konfigurimi i tyre do t\u00eb ishte b\u00ebr\u00eb). Sepse, shpeshher\u00eb transferimi i t\u00eb dh\u00ebnave ndodh thjesht me an\u00eb t\u00eb FTP, Putty, WinSCP ose skripteve PowerShell. P\u00ebr t\u00eb kaluar DLP dhe sistemet e monitorimit t\u00eb rrjetit, t\u00eb dh\u00ebnat mund t\u00eb enkriptohen ose t\u00eb d\u00ebrgohen si nj\u00eb arkiv me fjal\u00ebkalim, dhe kjo \u00ebsht\u00eb nj\u00eb sfid\u00eb e re p\u00ebr sh\u00ebrbimet e siguris\u00eb, t\u00eb cilat duhet t\u00eb kontrollojn\u00eb trafikun e daljes p\u00ebr pranin\u00eb e skedar\u00ebve t\u00eb till\u00eb.<\/p>\n

Studimi i sjelljes s\u00eb infostealer\u00ebve tregon se kriminel\u00ebt nuk mbledhin gjith\u00e7ka - ata jan\u00eb t\u00eb interesuar kryesisht p\u00ebr raportet financiare, bazat e klient\u00ebve, t\u00eb dh\u00ebnat personale t\u00eb punonj\u00ebsve dhe klient\u00ebve, kontratat, regjistrimet, dokumentet ligjore. Malware skanon diskun p\u00ebr \u00e7do informacion q\u00eb teorikisht mund t\u00eb p\u00ebrdoret p\u00ebr shantazh.
\nN\u00ebse nj\u00eb sulm i till\u00eb ka pasur sukses, zakonisht kriminel\u00ebt publikojn\u00eb nj\u00eb teaser t\u00eb vog\u00ebl, duke treguar disa dokumente si konfirmim se t\u00eb dh\u00ebnat jan\u00eb rrjedhur nga organizata. Disa grupe madje publikojn\u00eb t\u00eb gjith\u00eb setin e t\u00eb dh\u00ebnave n\u00eb faqen e tyre, n\u00ebse koha p\u00ebr pages\u00ebn e hara\u00e7it ka skaduar. P\u00ebr t\u00eb shmangur bllokimin dhe p\u00ebr t\u00eb siguruar nj\u00eb mbulim t\u00eb gjer\u00eb, t\u00eb dh\u00ebnat publikohen gjithashtu n\u00eb rrjetin TOR.<\/p>\n

Nj\u00eb m\u00ebnyr\u00eb tjet\u00ebr p\u00ebr monetizim \u00ebsht\u00eb shitja e t\u00eb dh\u00ebnave. P\u00ebr shembull, Sodinokibi s\u00eb fundmi shpalli organizimin e aukcioneve t\u00eb hapura, ku t\u00eb dh\u00ebnat i ndahen pjes\u00ebmarr\u00ebsit q\u00eb b\u00ebn ofert\u00ebn m\u00eb t\u00eb lart\u00eb. \u00c7mimi fillestar p\u00ebr k\u00ebto tregje \u00ebsht\u00eb $50-100K, n\u00eb var\u00ebsi t\u00eb cil\u00ebsis\u00eb dhe p\u00ebrmbajtjes s\u00eb t\u00eb dh\u00ebnave. P\u00ebr shembull, nj\u00eb grup prej 10,000 regjistrimesh mbi rrjedhat financiare, t\u00eb dh\u00ebna konfidenciale t\u00eb biznesit dhe patentash t\u00eb skanuara u shit\u00ebn p\u00ebr \u00e7mimin fillestar prej $100,000. Nd\u00ebrsa p\u00ebr $50,000 mund t\u00eb blinim m\u00eb shum\u00eb se 20,000 dokumente financiare plus tri baza t\u00eb dh\u00ebnash me skedar\u00eb llogarish dhe t\u00eb dh\u00ebna klientore. <\/p>\n

Faqet ku publikohen t\u00eb dh\u00ebnat e rrjedhura mund t\u00eb jen\u00eb shum\u00eb t\u00eb ndryshme. Kjo mund t\u00eb jet\u00eb nj\u00eb faqe e thjesht\u00eb, ku jan\u00eb publikuar thjesht t\u00eb gjitha ato q\u00eb jan\u00eb vjedhur, por ka edhe struktura m\u00eb t\u00eb komplikuara me seksione dhe mund\u00ebsi blerjeje. Por e r\u00ebnd\u00ebsishme \u00ebsht\u00eb q\u00eb t\u00eb gjitha ato sh\u00ebrbejn\u00eb nj\u00eb q\u00ebllimi - p\u00ebr t\u00eb rritur shanset e sulmuesve p\u00ebr t\u00eb fituar para reale. N\u00ebse kjo model biznesi do t\u00eb ket\u00eb rezultate t\u00eb mira p\u00ebr kriminel\u00ebt, nuk ka dyshim se do t\u00eb ket\u00eb edhe m\u00eb shum\u00eb faqe t\u00eb tilla, dhe teknikat e vjedhjes dhe monetizimit t\u00eb t\u00eb dh\u00ebnave korporative do t\u00eb zgjerohen akoma m\u00eb tej.<\/p>\n

K\u00ebshtu duken faqet aktuale ku publikohen rrjedhjet e t\u00eb dh\u00ebnave:<\/p>\n

\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n<\/p>\n

\u00c7far\u00eb t\u00eb b\u00ebni me sulmet e reja
\n<\/h3>\n

\nSfidimi kryesor p\u00ebr sh\u00ebrbimet e siguris\u00eb n\u00eb k\u00ebto kushte \u00ebsht\u00eb se s\u00eb fundmi po ndodhin gjithnj\u00eb e m\u00eb shum\u00eb incidente q\u00eb lidhen me ransomware, t\u00eb cilat n\u00eb fakt jan\u00eb thjesht nj\u00eb metod\u00eb shp\u00ebrq\u00ebndrimi nga vjedhja e t\u00eb dh\u00ebnave. Kriminel\u00ebt tashm\u00eb nuk kan\u00eb fokus vet\u00ebm n\u00eb enkriptimin e server\u00ebve. P\u00ebrkundrazi, q\u00ebllimi kryesor b\u00ebhet organizimi i rrjedhjes, nd\u00ebrsa ju jeni duke u marr\u00eb me enkriptor\u00ebt. <\/p>\n

Pra, p\u00ebrdorimi i vet\u00ebm t\u00eb nj\u00eb sistemi rezerv\u00eb, madje edhe me nj\u00eb plan t\u00eb mir\u00eb rikthimi, rezulton se \u00ebsht\u00eb i pamjaftuesh\u00ebm p\u00ebr t'u p\u00ebrballur me k\u00ebrc\u00ebnimet shum\u00eblayer. Jo, sigurisht q\u00eb nuk mund t\u00eb shmangen rezervat, pasi kriminel\u00ebt patjet\u00ebr do t\u00eb p\u00ebrpiqen t\u00eb enkriptojn\u00eb di\u00e7ka dhe do t\u00eb k\u00ebrkojn\u00eb hara\u00e7. \u00c7\u00ebshtja \u00ebsht\u00eb se tani \u00e7do sulm q\u00eb p\u00ebrdor ransomware duhet t\u00eb konsiderohet si nj\u00eb rast p\u00ebr nj\u00eb analiz\u00eb t\u00eb plot\u00eb t\u00eb trafikut dhe p\u00ebr t\u00eb nisur nj\u00eb hetim t\u00eb mundsh\u00ebm t\u00eb sulmit. Po ashtu, duhet t\u00eb mendohet p\u00ebr mjete shtes\u00eb sigurie q\u00eb mund t\u00eb: <\/p>\n