{"id":86086,"date":"2020-06-21T13:42:19","date_gmt":"2020-06-21T11:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/ransomware-novyj-sposob-organizaczii-utechek-dannyh"},"modified":"2020-06-21T13:42:19","modified_gmt":"2020-06-21T11:42:19","slug":"ransomware-novyj-sposob-organizaczii-utechek-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/ransomware-novyj-sposob-organizaczii-utechek-dannyh","title":{"rendered":"Ransomware \u2014 nj\u00eb m\u00ebnyr\u00eb e re p\u00ebr t\u00eb organizuar rrjedhjet e t\u00eb dh\u00ebnave","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Rrjedhjet e t\u00eb dh\u00ebnave jan\u00eb nj\u00eb \u00e7\u00ebshtje shum\u00eb e r\u00ebnd\u00ebsishme p\u00ebr sh\u00ebrbimin e siguris\u00eb. Dhe tani, kur shumica e njer\u00ebzve punojn\u00eb nga sht\u00ebpia, rreziku i rrjedhjeve \u00ebsht\u00eb shum\u00eb m\u00eb i lart\u00eb. Pik\u00ebrisht p\u00ebr k\u00ebt\u00eb arsye, grupet e njohura t\u00eb krimit kibernetik po u kushtojn\u00eb m\u00eb shum\u00eb v\u00ebmendje protokolleve t\u00eb vjetra dhe t\u00eb mbrojtura dob\u00ebt p\u00ebr aksesin e larg\u00ebt. Dhe, \u00e7udit\u00ebrisht, gjithnj\u00eb e m\u00eb shum\u00eb rrjedhje t\u00eb t\u00eb dh\u00ebnave sot jan\u00eb t\u00eb lidhura me Ransomware. Si, pse dhe n\u00eb \u00e7far\u00eb m\u00ebnyre \u2014 lexoni m\u00eb posht\u00eb.<\/p>\n

\"Ransomware
\n<\/a><\/noindex>
\nT\u00eb fillojm\u00eb me faktin se zhvillimi dhe shp\u00ebrndarja e programeve t\u00eb k\u00ebrc\u00ebnimit \u00ebsht\u00eb nj\u00eb biznes shum\u00eb fitimprur\u00ebs kriminel. P\u00ebr shembull, sipas vler\u00ebsimeve t\u00eb FBI-s\u00eb amerikane, grupi Sodinokibi<\/a><\/noindex> n\u00eb vitin e kaluar fitonte rreth 1 milion dollar\u00eb n\u00eb muaj. Nd\u00ebrsa ata q\u00eb p\u00ebrdornin Ryuk fitonin edhe m\u00eb shum\u00eb \u2014 n\u00eb fillim t\u00eb aktivitetit t\u00eb grupit, t\u00eb ardhurat e tyre arrinin deri n\u00eb 3 milion dollar\u00eb n\u00eb muaj. Prandaj nuk \u00ebsht\u00eb \u00e7udi q\u00eb shum\u00eb drejtor\u00eb t\u00eb siguris\u00eb s\u00eb informacionit (CISO) e identifikojn\u00eb Ransomware si nj\u00eb nga pes\u00eb rreziqet kryesore p\u00ebr biznesin.<\/p>\n

Qendra e Siguris\u00eb Acronis Cyber Protection Operation Center (CPOC), e vendosur n\u00eb Singapor, konfirmon aktivizimin e krimit kibernetik n\u00eb fush\u00ebn e Ransomware. Gjat\u00eb gjysm\u00ebs s\u00eb dyt\u00eb t\u00eb majit, n\u00eb mbar\u00eb bot\u00ebn u bllokuan 20% m\u00eb shum\u00eb k\u00ebrc\u00ebnime Ransomware se zakonisht. Pas nj\u00eb r\u00ebnie t\u00eb vog\u00ebl tani, n\u00eb qershor, po v\u00ebrejm\u00eb s\u00ebrish nj\u00eb rritje t\u00eb aktivitetit. Dhe p\u00ebr k\u00ebt\u00eb ka disa arsye t\u00eb menj\u00ebhershme. <\/p>\n

T\u00eb hysh n\u00eb kompjuterin e viktim\u00ebs
\n<\/h3>\n

\nTeknologjit\u00eb e mbrojtjes po zhvillohen, dhe kriminel\u00ebt duhet t\u00eb ndryshojn\u00eb taktik\u00ebn e tyre p\u00ebr t\u00eb hyr\u00eb n\u00eb nj\u00eb sistem t\u00eb caktuar. Sulmet e synuara Ransomware vazhdojn\u00eb t\u00eb p\u00ebrhapen p\u00ebrmes email-eve t\u00eb mir\u00ebprojektuar phishing (nuk mungon elementi i inxhinieris\u00eb sociale). Megjithat\u00eb, s\u00eb fundmi, zhvilluesit e softuerit malinj po u kushtojn\u00eb shum\u00eb v\u00ebmendje punonj\u00ebsve t\u00eb distancuar. P\u00ebr t\u2019i sulmuar ata, mund t\u00eb gjenden sh\u00ebrbime t\u00eb mbrojtura dob\u00ebt p\u00ebr qasje t\u00eb larg\u00ebt, si RDP, ose server\u00eb VPN me dob\u00ebsi.
\nK\u00ebt\u00eb po b\u00ebjn\u00eb ata. N\u00eb darknet jan\u00eb shfaqur madje sh\u00ebrbime ransomware-as-a-service, t\u00eb cilat ofrojn\u00eb gjith\u00e7ka t\u00eb nevojshme p\u00ebr t\u00eb sulmuar nj\u00eb organizat\u00eb ose individ t\u00eb zgjedhur. <\/p>\n

K\u00ebrc\u00ebnuesit k\u00ebrkojn\u00eb \u00e7do mund\u00ebsi p\u00ebr t\u00eb dep\u00ebrtuar n\u00eb rrjetin korporativ dhe p\u00ebr t\u00eb zgjeruar gam\u00ebn e sulmit. Nj\u00eb drejtim i njohur jan\u00eb p\u00ebrpjekjet p\u00ebr t\u00eb infektuar rrjetet e ofruesve t\u00eb sh\u00ebrbimeve. Duke qen\u00eb se sh\u00ebrbimet cloud sot po fitojn\u00eb popullaritet, infektimi i nj\u00eb sh\u00ebrbimi t\u00eb njohur lejon sulmin e dhjet\u00ebra apo edhe qindra viktimave nj\u00ebher\u00ebsh. <\/p>\n

N\u00eb rastin e thyerjes s\u00eb konsolave t\u00eb internetit q\u00eb menaxhojn\u00eb sistemet e siguris\u00eb ose rezervave, sulmuesit mund t\u00eb \u00e7aktivizojn\u00eb mbrojtjen, t\u00eb fshijn\u00eb rezervat dhe gjithashtu t\u00eb sigurojn\u00eb q\u00eb malware-i i tyre t\u00eb shp\u00ebrndahet n\u00eb t\u00eb gjith\u00eb organizat\u00ebn. N\u00eb fakt, p\u00ebr k\u00ebt\u00eb arsye ekspert\u00ebt rekomandojn\u00eb t\u00eb mbrohen me kujdes t\u00eb gjitha llogarit\u00eb sh\u00ebrbyesh p\u00ebrmes autentifikimit me shum\u00eb faktor\u00eb. P\u00ebr shembull, t\u00eb gjitha sh\u00ebrbimet cloud Acronis lejojn\u00eb vendosjen e mbrojtjes dyfishe, sepse n\u00eb rastin e kompromiseve t\u00eb fjal\u00ebkalimeve, k\u00ebrc\u00ebnuesit mund t\u00eb anullojn\u00eb \u00e7do avantazh nga p\u00ebrdorimi i nj\u00eb sistemi t\u00eb plot\u00eb t\u00eb mbrojtjes kibernetike. <\/p>\n

Zgjerimi i gam\u00ebs s\u00eb sulmit
\n<\/h3>\n

\nKur q\u00ebllimi i d\u00ebshiruar \u00ebsht\u00eb arritur dhe malware-i tashm\u00eb ndodhet brenda rrjetit korporativ, p\u00ebr shp\u00ebrndarje t\u00eb m\u00ebtejshme zakonisht p\u00ebrdoren taktik\u00eb shum\u00eb standarde. K\u00ebrc\u00ebnuesit studiojn\u00eb situat\u00ebn dhe p\u00ebrpiqen t\u00eb kalojn\u00eb barrierat q\u00eb jan\u00eb krijuar brenda kompanis\u00eb p\u00ebr t\u00eb kund\u00ebrshtuar k\u00ebrc\u00ebnimet. Kjo pjes\u00eb e sulmit mund t\u00eb ndodh\u00eb manualisht (sepse n\u00ebse ata tashm\u00eb kan\u00eb hyr\u00eb n\u00eb rrjet, at\u00ebher\u00eb ka mbetur vet\u00ebm 'ngacmimi n\u00eb gozhd\u00eb\u2019!). P\u00ebr k\u00ebt\u00eb p\u00ebrdoren mjete tashm\u00eb t\u00eb njohura, si PowerShell, WMI PsExec, si dhe emulatori m\u00eb i ri Cobalt Strike dhe utilitete t\u00eb tjera. Disa grupe kriminale q\u00ebllimisht sulmojn\u00eb menaxher\u00ebt e fjal\u00ebkalimeve p\u00ebr t\u00eb hyr\u00eb m\u00eb thell\u00eb n\u00eb rrjetin korporativ. Nj\u00eb malware i till\u00eb si Ragnar \u00ebsht\u00eb v\u00ebrejtur s\u00eb fundmi n\u00eb nj\u00eb imazh t\u00eb plot\u00ebsisht t\u00eb mbyllur t\u00eb makin\u00ebs virtuale VirtualBox, e cila ndihmon n\u00eb fshehjen e pranis\u00eb s\u00eb software-it t\u00eb huaj n\u00eb makin\u00eb. <\/p>\n

Pra ndaj, kur hyn n\u00eb rrjetin korporativ, malware p\u00ebrpiqet t\u00eb verifikoj\u00eb nivelin e aksesit t\u00eb p\u00ebrdoruesit dhe t\u00eb aplikohet fjal\u00ebkalimet e vjedhura. Teknika si Mimikatz dhe Bloodhound & Co. ndihmojn\u00eb n\u00eb thyerjen e llogarive t\u00eb administrator\u00ebve t\u00eb domain-eve. Vet\u00ebm kur sulmuesi beson se mund\u00ebsit\u00eb p\u00ebr p\u00ebrhapje jan\u00eb shteruar, ngarkohet n\u00eb sistemet e klient\u00ebve direkt nj\u00eb program k\u00ebrkes\u00eb-ransom\u00eb. <\/p>\n

Ransomware si mbulues
\n<\/h3>\n

\nDuke marr\u00eb parasysh shkall\u00ebn e rrezikut t\u00eb humbjes s\u00eb t\u00eb dh\u00ebnave, \u00e7do vit gjithnj\u00eb e m\u00eb shum\u00eb kompani zbatohen n\u00eb jet\u00ebn e quajtur \"plani i rikuperimit nga fatkeq\u00ebsit\u00eb\". Fal\u00eb k\u00ebsaj, ata nuk shqet\u00ebsohen shum\u00eb p\u00ebr t\u00eb dh\u00ebnat e koduara, dhe n\u00eb rastin e nj\u00eb sulmi Ransomware, ata nuk fillojn\u00eb t\u00eb grumbullojn\u00eb shp\u00ebrblim, por fillojn\u00eb procesin e rikuperimit. Por edhe haker\u00ebt nuk flejn\u00eb. n\u00ebn mbulimin e Ransomware ndodhin vjedhje masive t\u00eb t\u00eb dh\u00ebnave. Taktika e till\u00eb filloi t\u00eb aplikohej masivisht nga Maze q\u00eb n\u00eb vitin 2019, megjithat\u00eb grupe t\u00eb tjera periodikisht kan\u00eb kombinuar sulmet. Tani, vjedhja e t\u00eb dh\u00ebnave s\u00eb bashku me kodimin po merret me t\u00eb pakt\u00ebn Sodinokibi, Netfilm, Nemty, Netwalker, Ragnar, Psya, DoppelPaymer, CLOP, AKO dhe Sekhmet.<\/p>\n

Ndonj\u00ebher\u00eb, sulmuesit arrijn\u00eb t\u00eb nxjerrin nga kompania dhjet\u00ebra terabajt t\u00eb dh\u00ebnash, t\u00eb cilat mund t\u00eb ishin zbuluar nga mjete t\u00eb monitorimit t\u00eb rrjetit (n\u00ebse do t\u00eb ishin instaluar dhe konfiguruar). Sepse m\u00eb s\u00eb shpeshti, transferimi i t\u00eb dh\u00ebnave ndodh thjesht p\u00ebrmes FTP, Putty, WinSCP ose skripteve PowerShell. P\u00ebr t\u00eb kap\u00ebrcyer DLP dhe sistemet e monitorimit t\u00eb rrjetit, t\u00eb dh\u00ebnat mund t\u00eb enkriptohen ose t\u00eb d\u00ebrgohen si arkiv me fjal\u00ebkalim, dhe kjo \u00ebsht\u00eb nj\u00eb sfid\u00eb e re p\u00ebr sh\u00ebrbimet e siguris\u00eb, t\u00eb cilat duhet t\u00eb kontrollojn\u00eb trafik dal\u00ebs p\u00ebr pranin\u00eb e skedar\u00ebve t\u00eb till\u00eb.<\/p>\n

Studimi i sjelljes s\u00eb infostealer\u00ebve tregon se haker\u00ebt nuk mbledhin \u00e7far\u00ebdo \u2014 ata jan\u00eb t\u00eb interesuar pik\u00ebrisht p\u00ebr raportet financiare, bazat e t\u00eb dh\u00ebnave t\u00eb klient\u00ebve, t\u00eb dh\u00ebnat personale t\u00eb punonj\u00ebsve dhe klient\u00ebve, kontratat, regjistrat, dokumentet ligjore. Malware skanon disqet n\u00eb k\u00ebrkim t\u00eb \u00e7do informacioni q\u00eb teorikisht mund t\u00eb p\u00ebrdoret p\u00ebr shantazh.
\nN\u00ebse nj\u00eb sulm i till\u00eb ka qen\u00eb i suksessh\u00ebm, zakonisht autor\u00ebt publikojn\u00eb nj\u00eb teaser t\u00eb vog\u00ebl, duke treguar disa dokumente si prov\u00eb se t\u00eb dh\u00ebnat kan\u00eb rrjedhur nga organizata. Disa grupe madje publikojn\u00eb t\u00eb gjith\u00eb paket\u00ebn e t\u00eb dh\u00ebnave n\u00eb faqen e tyre, n\u00ebse koha p\u00ebr t\u00eb paguar shp\u00ebrblimin ka skaduar. P\u00ebr t\u00eb shmangur bllokimin dhe p\u00ebr t\u00eb siguruar nj\u00eb shtrirje t\u00eb gjer\u00eb, t\u00eb dh\u00ebnat publikohen gjithashtu n\u00eb rrjetin TOR.<\/p>\n

Nj\u00eb tjet\u00ebr m\u00ebnyr\u00eb monetizimi \u00ebsht\u00eb shitja e t\u00eb dh\u00ebnave. P\u00ebr shembull, Sodinokibi s\u00eb fundmi shpalli zhvillimin e ankandeve t\u00eb hapura, ku t\u00eb dh\u00ebnat i jepen pjes\u00ebmarr\u00ebsit q\u00eb b\u00ebn ofert\u00ebn m\u00eb t\u00eb lart\u00eb. \u00c7mimi fillestar i k\u00ebtyre ankandeve \u00ebsht\u00eb $50-100K n\u00eb var\u00ebsi t\u00eb cil\u00ebsis\u00eb dhe p\u00ebrmbajtjes s\u00eb t\u00eb dh\u00ebnave. P\u00ebr shembull, nj\u00eb grup prej 10,000 regjistrimesh mbi flukset e paras\u00eb, t\u00eb dh\u00ebna konfidenciale t\u00eb biznesit dhe patentash t\u00eb skanuara u shit\u00ebn p\u00ebr nj\u00eb \u00e7mim prej 100,000 dollar\u00ebsh. Nd\u00ebrsa p\u00ebr 50,000 dollar\u00eb, mund t\u00eb blihej m\u00eb shum\u00eb se 20,000 dokumente financiare plus tre baza t\u00eb dh\u00ebnash me skedar\u00eb llogarish dhe t\u00eb dh\u00ebna p\u00ebr klient\u00ebt. <\/p>\n

Faqet ku publikohen t\u00eb dh\u00ebnat e rrjedhura jan\u00eb shum\u00eb t\u00eb ndryshme. Ato mund t\u00eb jen\u00eb nj\u00eb faqe e thjesht\u00eb, ku jan\u00eb publikuar t\u00eb gjitha t\u00eb dh\u00ebnat e vjedhura, dhe madje ka struktura m\u00eb t\u00eb komplikuara me seksione dhe mund\u00ebsi blerjeje. Por e r\u00ebnd\u00ebsishmja \u00ebsht\u00eb se t\u00eb gjith\u00eb ato sh\u00ebrbejn\u00eb nj\u00eb q\u00ebllimi \u2014 p\u00ebr t\u00eb rritur shanset e sulmuesve p\u00ebr t\u00eb marr\u00eb para t\u00eb v\u00ebrteta. N\u00ebse ky model biznesi do t\u00eb tregoj\u00eb rezultate t\u00eb mira p\u00ebr autor\u00ebt e krimeve, nuk ka dyshim se do t\u00eb ket\u00eb edhe m\u00eb shum\u00eb faqe t\u00eb tilla dhe teknikat e vjedhjes dhe monetizimit t\u00eb t\u00eb dh\u00ebnave korporative do t\u00eb zgjerojn\u00eb m\u00eb tej.<\/p>\n

K\u00ebtu jan\u00eb disa nga faqet aktuale ku publikohen t\u00eb dh\u00ebnat e rrjedhura:<\/p>\n

\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n<\/p>\n

\u00c7far\u00eb t\u00eb b\u00ebni me sulmet e reja
\n<\/h3>\n

\nSfidat kryesore p\u00ebr sh\u00ebrbimet e siguris\u00eb n\u00eb k\u00ebto kushte jan\u00eb se s\u00eb fundmi gjithnj\u00eb e m\u00eb shum\u00eb incidente q\u00eb lidhen me Ransomware po dalin si nj\u00eb metod\u00eb shp\u00ebrqendrimi nga vjedhja e t\u00eb dh\u00ebnave. Autor\u00ebt e krimeve nuk p\u00ebrqendrohen m\u00eb vet\u00ebm n\u00eb enkriptimin e server\u00ebve. P\u00ebrkundrazi, q\u00ebllimi kryesor \u00ebsht\u00eb organizimi i rrjedhjes, nd\u00ebrsa ju luftoni me enkriptuesit. <\/p>\n

Prandaj, p\u00ebrdorimi i vet\u00ebm i nj\u00eb sistemi backup, edhe me nj\u00eb plan t\u00eb mir\u00eb rikuperimi, rezulton t\u00eb jet\u00eb i pamjaftuesh\u00ebm p\u00ebr t'u p\u00ebrballur me k\u00ebrc\u00ebnime t\u00eb shum\u00ebfishta. Natyrisht, nuk mund t\u00eb shmangim backup-\u00ebt, pasi sulmuesit do t\u00eb provokojn\u00eb gjithmon\u00eb t\u00eb kriptojn\u00eb di\u00e7ka dhe t\u00eb k\u00ebrkojn\u00eb nj\u00eb shp\u00ebrblim. B\u00ebhet fjal\u00eb m\u00eb shum\u00eb p\u00ebr faktin se tani \u00e7do sulm q\u00eb p\u00ebrdor ransomware duhet t\u00eb merret si nj\u00eb rast p\u00ebr nj\u00eb analiz\u00eb t\u00eb plot\u00eb t\u00eb trafikut dhe fillimin e nj\u00eb hetimi t\u00eb mundsh\u00ebm t\u00eb sulmit. Gjithashtu, duhet t\u00eb mendojm\u00eb p\u00ebr mjete t\u00eb tjera sigurie q\u00eb mund t\u00eb: <\/p>\n