{"id":96228,"date":"2020-10-09T19:42:19","date_gmt":"2020-10-09T17:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit"},"modified":"2020-10-09T19:42:19","modified_gmt":"2020-10-09T17:42:19","slug":"nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","title":{"rendered":"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/b57d6aa03463566d8f17c4b51246a07e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Kompani t\u00eb antivirusit, ekspert\u00eb t\u00eb siguris\u00eb dhe thjesht entuziast\u00eb publikojn\u00eb n\u00eb internet sisteme mashtruese \u2014 honeypots, p\u00ebr t\u00eb 'kapur' lloje t\u00eb reja viruse ose p\u00ebr t\u00eb zbuluar taktika t\u00eb pazakonta t\u00eb haker\u00ebve. Honeypot-et jan\u00eb kaq t\u00eb zakonshme sa q\u00eb kriminel\u00ebt kibernetik\u00eb kan\u00eb zhvilluar nj\u00eb lloj imuniteti: ata shpejt e zbulojn\u00eb se \u00e7far\u00eb kan\u00eb p\u00ebrball\u00eb dhe thjesht e injorojn\u00eb. P\u00ebr t\u00eb studiuar taktikat e haker\u00ebve t\u00eb sot\u00ebm, ne krijuam nj\u00eb honeypot realistik, i cili gjat\u00eb shtat\u00eb muajve jetoi n\u00eb internet, duke t\u00ebrhequr sulme t\u00eb ndryshme. Rreth k\u00ebsaj historie, ne kemi folur n\u00eb studimin ton\u00eb '<noindex><a rel=\"nofollow\" href=\"https:\/\/documents.trendmicro.com\/assets\/white_papers\/wp-caught-in-the-act-running-a-realistic-factory-honeypot-to-capture-real-threats.pdf\">Caught in the Act: Running a Realistic Factory Honeypot to Capture Real Threats<\/a><\/noindex>'. Disa fakte nga studimi \u2014 n\u00eb k\u00ebt\u00eb postim. <\/i><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Zhvillimi i honeypot-it: lista e kontrollit<\/h3>\n<p>\nDetyra kryesore gjat\u00eb krijimit t\u00eb kurthit ton\u00eb super ishte q\u00eb t\u00eb siguroheshim q\u00eb haker\u00ebt q\u00eb treguan interes p\u00ebr t\u00eb, nuk do t\u00eb zbulonin mashtrimin. P\u00ebr k\u00ebt\u00eb, na u desh t\u00eb kryenim nj\u00eb pun\u00eb t\u00eb madhe: <\/p>\n<ol>\n<li>T\u00eb krijonim nj\u00eb legjend\u00eb realiste p\u00ebr kompanin\u00eb, duke p\u00ebrfshir\u00eb emra dhe foto t\u00eb punonj\u00ebsve, numra telefoni dhe e-maile.<\/li>\n<li>T\u00eb imagjinonim dhe realizonim nj\u00eb model t\u00eb infrastruktur\u00ebs industriale, n\u00eb p\u00ebrputhje me legjend\u00ebn p\u00ebr aktivitetet e kompanis\u00eb son\u00eb. <\/li>\n<li>T\u00eb vendosnim se cilat sh\u00ebrbime rrjetesh do t\u00eb ishin t\u00eb aksesueshme nga jasht\u00eb, megjithat\u00eb pa u tepruar me hapjen e porteve t\u00eb dob\u00ebt, p\u00ebr t\u00eb mos e b\u00ebr\u00eb at\u00eb t\u00eb duket si nj\u00eb kurth p\u00ebr budallenj. <\/li>\n<li>T\u00eb organizonim dukshm\u00ebrin\u00eb e rrjedhjes s\u00eb informacionit rreth nj\u00eb sistemi t\u00eb dob\u00ebt dhe t\u00eb shp\u00ebrndanim k\u00ebto t\u00eb dh\u00ebna mes sulmuesve potencial\u00eb.<\/li>\n<li>T\u00eb zbatojm\u00eb nj\u00eb v\u00ebzhgim t\u00eb paduksh\u00ebm mbi veprimet e haker\u00ebve n\u00eb infrastruktur\u00ebn e kurthit. <\/li>\n<\/ol>\n<p>\nDhe tani p\u00ebr \u00e7do gj\u00eb n\u00eb rendin e duhur.<\/p>\n<h3><b>Krijojm\u00eb legjend\u00ebn<\/b><\/h3>\n<p>\nKriminel\u00ebt kibernetik\u00eb tashm\u00eb jan\u00eb m\u00ebsuar me shum\u00eb honeypots, prandaj pjesa m\u00eb e avancuar e tyre kryen nj\u00eb hetim t\u00eb thelluar t\u00eb \u00e7do sistemi t\u00eb dob\u00ebt p\u00ebr t\u00eb siguruar se nuk \u00ebsht\u00eb nj\u00eb kurth. P\u00ebr k\u00ebt\u00eb arsye, ne k\u00ebrkuam t\u00eb arrijm\u00eb jo vet\u00ebm realitetin e honeypot-it nga k\u00ebndv\u00ebshtrimi i dizajnit dhe aspekteve teknike, por gjithashtu t\u00eb krijojm\u00eb dukshm\u00ebrin\u00eb e nj\u00eb kompanie reale.<\/p>\n<p>Duke v\u00ebn\u00eb veten n\u00eb vendin e nj\u00eb hackeri hipotez\u00eb, ne zhvilluam nj\u00eb algorit\u00ebm kontrolli q\u00eb mund t\u00eb ndihmonte n\u00eb identifikimin e sistemit t\u00eb v\u00ebrtet\u00eb nga kurthi. Ai p\u00ebrfshinte k\u00ebrkimin e adresave IP t\u00eb kompanis\u00eb n\u00eb sistemet e reputacionit, hulumtimin e historis\u00eb s\u00eb adresave IP, k\u00ebrkimin e emrave dhe fjal\u00ebve ky\u00e7e lidhur me kompanin\u00eb, si dhe partner\u00ebt e saj dhe shum\u00eb gj\u00ebra t\u00eb tjera. N\u00eb fund, legjenda doli mjaft bind\u00ebse dhe atraktive.<\/p>\n<p>Ne vendos\u00ebm ta poziciononim fabrik\u00ebn-kurth si nj\u00eb butik t\u00eb vog\u00ebl p\u00ebr prototipim industrial, q\u00eb punon p\u00ebr klient\u00eb shum\u00eb t\u00eb m\u00ebdhenj anonim\u00eb nga segmenti ushtarak dhe aviacione. Kjo na liroi nga v\u00ebshtir\u00ebsit\u00eb ligjore q\u00eb lidhen me p\u00ebrdorimin e nj\u00eb marke ekzistuese.<\/p>\n<p>M\u00eb pas na duhej t\u00eb krijonim nj\u00eb vizion, mision dhe em\u00ebr p\u00ebr organizat\u00ebn. Ne vendos\u00ebm se kompania jon\u00eb do t\u00eb ishte nj\u00eb startup me nj\u00eb num\u00ebr t\u00eb vog\u00ebl punonj\u00ebsish, \u00e7do nj\u00ebri prej t\u00eb cil\u00ebve do t\u00eb ishte themelues. Kjo e shtonte besueshm\u00ebrin\u00eb e legjend\u00ebs p\u00ebr specializimin e biznesit ton\u00eb, i cili e b\u00ebn at\u00eb t\u00eb jet\u00eb n\u00eb gjendje t\u00eb punoj\u00eb me projekte delikate p\u00ebr klient\u00eb t\u00eb r\u00ebnd\u00ebsish\u00ebm. Ne doja q\u00eb kompania jon\u00eb t\u00eb dukej e dob\u00ebt nga ana e siguris\u00eb kibernetike, por nj\u00ebkoh\u00ebsisht t\u00eb ishte e qart\u00eb se ne punojm\u00eb me aktivet e r\u00ebnd\u00ebsishme n\u00eb sistemet e synuara.<\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/cefb9d754e08689bc4cedc91efa53bdc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Screenshot i uebfaqes s\u00eb honeypot-it MeTech. Burimi: Trend Micro<\/i><\/p>\n<p>Si em\u00ebr t\u00eb kompanis\u00eb, ne zgjodh\u00ebm fjal\u00ebn MeTech. Uebfaqja u b\u00eb mbi nj\u00eb template falas. Imazhet i mor\u00ebm nga bankat e fotove, duke p\u00ebrdorur m\u00eb t\u00eb pak\u00ebta dhe duke i redaktuar p\u00ebr t'i b\u00ebr\u00eb ato m\u00eb pak t\u00eb njohura. <\/p>\n<p>Ne donim q\u00eb kompania t\u00eb dukej reale, prandaj duhej t\u00eb shtonim punonj\u00ebs me aft\u00ebsi profesionale q\u00eb p\u00ebrputhen me profilin e aktiviteteve. Ne krijuam emra dhe personalitete p\u00ebr ta, dhe pastaj u p\u00ebrpoq\u00ebm t\u00eb zgjidhnim imazhe nga bankat e fotove p\u00ebrkat\u00ebsisht me p\u00ebrkat\u00ebsin\u00eb etnike. <\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/3b7fa0a8287500349c0a25aa464fee2a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i><i>Screenshot i uebfaqes s\u00eb honeypot-it MeTech. Burimi: Trend Micro<\/i><\/i><\/p>\n<p>P\u00ebr t'u siguruar q\u00eb nuk do t\u00eb na zbulonin, ne k\u00ebrkuam foto grupore me cil\u00ebsi t\u00eb lart\u00eb, nga t\u00eb cilat mund t\u00eb zgjidhnim fytyrat q\u00eb na duhej. Sidoqoft\u00eb, ne m\u00eb von\u00eb heq\u00ebm dor\u00eb nga ky opsion, pasi nj\u00eb haker potencial mund ta p\u00ebrdorte k\u00ebrkimin e reversit t\u00eb imazheve dhe t\u00eb zbulonte se 'punonj\u00ebsit' tan\u00eb jetonin vet\u00ebm n\u00eb bankat e fotove. N\u00eb fund, p\u00ebrdor\u00ebm fotografit\u00eb e njer\u00ebzve t\u00eb pav\u00ebrtet\u00eb, t\u00eb krijuara me ndihm\u00ebn e rrjeteve nervore.<\/p>\n<p>Profilet e publikuara n\u00eb uebfaqe p\u00ebrmbanin informacione t\u00eb r\u00ebnd\u00ebsishme mbi aft\u00ebsit\u00eb e tyre teknike, megjithat\u00eb ne shmangnim t\u00eb dh\u00ebnat e institucioneve t\u00eb caktuara arsimore dhe qyteteve.<br \/>\nP\u00ebr krijimin e kutive postare, ne p\u00ebrdor\u00ebm serverin e ofruesit t\u00eb sh\u00ebrbimeve t\u00eb hostingu, dhe m\u00eb pas qeruan disa numra telefoni n\u00eb SHBA dhe i kombinova n\u00eb nj\u00eb PBX virtual me menu zanore dhe p\u00ebrgjigje automatike.<\/p>\n<h3><b>Infrastruktura e hani-poteve<\/b><\/h3>\n<p>\nP\u00ebr t\u00eb shmangur zbuluarjen, ne vendos\u00ebm t\u00eb p\u00ebrdorim nj\u00eb kombinim t\u00eb pajisjeve t\u00eb v\u00ebrteta industriale, kompjuter\u00ebve fizik\u00eb dhe makinave virtuale t\u00eb mbrojtura. Si\u00e7 do t\u00eb shohim m\u00eb von\u00eb, ne e verifikuam rezultatin e p\u00ebrpjekjeve tona me ndihm\u00ebn e motorit t\u00eb k\u00ebrkimit Shodan, dhe ai tregoi se hani-poti dukej si nj\u00eb sistem industrial t\u00eb v\u00ebrtet\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/77ff6f72dacafcf9326161f2150c91b8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Rezultati i skanimit t\u00eb hani-poteve me Shodan. Burimi: Trend Micro<\/i><\/p>\n<p>Si \"pajisje\" p\u00ebr kurthin ton\u00eb, ne p\u00ebrdor\u00ebm kat\u00ebr PLC:<\/p>\n<ul>\n<li> Siemens S7-1200,<\/li>\n<li>dy AllenBradley MicroLogix 1100,<\/li>\n<li>Omron CP1L.<\/li>\n<\/ul>\n<p>\nK\u00ebto PLC u p\u00ebrzgjodh\u00ebn p\u00ebr popullaritetin e tyre n\u00eb tregun bot\u00ebror t\u00eb sistemit t\u00eb menaxhimit. Gjithashtu, \u00e7do nj\u00ebri nga k\u00ebta kontrollues p\u00ebrdor protokollin e saj, duke na lejuar t\u00eb testojm\u00eb se cili nga PLC-t\u00eb do t\u00eb sulmohej m\u00eb shpesh dhe n\u00ebse ata do t\u00eb interesonin ndok\u00ebnd. <\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/f575a4cabd0b38f1af43b8d20cc0a8d4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Pajisjet e \"fabrik\u00ebs\" son\u00eb t\u00eb kurthit. Burimi: Trend Micro<\/i><\/p>\n<p>Ne nuk thjesht vendos\u00ebm pajisjet dhe i lidh\u00ebm ato me internetin. \u00c7do kontrollues e programuam p\u00ebr t\u00eb kryer detyra, midis t\u00eb cilave ishin<\/p>\n<ul>\n<li>shk\u00ebmbyes,<\/li>\n<li>kontrolli i oxhakut dhe linj\u00ebs s\u00eb konvejers\u00eb,<\/li>\n<li>paletizimi duke p\u00ebrdorur nj\u00eb manipulues robotik.<\/li>\n<\/ul>\n<p>\nDhe p\u00ebr t\u00eb b\u00ebr\u00eb procesin prodhues m\u00eb realist, ne programuam logjik\u00ebn p\u00ebr t\u00eb modifikuar rast\u00ebsisht parametrat e reagimit, duke simuluar ndezjen dhe fikjen e motor\u00ebve, duke aktivizuar dhe \u00e7aktivizuar oxhakun.<\/p>\n<p>N\u00eb fabrik\u00ebn ton\u00eb kishte tre kompjuter\u00eb virtual\u00eb dhe nj\u00eb fizik. Kompjuter\u00ebt virtual\u00eb u p\u00ebrdor\u00ebn p\u00ebr menaxhimin e fabrik\u00ebs, robotit paletizues dhe si nj\u00eb stacion p\u00ebr inxhinierin e programimit PLC. Kompjuter fizike punonte si server dosjesh.<\/p>\n<p>P\u00ebrve\u00e7 ndjekjes s\u00eb sulmeve ndaj PLC-ve, ne donim t\u00eb monitoronim gjendjen e programeleve t\u00eb ngarkuara n\u00eb pajisjet tona. P\u00ebr k\u00ebt\u00eb, ne krijuam nj\u00eb nd\u00ebrfaqe q\u00eb lejonte p\u00ebrcaktimin e shpejt\u00eb t\u00eb m\u00ebnyr\u00ebs se si ishin modifikuar gjendjet e mekanizmave dhe vazhduesve tan\u00eb virtual\u00eb. Gjat\u00eb faz\u00ebs s\u00eb planifikimit, ne zbuluam se ishte m\u00eb e leht\u00eb ta realizonim k\u00ebt\u00eb me nj\u00eb program menaxhimi sesa duke e programuar logjik\u00ebn e kontrolluesit drejtp\u00ebrdrejt. Ne hap\u00ebm aksesin n\u00eb nd\u00ebrfaqen e menaxhimit t\u00eb pajisjeve t\u00eb hani-poteve p\u00ebrmes VNC pa fjal\u00ebkalim.<\/p>\n<p>Robot\u00ebt industrial\u00eb jan\u00eb nj\u00eb komponent ky\u00e7 i prodhimit t\u00eb men\u00e7ur modern. P\u00ebr k\u00ebt\u00eb arsye, ne vendos\u00ebm t\u00eb shtonim nj\u00eb robot dhe nj\u00eb stacion t\u00eb menaxhimit p\u00ebr t\u00eb n\u00eb pajisjet e fabrik\u00ebs son\u00eb t\u00eb kurthit. P\u00ebr ta b\u00ebr\u00eb \"fabriken\" m\u00eb realiste, n\u00eb stacionin e menaxhimit vendos\u00ebm software t\u00eb v\u00ebrtet\u00eb q\u00eb inxhinier\u00ebt p\u00ebrdorin p\u00ebr t\u00eb programuar logjik\u00ebn e robotit n\u00eb stilin grafik. Nj\u00ebkoh\u00ebsisht, pasi robot\u00ebt industrial\u00eb zakonisht ndodhen n\u00eb nj\u00eb rrjet t\u00eb brendsh\u00ebm t\u00eb izoluar, ne vendos\u00ebm t\u00eb l\u00ebm\u00eb vet\u00ebm aksesin e paprotectuar p\u00ebr VNC n\u00eb stacionin e menaxhimit.<\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/157e4891ccf19fb93d3b925309543c9d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Mediat RobotStudio me model 3D t\u00eb robotit ton\u00eb. Burimi: Trend Micro<\/i><\/p>\n<p>N\u00eb virtualin me stacionin e menaxhimit t\u00eb robotit, ne instalojm\u00eb mjedisin e programimit RobotStudio nga ABB Robotics. Duke konfiguruar RobotStudio, ne hap\u00ebm skedarin e simulimit me robotin ton\u00eb, n\u00eb at\u00eb m\u00ebnyr\u00eb q\u00eb imazhi 3D t\u00eb ishte i duksh\u00ebm n\u00eb ekran. Si rezultat, Shodan dhe motor\u00ebt e tjer\u00eb t\u00eb k\u00ebrkimit, duke zbuluar nj\u00eb server VNC t\u00eb paprotectuar, do t\u00eb merrnin k\u00ebt\u00eb imazh nga ekrani dhe do ta tregonin p\u00ebr ata q\u00eb k\u00ebrkojn\u00eb robot\u00eb industrial\u00eb me qasje t\u00eb hapur n\u00eb menaxhim. <\/p>\n<p>Q\u00ebllimi i k\u00ebtij kujdesi p\u00ebr detajet ishte t\u00eb krijonte nj\u00eb q\u00ebllim t\u00ebrheq\u00ebs dhe sa m\u00eb realist p\u00ebr sulmuesit, t\u00eb cil\u00ebt, duke e zbuluar at\u00eb, ktheheshin p\u00ebrs\u00ebri p\u00ebr t\u00eb.<\/p>\n<p><b><\/p>\n<h3>Stacioni i inxhinierit<\/h3>\n<p><\/b><br \/>\nP\u00ebr programimin e logjik\u00ebs s\u00eb PLC-ve, ne shtuam nj\u00eb kompjuter inxhinierik n\u00eb infrastruktur\u00eb. N\u00eb t\u00eb, ne instalojm\u00eb softuer industrial p\u00ebr programimin e PLC-ve:<\/p>\n<ul>\n<li>TIA Portal p\u00ebr Siemens,<\/li>\n<li>MicroLogix p\u00ebr kontrolluesin Allen-Bradley,<\/li>\n<li>CX-One p\u00ebr Omron.<\/li>\n<\/ul>\n<p>\nNe vendos\u00ebm q\u00eb vendi i pun\u00ebs inxhinierik nuk do t\u00eb ishte i qassh\u00ebm jasht\u00eb rrjetit. N\u00eb vend t\u00eb k\u00ebsaj, ne vendos\u00ebm t\u00eb kemi t\u00eb nj\u00ebjtin fjal\u00ebkalim p\u00ebr llogarin\u00eb e administratorit, si\u00e7 ka n\u00eb stacionet e menaxhimit t\u00eb robotit dhe fabrik\u00ebs. Kjo konfigurim \u00ebsht\u00eb mjaft e zakonshme n\u00eb shum\u00eb kompani.<br \/>\nFatkeq\u00ebsisht, pavar\u00ebsisht nga t\u00eb gjitha p\u00ebrpjekjet tona, asnj\u00eb sulmues nuk arriti t\u00eb hynte n\u00eb stacionin e inxhinierit.<\/p>\n<h3>Serveri i skedar\u00ebve<\/h3>\n<p>\nAi ishte i nevojsh\u00ebm p\u00ebr ne si mamushka p\u00ebr sulmuesit dhe si mjet p\u00ebr kopje rezerv\u00eb t\u00eb \"pun\u00ebve\" tona n\u00eb fabrik\u00ebn e kurthit. Kjo na lejoi t\u00eb shk\u00ebmbenim skedar\u00eb me honeypot-in ton\u00eb duke p\u00ebrdorur pajisje USB, pa l\u00ebn\u00eb gjurm\u00eb n\u00eb rrjetin e kurthit. Si sistem operativ p\u00ebr serverin e skedar\u00ebve, ne instaluam Windows 7 Pro, ku krijuam nj\u00eb dosje t\u00eb p\u00ebrbashk\u00ebt, t\u00eb disponueshme p\u00ebr lexim dhe shkrim nga kushdo.<\/p>\n<p>N\u00eb fillim nuk krijuam asnj\u00eb hierarki dosjesh dhe dokumentesh n\u00eb serverin e skedar\u00ebve. Sidoqoft\u00eb, m\u00eb von\u00eb u zbulua se sulmuesit aktivisht studionin k\u00ebt\u00eb dosje, prandaj vendos\u00ebm ta mbushnim at\u00eb me skedar\u00eb t\u00eb ndrysh\u00ebm. P\u00ebr k\u00ebt\u00eb, shkruam nj\u00eb skritp python q\u00eb krijonte nj\u00eb skedar me dimension t\u00eb rast\u00ebsish\u00ebm me nj\u00eb nga zgjedhjet e dh\u00ebna, duke formuar emrin mbi baz\u00ebn e nj\u00eb fjalori. <\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/5c1ec2c139d04200849443771b48872a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Skript p\u00ebr gjenerimin e emrave t\u00ebrheq\u00ebs t\u00eb skedar\u00ebve. Burimi: Trend Micro<\/i><\/p>\n<p>Pas ekzekutimit t\u00eb skriptit, mor\u00ebm rezultatin e d\u00ebshiruar n\u00eb form\u00ebn e nj\u00eb dosje t\u00eb mbushur me skedar\u00eb me emra shum\u00eb interesant\u00eb. <\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/a1842a978ecb400e4390274e202af6f0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Rezultati i pun\u00ebs s\u00eb skriptit. Burimi: Trend Micro<\/i><\/p>\n<p><b><\/p>\n<h3>Mjedisi p\u00ebr monitorim<\/h3>\n<p><\/b><br \/>\nPas gjith\u00eb atij p\u00ebrpjekjeje p\u00ebr t\u00eb krijuar nj\u00eb kompani realiste, ne v\u00ebrtet nuk mund t\u00eb lejonim q\u00eb t\u00eb gabonim n\u00eb mjedisin p\u00ebr monitorimin e \"vizitor\u00ebve\" tan\u00eb. Na nevojitej t\u00eb merrnim t\u00eb gjitha t\u00eb dh\u00ebnat n\u00eb koh\u00eb reale n\u00eb nj\u00eb m\u00ebnyr\u00eb q\u00eb sulmuesit nuk e kuptonin q\u00eb po i vrojtonim. <\/p>\n<p>Ne e realizuam k\u00ebt\u00eb duke p\u00ebrdorur kat\u00ebr adaptrues USB-Ethernet, kat\u00ebr shp\u00ebrndar\u00ebs Ethernet t\u00eb SharkTap, Raspberry Pi 3 dhe nj\u00eb disk t\u00eb madh t\u00eb jasht\u00ebm. Skema e rrjetit ton\u00eb dukej k\u00ebshtu: <\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/2288c39fa3c4ceee6f5f30dd012de269.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Skema e rrjetit t\u00eb honeypotit me pajisje p\u00ebr monitorim. Burimi: Trend Micro<\/i><\/p>\n<p>Tre shp\u00ebrndar\u00ebs SharkTap i vendos\u00ebm n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb monitoronin t\u00eb gjith\u00eb trafikun e jasht\u00ebm drejt PLC-ve, t\u00eb disponueshme vet\u00ebm nga rrjeti i brendsh\u00ebm. SharkTap-i i kat\u00ebrt monitoronte trafikun e mysafir\u00ebve t\u00eb makin\u00ebs virtuale t\u00eb prekshme. <\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/9440a392352b104c27056ee00bc3b2a9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Ethernet shp\u00ebrndar\u00ebsi SharkTap dhe routeri Sierra Wireless AirLink RV50. Burimi: Trend Micro<\/i><\/p>\n<p>Raspberry Pi regjistronte trafikun ditore. K\u00ebtu u organizua lidhja me internetin me an\u00eb t\u00eb routerit celular Sierra Wireless AirLink RV50, i cili shpesh p\u00ebrdoret n\u00eb nd\u00ebrmarrje industriale. <\/p>\n<p>Fatkeq\u00ebsisht, ky router nuk na lejonte t\u00eb bllokonim selektivisht sulmet q\u00eb nuk p\u00ebrputheshin me planet tona, prandaj shtuam n\u00eb rrjet nj\u00eb firewall Cisco ASA 5505 n\u00eb modalitetin e p\u00ebrshkruar, p\u00ebr t\u00eb realizuar bllokimet me nd\u00ebrlikim minimal n\u00eb rrjet. <\/p>\n<p><b><\/p>\n<h3>Analiza e trafikut<\/h3>\n<p><\/b><br \/>\nTshark dhe tcpdump jan\u00eb t\u00eb p\u00ebrshtatshme p\u00ebr zgjidhjen e shpejt\u00eb t\u00eb problemeve t\u00eb tanishme, por n\u00eb rastin ton\u00eb, kapaciteti i tyre ishte i pamjaftuesh\u00ebm, pasi kishim shum\u00eb gigabajt trafiku q\u00eb po analizohej nga disa persona. Ne p\u00ebrdorim nj\u00eb analist open-source Moloch, t\u00eb zhvilluar nga AOL. N\u00eb funksionalitetin e saj, ajo \u00ebsht\u00eb n\u00eb nivelin e Wireshark, por ka m\u00eb shum\u00eb mund\u00ebsi p\u00ebr bashk\u00ebpunim, p\u00ebrshkrim dhe etiketim t\u00eb paketeve, eksport dhe detyra t\u00eb tjera.<\/p>\n<p>Pasi nuk donim t\u00eb p\u00ebrpunonim t\u00eb dh\u00ebnat e mbledhura n\u00eb kompjuter\u00ebt e honeypot-it, dump-et PCAP \u00e7do dit\u00eb eksportoheshin n\u00eb depo AWS, nga ku i importonim n\u00eb makin\u00eb me Moloch. <\/p>\n<h3><b>Regjistrimi i ekranit <\/b><\/h3>\n<p>\nP\u00ebr t\u00eb dokumentuar veprimet e haker\u00ebve n\u00eb honeypot-in ton\u00eb, shkruam nj\u00eb skritp q\u00eb n\u00eb nj\u00eb interval t\u00eb caktuar b\u00ebnte screenshots t\u00eb makin\u00ebs virtuale dhe, duke i krahasuar me screenshot-in e m\u00ebparsh\u00ebm, p\u00ebrcaktonte n\u00ebse ndodhte di\u00e7ka apo jo. Kur identifikohej aktiviteti, skripti aktivizonte regjistrimin e ekranit. Ky qasje doli t\u00eb ishte m\u00eb efektiv. Ne gjithashtu u p\u00ebrpoq\u00ebm t\u00eb analizonim trafikun VNC nga dump-i PCAP, p\u00ebr t\u00eb kuptuar se cilat ndryshime ndodh\u00ebn n\u00eb sistem, por p\u00ebrfundimisht regjistrimi i ekranit q\u00eb kishim realizuar ishte m\u00eb i leht\u00eb dhe m\u00eb shk\u00eblqyes. <\/p>\n<p><b><\/p>\n<h3>Monitorimi i seancave VNC<\/h3>\n<p><\/b><br \/>\nP\u00ebr k\u00ebt\u00eb, ne p\u00ebrdor\u00ebm Chaosreader dhe VNCLogger. T\u00eb dy utilitetet nxjerrin nga dump-i PCAP shtypjet e \u00e7el\u00ebsave, por VNCLogger trajton m\u00eb sakt\u00eb \u00e7el\u00ebsat tipik\u00eb si Backspace, Enter, Ctrl.<\/p>\n<p>VNCLogger ka dy disavantazhe. E para: ajo mund t\u00eb nxjerr\u00eb \u00e7el\u00ebsat vet\u00ebm duke \"degjuar\" trafikun n\u00eb interfes, prandaj na duhej t\u00eb imitojm\u00eb p\u00ebr t\u00eb nj\u00eb seanc\u00eb VNC me an\u00eb t\u00eb tcpreplay. Disavantazhi i dyt\u00eb VNCLogger ndan me Chaosreader: t\u00eb dy nuk tregojn\u00eb p\u00ebrmbajtjen e sked\u00ebs s\u00eb kopjes. P\u00ebr k\u00ebt\u00eb, duhej t\u00eb shfryt\u00ebzonim Wireshark. <\/p>\n<p><b><\/p>\n<h3>T\u00ebrheqim haker\u00ebt<\/h3>\n<p><\/b><br \/>\nNe krijuam honeypot-in q\u00eb t\u00eb sulmohej. P\u00ebr ta arritur k\u00ebt\u00eb, ne inskenuam nj\u00eb rrjedhje informacioni, e cila kishte p\u00ebr q\u00ebllim t\u00eb t\u00ebrhiqte v\u00ebmendjen e potencialeve haker\u00ebve. N\u00eb honeypot u hap\u00ebn portet e m\u00ebposhtme: <\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/0defa27d76010837c00aa7b97e993ac0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nPorti RDP duhej mbyllur sapo filloi puna, p\u00ebr shkak t\u00eb nj\u00eb numri t\u00eb madh t\u00eb trafikut skanuese n\u00eb rrjetin ton\u00eb, q\u00eb sjellin probleme me performanc\u00ebn.<br \/>\nTerminalet VNC fillimisht punuan n\u00eb m\u00ebnyr\u00eb 'p\u00ebrve\u00e7 se shikimi' pa fjal\u00ebkalim, dhe pastaj 'gabimisht' i kaluam ato n\u00eb modin e aksesit t\u00eb plot\u00eb. <\/p>\n<p>P\u00ebr t\u00eb t\u00ebrhequr sulmuesit, ne publikuan dy postime me informacion \"t\u00eb rrjedhur\" mbi nj\u00eb sistem industrial t\u00eb disponuesh\u00ebm n\u00eb PasteBin.<\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/2db7cc5aa60da13a6bf70a6f5e88a934.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Nj\u00eb nga postimet, t\u00eb publikuara n\u00eb PasteBin p\u00ebr t\u00eb t\u00ebrhequr sulmet. Burimi: Trend Micro<\/i><\/p>\n<p><b><\/p>\n<h3>Sulmet<\/h3>\n<p><\/b><br \/>\nHoneypoti ka qen\u00eb online p\u00ebr rreth shtat\u00eb muaj. Sulmi i par\u00eb ka ndodhur nj\u00eb muaj pasi honeypoti doli online. <\/p>\n<p><b>Skener\u00ebt<\/b><\/p>\n<p>Ishte shum\u00eb trafik nga skener\u00eb t\u00eb kompanive t\u00eb njohura \u2014 ip-ip, Rapid, Shadow Server, Shodan, ZoomEye dhe t\u00eb tjera. Kishte kaq shum\u00eb, saq\u00eb na u desh t\u00eb p\u00ebrjashtonim ato <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sq\/lir\/ipv4\/\"   title=\"adresat IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"676\">adresat IP<\/a> nga analiza: 610 nga 9452 ose 6,45% e t\u00eb gjitha adresa unike IP i p\u00ebrkisnin skener\u00ebve t\u00eb legjitimuar.<\/p>\n<p><b>Mashtruesit<\/b><\/p>\n<p>Nj\u00eb nga rreziqet m\u00eb t\u00eb m\u00ebdha q\u00eb na \u00ebsht\u00eb dashur t\u00eb p\u00ebrballemi \u00ebsht\u00eb p\u00ebrdorimi i sistemit ton\u00eb p\u00ebr q\u00ebllime kriminale: p\u00ebr t\u00eb bler\u00eb smartphone p\u00ebrmes llogaris\u00eb s\u00eb abonentit, p\u00ebr t\u00eb kthyer milje compagnieve ajrore me kartat dhurat\u00eb dhe forma t\u00eb tjera mashtrimi.<\/p>\n<p><b>Minator\u00ebt<\/b><\/p>\n<p>Nj\u00eb nga vizitor\u00ebt e par\u00eb t\u00eb sistemit ton\u00eb rezultoi t\u00eb ishte nj\u00eb minator. Ai ngarkoi n\u00eb t\u00eb nj\u00eb softuer p\u00ebr minimin e Monero. Ai nuk do t\u00eb ishte n\u00eb gjendje t\u00eb fitonte shum\u00eb n\u00eb sistemin ton\u00eb t\u00eb ve\u00e7ant\u00eb p\u00ebr shkak t\u00eb performanc\u00ebs s\u00eb ul\u00ebt. Megjithat\u00eb, n\u00ebse do t\u00eb bashkoheshin disa dhjet\u00ebra ose madje qindra nga k\u00ebto sisteme, do t\u00eb mund t\u00eb ishte nj\u00eb arritje e mir\u00eb. <\/p>\n<p><b>Shk\u00ebrdhimi <\/b><\/p>\n<p>Gjat\u00eb koh\u00ebs s\u00eb pun\u00ebs s\u00eb honeypotit, u p\u00ebrball\u00ebm dy her\u00eb me viruse t\u00eb v\u00ebrteta k\u00ebrc\u00ebnuese. N\u00eb rastin e par\u00eb ishte Crysis. Operatoret e tij hyn\u00eb n\u00eb sistem p\u00ebrmes VNC, por m\u00eb pas instaluan TeamViewer dhe me t\u00eb kryenin veprimet e tjera. Pas pritjes s\u00eb mesazhit t\u00eb k\u00ebrkes\u00ebs p\u00ebr shp\u00ebrblim prej 10 mij\u00eb dollar\u00eb n\u00eb BTC, ne u angazhuam n\u00eb biseda me kriminel\u00ebt, duke u k\u00ebrkuar atyre t\u00eb na dekriptojn\u00eb nj\u00eb nga skedar\u00ebt. Ata e p\u00ebrmbush\u00ebn k\u00ebrkes\u00ebn dhe p\u00ebrs\u00ebrit\u00ebn k\u00ebrkes\u00ebn p\u00ebr shp\u00ebrblim. Na arriti t\u00eb negociojm\u00eb deri n\u00eb 6 mij\u00eb dollar\u00eb, pas s\u00eb cil\u00ebs ne thjesht e rimbush\u00ebm sistemin n\u00eb nj\u00eb virtual, pasi mor\u00ebm gjitha informacionin e nevojsh\u00ebm. <\/p>\n<p>Shk\u00ebrdhimi i dyt\u00eb rezultoi t\u00eb ishte Phobos. Hakeri q\u00eb e instaloi, pas nj\u00eb ore shqyrtoi sistemin e skedar\u00ebve t\u00eb honeypotit dhe skanoi rrjetin, e m\u00eb pas gjithsesi instaloi k\u00ebrc\u00ebnuesin. <br \/>\nSulmi i tret\u00eb i k\u00ebrc\u00ebnuesit ishte i rrem\u00eb. Nj\u00eb \"haker\" shkarkoi n\u00eb sistemin ton\u00eb skedarin haha.bat, pas s\u00eb cil\u00ebs p\u00ebr nj\u00eb koh\u00eb shikuam sesi ai p\u00ebrpiqej ta b\u00ebnte at\u00eb t\u00eb funksiononte. Nj\u00eb nga p\u00ebrpjekjet ishte rinaming haha.bat n\u00eb haha.rnsmwr. <\/p>\n<p><img decoding=\"async\" alt=\"P\u00ebrher\u00eb t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/cab8571ce84fd25eed10d3f14ed3bff6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>\"Hakeri\" rriti d\u00ebmshm\u00ebrin\u00eb e skedarit bat, duke ndryshuar zgjerimin e saj n\u00eb .rnsmwr. Burimi: Trend Micro<\/i><\/p>\n<p>Kur skedari bat m\u00eb n\u00eb fund filloi t\u00eb funksiononte, \"hakeri\" e redaktoi at\u00eb, duke e rritur shp\u00ebrblimin nga 200 n\u00eb 750 dollar\u00eb. Pas k\u00ebsaj, ai \"e kodoi\" t\u00eb gjitha skedar\u00ebt, la nj\u00eb mesazh k\u00ebrc\u00ebnimi n\u00eb desktop dhe u zhduk, duke nd\u00ebrruar fjal\u00ebkalimet p\u00ebr VNC-n\u00eb ton\u00eb. <\/p>\n<p>Pas disa dit\u00ebsh, hakeri u kthye p\u00ebr t\u00eb na kujtuar, duke e aktivizuar skedarin, i cili hapte shum\u00eb dritare me nj\u00eb faqe pornografike. Dukej se k\u00ebshtu ai p\u00ebrpiqej t\u00eb t\u00ebrhiqte v\u00ebmendjen e k\u00ebrkes\u00ebs s\u00eb tij.<\/p>\n<p><b><\/p>\n<h3>P\u00ebrfundimet<\/h3>\n<p><\/b><br \/>\nGjat\u00eb hulumtimit u zbulua se sa her\u00eb q\u00eb informacioni mbi ndjeshm\u00ebrin\u00eb u publikua, honeypoti t\u00ebrhoqi v\u00ebmendjen me nj\u00eb rritje t\u00eb aktiviteteve nga dita n\u00eb dit\u00eb. P\u00ebr t\u00eb b\u00ebr\u00eb q\u00eb gracka t\u00eb t\u00ebrhiqe v\u00ebmendje, duhej t\u00eb lejohej nj\u00eb num\u00ebr i konsideruesh\u00ebm shkeljesh t\u00eb siguris\u00eb s\u00eb kompanis\u00eb son\u00eb t\u00eb shtirur. Fatkeq\u00ebsisht, nj\u00eb situat\u00eb e till\u00eb nuk \u00ebsht\u00eb e pazakont\u00eb p\u00ebr shum\u00eb kompani reale, q\u00eb nuk kan\u00eb stafin e TI dhe t\u00eb siguris\u00eb p\u00ebrkat\u00ebse.<\/p>\n<p>N\u00eb p\u00ebrgjith\u00ebsi, organizatat duhet t\u00eb p\u00ebrdorin parimin e privilegjeve m\u00eb t\u00eb vogla, nd\u00ebrsa ne zbatonim plot\u00ebsisht kund\u00ebrshtimin e tij p\u00ebr t\u00eb t\u00ebrhequr sulmuesit. Dhe sa m\u00eb gjat\u00eb kemi v\u00ebzhguar sulmet, aq m\u00eb t\u00eb sofistikuara ato b\u00ebheshin krahasuar me metodat standarde t\u00eb testimit t\u00eb penetrimit.<\/p>\n<p>Dhe m\u00eb e r\u00ebnd\u00ebsishmja: t\u00eb gjitha k\u00ebto sulme do t\u00eb kishin d\u00ebshtuar, n\u00ebse do t\u00eb ishin zbatuar masa adekuate t\u00eb siguris\u00eb n\u00eb konfigurimin e rrjetit. Organizatat duhet t\u00eb kujdesen q\u00eb pajisjet e tyre dhe komponent\u00ebt e infrastruktur\u00ebs industriale t\u00eb mos jen\u00eb t\u00eb aksesuesh\u00ebm nga interneti, si\u00e7 e b\u00ebm\u00eb ne me q\u00ebllim n\u00eb grack\u00ebn ton\u00eb. <\/p>\n<p>Megjith\u00ebse nuk kemi regjistruar asnj\u00eb sulm n\u00eb ARM e inxhinierit, pavar\u00ebsisht se p\u00ebrdorej t\u00eb nj\u00ebjtin fjal\u00ebkalim t\u00eb administratorit lokal n\u00eb t\u00eb gjitha kompjuter\u00ebt, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb shmanget kjo praktik\u00eb, p\u00ebr t\u00eb minimizuar mund\u00ebsin\u00eb e dep\u00ebrtimit. Sepse nj\u00eb siguri e dob\u00ebt sh\u00ebrben si nj\u00eb ftes\u00eb shtes\u00eb p\u00ebr sulm n\u00eb sistemet industriale, t\u00eb cilat tashm\u00eb koh\u00eb kan\u00eb t\u00ebrhequr interesin e kriminel\u00ebve kibernetik.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/trendmicro\/blog\/490406\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u044b \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b-\u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u2014 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u044b, \u0447\u0442\u043e\u0431\u044b \u00ab\u043f\u043e\u0439\u043c\u0430\u0442\u044c \u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb \u0441\u0432\u0435\u0436\u0443\u044e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0442\u0430\u043a\u0442\u0438\u043a\u0443. \u0425\u0430\u043d\u0438\u043f\u043e\u0442\u044b \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e, \u0447\u0442\u043e \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u0432\u044b\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0441\u044f \u0441\u0432\u043e\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0439 \u0438\u043c\u043c\u0443\u043d\u0438\u0442\u0435\u0442: \u043e\u043d\u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u044e\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434 \u043d\u0438\u043c\u0438 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044e\u0442 \u0435\u0451. \u0427\u0442\u043e\u0431\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0442\u0430\u043a\u0442\u0438\u043a\u0443 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u044b\u0439 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u044b \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b-\u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u2014 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u044b, \u0447\u0442\u043e\u0431\u044b \u00ab\u043f\u043e\u0439\u043c\u0430\u0442\u044c \u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb \u0441\u0432\u0435\u0436\u0443\u044e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0442\u0430\u043a\u0442\u0438\u043a\u0443. \u0425\u0430\u043d\u0438\u043f\u043e\u0442\u044b \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e, \u0447\u0442\u043e \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u0432\u044b\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0441\u044f \u0441\u0432\u043e\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0439 \u0438\u043c\u043c\u0443\u043d\u0438\u0442\u0435\u0442: \u043e\u043d\u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u044e\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434 \u043d\u0438\u043c\u0438 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044e\u0442 \u0435\u0451. \u0427\u0442\u043e\u0431\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0442\u0430\u043a\u0442\u0438\u043a\u0443 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u044b\u0439 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041d\u0435\u0432\u044b\u0440\u0430\u0437\u0438\u043c\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u0435\u043d: \u043a\u0430\u043a \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0438\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u044b \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b-\u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u2014 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u044b, \u0447\u0442\u043e\u0431\u044b \u00ab\u043f\u043e\u0439\u043c\u0430\u0442\u044c \u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb \u0441\u0432\u0435\u0436\u0443\u044e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0442\u0430\u043a\u0442\u0438\u043a\u0443. \u0425\u0430\u043d\u0438\u043f\u043e\u0442\u044b \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e, \u0447\u0442\u043e \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u0432\u044b\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0441\u044f \u0441\u0432\u043e\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0439 \u0438\u043c\u043c\u0443\u043d\u0438\u0442\u0435\u0442: \u043e\u043d\u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u044e\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434 \u043d\u0438\u043c\u0438 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044e\u0442 \u0435\u0451. \u0427\u0442\u043e\u0431\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0442\u0430\u043a\u0442\u0438\u043a\u0443 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u044b\u0439 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T17:42:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T17:42:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00ebrtej p\u00ebrshkrimeve: si e krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet | ProHoster","description":"Kompani antivirus, ekspert\u00eb t\u00eb siguris\u00eb dhe thjesht entuziast\u00eb vendosin n\u00eb internet sisteme-t\u00eb-joshjes \u2014 honeypots, p\u00ebr t\u00eb \"kapur n\u00eb gjall\u00eb\" nj\u00eb variant t\u00eb ri t\u00eb virusit ose p\u00ebr t\u00eb zbuluar nj\u00eb taktik\u00eb t\u00eb pazakont\u00eb haker\u00ebsh. Honeypots jan\u00eb kaq t\u00eb zakonshme, sa q\u00eb kriminel\u00ebt kibernetik\u00eb kan\u00eb zhvilluar nj\u00eblloj imuniteti: ata i identifikojn\u00eb shpejt q\u00eb para tyre \u00ebsht\u00eb nj\u00eb grack\u00eb dhe thjesht e injorojn\u00eb at\u00eb. P\u00ebr t\u00eb studiuar taktik\u00ebn e haker\u00ebve modern\u00eb, ne krijuam nj\u00eb honeypot realistik q\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435\u0432\u044b\u0440\u0430\u0437\u0438\u043c\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u0435\u043d: \u043a\u0430\u043a \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0438\u0442\u044c | ProHoster","og:description":"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u044b \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b-\u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u2014 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u044b, \u0447\u0442\u043e\u0431\u044b \u00ab\u043f\u043e\u0439\u043c\u0430\u0442\u044c \u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb \u0441\u0432\u0435\u0436\u0443\u044e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0442\u0430\u043a\u0442\u0438\u043a\u0443. \u0425\u0430\u043d\u0438\u043f\u043e\u0442\u044b \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e, \u0447\u0442\u043e \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u0432\u044b\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0441\u044f \u0441\u0432\u043e\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0439 \u0438\u043c\u043c\u0443\u043d\u0438\u0442\u0435\u0442: \u043e\u043d\u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u044e\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434 \u043d\u0438\u043c\u0438 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044e\u0442 \u0435\u0451. \u0427\u0442\u043e\u0431\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0442\u0430\u043a\u0442\u0438\u043a\u0443 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u044b\u0439 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T17:42:19+00:00","article:modified_time":"2020-10-09T17:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2026-02-08 20:24:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/96228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=96228"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/96228\/revisions"}],"predecessor-version":[{"id":157867,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/96228\/revisions\/157867"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/96229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=96228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=96228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=96228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}