{"id":96228,"date":"2020-10-09T19:42:19","date_gmt":"2020-10-09T17:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit"},"modified":"2020-10-09T19:42:19","modified_gmt":"2020-10-09T17:42:19","slug":"nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","title":{"rendered":"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/b57d6aa03463566d8f17c4b51246a07e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Kompani t\u00eb antivirusit, ekspert\u00eb t\u00eb siguris\u00eb dhe thjesht entuziast\u00eb krijojn\u00eb sisteme-kap\u00ebse n\u00eb internet \u2014 honeypots, p\u00ebr t\u00eb \"kapur n\u00eb gjall\u00eb\" variante t\u00eb reja t\u00eb virusit ose p\u00ebr t\u00eb zbuluar taktik\u00ebn e pazakont\u00eb t\u00eb haker\u00ebve. Honeypots jan\u00eb kaq t\u00eb zakonshme, saq\u00eb kriminel\u00ebt kibernetik\u00eb kan\u00eb zhvilluar nj\u00eb lloj imuniteti: ata shpejt zbulojn\u00eb se \u00e7far\u00eb \u00ebsht\u00eb kapja dhe thjesht e injorojn\u00eb. P\u00ebr t\u00eb studiuar taktik\u00ebn e hacker\u00ebve modern\u00eb, ne kemi krijuar nj\u00eb honeypot realistik, i cili p\u00ebr shtat\u00eb muaj jetoi n\u00eb internet, duke t\u00ebrhequr sulme t\u00eb ndryshme. Rreth k\u00ebsaj q\u00eb u ndodhi, ne treguam n\u00eb studimin ton\u00eb \"<noindex><a rel=\"nofollow\" href=\"https:\/\/documents.trendmicro.com\/assets\/white_papers\/wp-caught-in-the-act-running-a-realistic-factory-honeypot-to-capture-real-threats.pdf\">Kapur n\u00eb Akt: Drejtimi i nj\u00eb Honeypot Fabrike Realiste p\u00ebr t\u00eb Kapur K\u00ebrc\u00ebnime t\u00eb V\u00ebrteta<\/a><\/noindex>'. Disa fakte nga studimi \u2014 n\u00eb k\u00ebt\u00eb postim. <\/i><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Zhvillimi i Honeypot: lista e kontrollit<\/h3>\n<p>\nQ\u00ebllimi kryesor n\u00eb krijimin e grack\u00ebs son\u00eb super ishte t\u00eb mos lejonim q\u00eb haker\u00ebt q\u00eb treguan interes t\u00eb na zbulonin. P\u00ebr k\u00ebt\u00eb k\u00ebrkoi nj\u00eb pun\u00eb t\u00eb madhe: <\/p>\n<ol>\n<li>T\u00eb krijojm\u00eb nj\u00eb legjend\u00eb realiste p\u00ebr kompanin\u00eb, duke p\u00ebrfshir\u00eb emrat dhe fotot e punonj\u00ebsve, numrat e telefonit dhe email-et.<\/li>\n<li>T\u00eb shpikim dhe realizojm\u00eb nj\u00eb model t\u00eb infrastruktur\u00ebs industriale, i cili i p\u00ebrgjigjet legjend\u00ebs p\u00ebr aktivitetin e kompanis\u00eb son\u00eb. <\/li>\n<li>T\u00eb vendosim cilat sh\u00ebrbime rrjet\u00eb do t\u00eb jen\u00eb t\u00eb disponueshme nga jasht\u00eb, por pa e tepruar me hapjen e porteve t\u00eb cenueshme, n\u00eb m\u00ebnyr\u00eb q\u00eb kjo t\u00eb mos dukej si nj\u00eb grack\u00eb p\u00ebr t\u00eb thjesht\u00eb. <\/li>\n<li>T\u00eb organizojm\u00eb dukshm\u00ebrin\u00eb e rrjedhjes s\u00eb informacionit mbi sistemin e ndjesh\u00ebm dhe t\u00eb shp\u00ebrndajm\u00eb k\u00ebto t\u00eb dh\u00ebna nd\u00ebrmjet sulmuesve potencial\u00eb.<\/li>\n<li>T\u00eb realizojm\u00eb v\u00ebzhgim t\u00eb paduksh\u00ebm mbi veprimet e haker\u00ebve n\u00eb infrastruktur\u00ebn e grack\u00ebs. <\/li>\n<\/ol>\n<p>\nDhe tani, p\u00ebr gjith\u00e7ka nj\u00eb nga nj\u00eb.<\/p>\n<h3><b>Krijojm\u00eb legjend\u00ebn<\/b><\/h3>\n<p>\nKriminel\u00ebt kibernetik\u00eb tashm\u00eb jan\u00eb m\u00ebsuar me faktin se ata ndeshen me shum\u00eb honeypots, prandaj pjesa e tyre m\u00eb e avancuar kryen nj\u00eb k\u00ebrkim t\u00eb thelluar mbi \u00e7do sistem t\u00eb ndjesh\u00ebm, p\u00ebr t\u00eb siguruar se nuk \u00ebsht\u00eb nj\u00eb grack\u00eb. P\u00ebr t\u00eb nj\u00ebjt\u00ebn arsye, ne synonim t\u00eb arrijm\u00eb jo vet\u00ebm realitetin e honeypot nga pik\u00ebpamja e dizajnit dhe aspekteve teknike, por gjithashtu t\u00eb krijojm\u00eb dukshm\u00ebrin\u00eb e nj\u00eb kompanie reale.<\/p>\n<p>Duke vendosim veten n\u00eb vendin e nj\u00eb hacker-i hipotetik, ne zhvilluam nj\u00eb algorit\u00ebm verifikimi q\u00eb do t\u00eb ndihmonte n\u00eb diferencimin e nj\u00eb sistemi t\u00eb v\u00ebrtet\u00eb nga nj\u00eb kurth. Ai p\u00ebrfshinte k\u00ebrkimin e adresave IP t\u00eb kompanis\u00eb n\u00eb sistemet e reputacionit, hulumtimin e historis\u00eb p\u00ebrmbys t\u00eb adresave IP, k\u00ebrkimin e emrave dhe fjal\u00ebve ky\u00e7e t\u00eb lidhura me kompanin\u00eb, si dhe me partner\u00ebt e saj dhe shum\u00eb gj\u00ebra t\u00eb tjera. Si rezultat, legjenda doli t\u00eb ishte mjaft bind\u00ebse dhe t\u00ebrheq\u00ebse.<\/p>\n<p>Ne vendos\u00ebm ta pozicionojm\u00eb fabrik\u00ebn-kurth si nj\u00eb butik t\u00eb vog\u00ebl t\u00eb prototipizimit industrial q\u00eb punon p\u00ebr klient\u00eb shum\u00eb t\u00eb m\u00ebdhenj anonim\u00eb nga segmenti ushtarak dhe aviatik. Kjo na \u00e7liroi nga kompleksitetet juridike t\u00eb lidhura me p\u00ebrdorimin e nj\u00eb marke ekzistuese.<\/p>\n<p>M\u00eb pas, na nevojitej t\u00eb krijonim nj\u00eb vizion, nj\u00eb mision dhe nj\u00eb em\u00ebr p\u00ebr organizat\u00ebn. Ne vendos\u00ebm se kompania jon\u00eb do t\u00eb ishte nj\u00eb startup me nj\u00eb num\u00ebr t\u00eb vog\u00ebl punonj\u00ebsish, secili prej t\u00eb cil\u00ebve ishte themelues. Kjo i shtonte besueshm\u00ebri legjend\u00ebs p\u00ebr specializimin e biznesit ton\u00eb, i cili i lejon at\u00eb t\u00eb punoj\u00eb me projekte delikate p\u00ebr klient\u00eb t\u00eb m\u00ebdhenj dhe t\u00eb r\u00ebnd\u00ebsish\u00ebm. Ne donim q\u00eb kompania jon\u00eb t\u00eb dukej e dob\u00ebt n\u00eb aspektin e siguris\u00eb kibernetike, por n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb t\u00eb ishte e dukshme se ne punonim me aktivet e r\u00ebnd\u00ebsishme n\u00eb sistemet e synuara.<\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/cefb9d754e08689bc4cedc91efa53bdc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Screenshot i faqes s\u00eb internetit t\u00eb honeypot MeTech. Burimi: Trend Micro<\/i><\/p>\n<p>Si em\u00ebr t\u00eb kompanis\u00eb, ne zgjodh\u00ebm fjal\u00ebn MeTech. Uebsajti u b\u00eb nga nj\u00eb shabllon falas. Imazhet i mor\u00ebm nga bankat e fotografive, duke p\u00ebrdorur ato m\u00eb pak t\u00eb njohura dhe duke i p\u00ebrpunuar ato p\u00ebr t'i b\u00ebr\u00eb m\u00eb pak t\u00eb njohura. <\/p>\n<p>Ne donim q\u00eb kompania t\u00eb dukej reale, k\u00ebshtu q\u00eb duhej t\u00eb shtonim punonj\u00ebs me aft\u00ebsi profesionale q\u00eb p\u00ebrputhen me profilin e aktivitetit. Ne i krijuam atyre emra dhe identitete, dhe pastaj p\u00ebrpoq\u00ebm t\u00eb zgjidhim imazhe nga bankat e fotografive sipas p\u00ebrkat\u00ebsis\u00eb etnike. <\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/3b7fa0a8287500349c0a25aa464fee2a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i><i>Screenshot i faqes s\u00eb internetit t\u00eb honeypot MeTech. Burimi: Trend Micro<\/i><\/i><\/p>\n<p>P\u00ebr t\u00eb mos u zbuluar, ne k\u00ebrkuam foto grupi me cil\u00ebsi t\u00eb mir\u00eb, nga t\u00eb cilat mund t\u00eb zgjidhim fytyrat q\u00eb na duheshin. Megjithat\u00eb, m\u00eb pas u t\u00ebrhoq\u00ebm nga kjo opsion, pasi nj\u00eb hacker potencial mund t\u00eb p\u00ebrdorte k\u00ebrkimin p\u00ebrmbys t\u00eb imazheve dhe t\u00eb zbulonte se \"punonj\u00ebsit\" tan\u00eb jetonin vet\u00ebm n\u00eb bankat e fotografive. N\u00eb fund, ne p\u00ebrdor\u00ebm fotografit\u00eb e njer\u00ebzve t\u00eb paekzistuesh\u00ebm, t\u00eb krijuara me an\u00eb t\u00eb rrjeteve nervore.<\/p>\n<p>Profili i punonj\u00ebsve t\u00eb publikuar n\u00eb faqen e internetit p\u00ebrmbante informacion t\u00eb r\u00ebnd\u00ebsish\u00ebm mbi aft\u00ebsit\u00eb e tyre teknike, megjithat\u00eb ne shmangnim p\u00ebrmendjen e institucioneve t\u00eb caktuara arsimore dhe qyteteve.<br \/>\nP\u00ebr t\u00eb krijuar kutit\u00eb e post\u00ebs, ne p\u00ebrdor\u00ebm serverin e ofruesit t\u00eb sh\u00ebrbimit t\u00eb hostimit dhe m\u00eb pas qiram\u00eb disa numra telefoni n\u00eb SHBA, duke i bashkuar ata n\u00eb nj\u00eb sistem virtual t\u00eb telefonat\u00ebs me nj\u00eb menun\u00eb e z\u00eb dhe nj\u00eb p\u00ebrgjigj\u00ebs automat.<\/p>\n<h3><b>Infrastruktura e honeypot<\/b><\/h3>\n<p>\nP\u00ebr t\u00eb shmangur zbulimin, vendos\u00ebm t\u00eb p\u00ebrdorim nj\u00eb kombinim t\u00eb pajisjeve reale industriale, kompjuter\u00ebve fizik\u00eb dhe makinave virtuale t\u00eb mbrojtura. Duke e kaluar p\u00ebrpara, rezultati i p\u00ebrpjekjeve tona u verifikua p\u00ebrmes motorit t\u00eb k\u00ebrkimit Shodan, dhe ai tregoi se honeypoti duket si nj\u00eb sistem industrial real.<\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/77ff6f72dacafcf9326161f2150c91b8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Rezultati i skanimit t\u00eb honeypot me Shodan. Burimi: Trend Micro<\/i><\/p>\n<p>Si \"pajisje\" p\u00ebr grack\u00ebn ton\u00eb p\u00ebrdor\u00ebm kat\u00ebr PLC:<\/p>\n<ul>\n<li> Siemens S7-1200,<\/li>\n<li>dy AllenBradley MicroLogix 1100,<\/li>\n<li>Omron CP1L.<\/li>\n<\/ul>\n<p>\nK\u00ebto PLC u zgjodh\u00ebn p\u00ebr popullaritetin e tyre n\u00eb tregun e sistemeve t\u00eb menaxhimit global. Gjithashtu, \u00e7do nj\u00ebri prej k\u00ebtyre kontrollor\u00ebve p\u00ebrdor nj\u00eb protokoll t\u00eb vetin, q\u00eb na lejoj q\u00eb t\u00eb kontrollojm\u00eb se cila prej PLC do t\u00eb sulmohet m\u00eb shpesh dhe n\u00ebse do t\u00eb interesonte ndok\u00ebnd n\u00eb parim. <\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/f575a4cabd0b38f1af43b8d20cc0a8d4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Pajisjet e \"fabrik\u00ebs\" son\u00eb grack\u00eb. Burimi: Trend Micro<\/i><\/p>\n<p>Ne nuk thjesht vendos\u00ebm pajisjet dhe i lidh\u00ebm ato me internetin. \u00c7do kontrollor e programuam p\u00ebr t\u00eb realizuar detyra, midis t\u00eb cilave ishin<\/p>\n<ul>\n<li>p\u00ebrzierje,<\/li>\n<li>menaxhimi i djeg\u00ebsit dhe brezit transportues,<\/li>\n<li>palletizimi me nj\u00eb manipulues roboti.<\/li>\n<\/ul>\n<p>\nDhe p\u00ebr t\u00eb b\u00ebr\u00eb procesin e prodhimit m\u00eb realist, ne programuam logjik\u00ebn p\u00ebr t\u00eb ndryshuar rast\u00ebsisht parametrat e feedback-ut, duke imituar nisjen dhe ndalimin e motor\u00ebve, duke aktivizuar dhe \u00e7aktivizuar djeg\u00ebsin.<\/p>\n<p>N\u00eb fabrik\u00ebn ton\u00eb kishte tri kompjuter\u00eb virtual\u00eb dhe nj\u00eb fizik. Kompjuter\u00ebt virtual\u00eb p\u00ebrdoren p\u00ebr menaxhimin e fabrik\u00ebs, robotit palletizer dhe si nj\u00eb stacion i pun\u00ebs p\u00ebr inxhinierin programues t\u00eb PLC. Kompjuteri fizik sh\u00ebrbente si server skedari.<\/p>\n<p>P\u00ebrve\u00e7 v\u00ebzhgimit t\u00eb sulmeve ndaj PLC-ve, ne desh\u00ebm t\u00eb kontrollonim gjendjen e programeve t\u00eb ngarkuara n\u00eb pajisjet tona. P\u00ebr k\u00ebt\u00eb, krijuam nj\u00eb nd\u00ebrfaqe q\u00eb lejonte t\u00eb p\u00ebrcaktonim shpejt se si ishin modifikuar gjendjet e mekanizmave t\u00eb ekzekutimit virtual dhe konfigurigimeve tona. Gjat\u00eb faz\u00ebs s\u00eb planifikimit, zbuluam se ishte shum\u00eb m\u00eb e thjesht\u00eb ta realizonim k\u00ebt\u00eb p\u00ebrmes nj\u00eb programi menaxhues sesa p\u00ebrmes programimit t\u00eb drejtp\u00ebrdrejt\u00eb t\u00eb logjik\u00ebs s\u00eb kontrolluesit. Nd\u00ebrfaqes s\u00eb menaxhimit t\u00eb pajisjeve t\u00eb honeypot-it ton\u00eb i hap\u00ebm aksesin p\u00ebrmes VNC pa fjal\u00ebkalim.<\/p>\n<p>Robot\u00ebt industrial\u00eb jan\u00eb komponenti ky\u00e7 i prodhimit t\u00eb avancuar sot. Prandaj, ne vendos\u00ebm t\u00eb shtojm\u00eb nj\u00eb robot dhe nj\u00eb PDS p\u00ebr ta menaxhuar at\u00eb n\u00eb p\u00ebrb\u00ebrjen e pajisjeve t\u00eb fabrik\u00ebs son\u00eb trap. P\u00ebr ta b\u00ebr\u00eb \"fabriken\" m\u00eb realiste, n\u00eb PDS t\u00eb menaxhimit vendos\u00ebm nj\u00eb soft t\u00eb v\u00ebrtet\u00eb, q\u00eb inxhinier\u00ebt e p\u00ebrdorin p\u00ebr programimin grafik t\u00eb logjik\u00ebs s\u00eb robot\u00ebve. Dhe pasi zakonisht robot\u00ebt industrial\u00eb jan\u00eb n\u00eb nj\u00eb rrjet t\u00eb brendsh\u00ebm t\u00eb izoluar, ne vendos\u00ebm t\u00eb l\u00ebm\u00eb aksesin e pa mbrojtur p\u00ebr VNC vet\u00ebm p\u00ebr PDS-n\u00eb e menaxhimit.<\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/157e4891ccf19fb93d3b925309543c9d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Mjedisi RobotStudio me modelin 3D t\u00eb robotit ton\u00eb. Burimi: Trend Micro<\/i><\/p>\n<p>N\u00eb virtual machine me PDS-n\u00eb p\u00ebr menaxhimin e robotit, ne instalua mjedisi i programimit RobotStudio nga ABB Robotics. Pasi setup-i i RobotStudio u p\u00ebrfundua, ne hap\u00ebm skedarin e simulimit me robotin ton\u00eb n\u00eb at\u00eb m\u00ebnyr\u00eb q\u00eb imazhi i tij 3D t\u00eb ishte i duksh\u00ebm n\u00eb ekran. Si rezultat, Shodan dhe motor\u00ebt e tjer\u00eb t\u00eb k\u00ebrkimit, duke zbuluar serverin VNC t\u00eb pa mbrojtur, do t\u00eb marrin k\u00ebt\u00eb imazh nga ekrani dhe do t'u tregojn\u00eb atyre q\u00eb k\u00ebrkojn\u00eb robot\u00eb industrial\u00eb me akses t\u00eb hapur n\u00eb menaxhim. <\/p>\n<p>Q\u00ebllimi i k\u00ebtij v\u00ebmendjeje ndaj detajeve ishte t\u00eb krijonte nj\u00eb objektiv t\u00ebrheq\u00ebs dhe sa m\u00eb realiste p\u00ebr sulmuesit, t\u00eb cil\u00ebt, duke e zbuluar at\u00eb, do t\u00eb ktheheshin vazhdimisht tek ajo.<\/p>\n<p><b><\/p>\n<h3>PDS e inxhinierit<\/h3>\n<p><\/b><br \/>\nP\u00ebr programimin e logjik\u00ebs PLC, ne shtuam nj\u00eb kompjuter inxhinierik n\u00eb infrastruktur\u00eb. N\u00eb t\u00eb instaluam softin industrial p\u00ebr programimin e PLC-s\u00eb:<\/p>\n<ul>\n<li>TIA Portal p\u00ebr Siemens,<\/li>\n<li>MicroLogix p\u00ebr kontrolluesin Allen-Bradley,<\/li>\n<li>CX-One p\u00ebr Omron.<\/li>\n<\/ul>\n<p>\nNe vendos\u00ebm q\u00eb stacioni i pun\u00ebs inxhinierik nuk do t\u00eb jet\u00eb i aksesuesh\u00ebm jasht\u00eb rrjetit. N\u00eb vend t\u00eb k\u00ebsaj, ne vendos\u00ebm nj\u00eb fjal\u00ebkalim t\u00eb nj\u00ebjt\u00eb p\u00ebr llogarin\u00eb e administratorit si n\u00eb ARM-in e menaxhimit t\u00eb robot\u00ebve dhe ARM-in e menaxhimit t\u00eb fabrik\u00ebs, t\u00eb cilat aksesohet p\u00ebrmes internetit. Kjo konfiguracion \u00ebsht\u00eb mjaft e zakonshme n\u00eb shum\u00eb kompani.<br \/>\nFatkeq\u00ebsisht, pavar\u00ebsisht nga p\u00ebrpjekjet tona t\u00eb shumta, asnj\u00eb sulmues nuk arriti t\u00eb hynte n\u00eb ARM-in e inxhinierit.<\/p>\n<h3>Serveri i skedave<\/h3>\n<p>\nAi na duhej si nj\u00eb kurth p\u00ebr sulmuesit dhe si nj\u00eb mjet p\u00ebr rezervimin e \u00abpun\u00ebve\u00bb tona n\u00eb fabrik\u00ebn e kurthit. Kjo na lejoi t\u00eb shk\u00ebmbenim skedar\u00eb me t\u00eb rinjt\u00eb tan\u00eb p\u00ebrmes pajisjeve USB, pa l\u00ebn\u00eb gjurm\u00eb n\u00eb rrjetin e kurthit. Si sistem operative p\u00ebr serverin e skedave ne instaluam Windows 7 Pro, ku krijuam nj\u00eb dosje t\u00eb p\u00ebrbashk\u00ebt, t\u00eb aksesueshme p\u00ebr t\u00eb lexuar dhe shkruar nga kushdo.<\/p>\n<p>Fillimisht nuk b\u00ebm\u00eb asnj\u00eb hierarki dosjesh dhe dokumentesh n\u00eb serverin e skedave. Megjithat\u00eb, m\u00eb von\u00eb u zbulua se sulmuesit po shqyrtonin aktivisht k\u00ebt\u00eb dosje, prandaj vendos\u00ebm ta mbushnim at\u00eb me skedar\u00eb t\u00eb ndrysh\u00ebm. P\u00ebr k\u00ebt\u00eb, shkruam nj\u00eb skript python-i, i cili krijonte nj\u00eb skedar me mbiem\u00ebr t\u00eb rastit me nj\u00eb nga p\u00ebrjashtimet e caktuara, duke formuar emrin mbi baz\u00ebn e nj\u00eb fjalori. <\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/5c1ec2c139d04200849443771b48872a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Skripti p\u00ebr gjenerimin e emrave t\u00ebrheq\u00ebs p\u00ebr skedar\u00ebt. Burimi: Trend Micro<\/i><\/p>\n<p>Pas aktivizimit t\u00eb skriptit, mor\u00ebm rezultatin e nevojsh\u00ebm n\u00eb form\u00ebn e nj\u00eb dosjeje t\u00eb mbushur me skedar\u00eb me emra shum\u00eb interesant\u00eb. <\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/a1842a978ecb400e4390274e202af6f0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Rezultati i pun\u00ebs s\u00eb skriptit. Burimi: Trend Micro<\/i><\/p>\n<p><b><\/p>\n<h3>Mjedisi p\u00ebr monitorim<\/h3>\n<p><\/b><br \/>\nPasi investuam aq shum\u00eb p\u00ebrpjekje n\u00eb krijimin e nj\u00eb kompanie realiste, ne thjesht nuk mund t\u00eb lejonim q\u00eb t\u00eb d\u00ebshtonim n\u00eb mjedisin p\u00ebr monitorimin e \u00abvizitor\u00ebve\u00bb tan\u00eb. Na duhej t\u00eb merrnim t\u00eb gjitha t\u00eb dh\u00ebnat n\u00eb koh\u00eb reale n\u00eb nj\u00eb m\u00ebnyr\u00eb q\u00eb sulmuesit t\u00eb mos e vinin re se ishim duke i v\u00ebzhguar. <\/p>\n<p>Ne e realizuam k\u00ebt\u00eb duke p\u00ebrdorur kat\u00ebr adaptator\u00eb USB-Ethernet, kat\u00ebr deg\u00ebzues Ethernet SharkTap, Raspberry Pi 3 dhe nj\u00eb disk t\u00eb jasht\u00ebm t\u00eb madh. Skema e rrjetit ton\u00eb dukej k\u00ebshtu: <\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/2288c39fa3c4ceee6f5f30dd012de269.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Skema e rrjetit t\u00eb kurthit me pajisje p\u00ebr monitorim. Burimi: Trend Micro<\/i><\/p>\n<p>Tre deg\u00ebzues SharkTap i vendos\u00ebm n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb monitoronim t\u00eb gjith\u00eb trafikun e jasht\u00ebm n\u00eb PLC-t\u00eb, t\u00eb cilat ishin t\u00eb aksesueshme vet\u00ebm nga rrjeti i brendsh\u00ebm. Deg\u00ebzuesi i kat\u00ebrt SharkTap monitoronte trafikun e mysafir\u00ebve t\u00eb makineris\u00eb virtuale t\u00eb cenueshme. <\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/9440a392352b104c27056ee00bc3b2a9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Deg\u00ebzuesi Ethernet SharkTap dhe routeri Sierra Wireless AirLink RV50. Burimi: Trend Micro<\/i><\/p>\n<p>Raspberry Pi ka realizuar kapjen e trafikut p\u00ebr \u00e7do dit\u00eb. Kemi organizuar lidhjen me internetin me an\u00eb t\u00eb router-it celular Sierra Wireless AirLink RV50, i cili p\u00ebrdoret shpesh n\u00eb nd\u00ebrmarrjet industriale. <\/p>\n<p>Fatkeq\u00ebsisht, ky router nuk lejonte bllokimin selektiv t\u00eb sulmeve q\u00eb nuk p\u00ebrputheshin me planet tona, prandaj shtuam n\u00eb rrjet nj\u00eb firewall Cisco ASA 5505 n\u00eb modalitetin transparent p\u00ebr t\u00eb realizuar bllokimet me ndikim minimal n\u00eb rrjet. <\/p>\n<p><b><\/p>\n<h3>Analiza e trafikut<\/h3>\n<p><\/b><br \/>\nTshark dhe tcpdump jan\u00eb t\u00eb p\u00ebrshtatshme p\u00ebr zgjidhjen e shpejt\u00eb t\u00eb \u00e7\u00ebshtjeve aktuale, por n\u00eb rastin ton\u00eb, aft\u00ebsit\u00eb e tyre nuk ishin t\u00eb mjaftueshme, pasi kishim shum\u00eb gigabajt t\u00eb trafikut, analiza e t\u00eb cilit merrej nga disa njer\u00ebz. Ne p\u00ebrdor\u00ebm analizuesin open-source Moloch, i zhvilluar nga AOL. N\u00eb funksionalitet \u00ebsht\u00eb krahasuesh\u00ebm me Wireshark, por ka m\u00eb shum\u00eb mund\u00ebsi p\u00ebr bashk\u00ebpunim, p\u00ebrshkrim dhe etiketimin e paketeve, eksportimin dhe detyra t\u00eb tjera.<\/p>\n<p>Duke qen\u00eb se nuk doja t\u00eb p\u00ebrpunonim t\u00eb dh\u00ebnat e mbledhura n\u00eb kompjuter\u00ebt e honeypot, dump-at e PCAP \u00e7do dit\u00eb u eksportuan n\u00eb ruajtjen AWS, nga ku i importuam n\u00eb makin\u00eb me Moloch. <\/p>\n<h3><b>Regjistrimi i ekranit <\/b><\/h3>\n<p>\nP\u00ebr t\u00eb dokumentuar veprimet e haker\u00ebve n\u00eb honeypot-in ton\u00eb, shkruam nj\u00eb skenar q\u00eb n\u00eb interval t\u00eb caktuar b\u00ebnte screenshot nga makina virtuale dhe, duke krahasuar me screenshot-in e m\u00ebparsh\u00ebm, p\u00ebrcaktonte n\u00ebse ndodh ndonj\u00eb gj\u00eb. Kur zbuloheshin aktivitete, skripti aktivizonte regjistrimin e ekranit. Ky qasje u tregua m\u00eb efektive. Ne gjithashtu p\u00ebrpoq\u00ebm t\u00eb analizojm\u00eb trafikun VNC nga dump-i PCAP p\u00ebr t\u00eb kuptuar se \u00e7far\u00eb ndryshimesh kishin ndodhur n\u00eb sistem, por n\u00eb fund regjistrimi i ekranit q\u00eb realizuam doli m\u00eb i thjesht\u00eb dhe m\u00eb i duksh\u00ebm. <\/p>\n<p><b><\/p>\n<h3>Monitorimi i sesioneve VNC<\/h3>\n<p><\/b><br \/>\nP\u00ebr k\u00ebt\u00eb p\u00ebrdor\u00ebm Chaosreader dhe VNCLogger. T\u00eb dy utilitetet nxjerrin nga dump-i PCAP shtypjet e \u00e7el\u00ebsave, por VNCLogger merret m\u00eb sakt\u00eb me \u00e7el\u00ebsa si Backspace, Enter, Ctrl.<\/p>\n<p>VNCLogger ka dy disavantazhe. E para: ajo mund t\u00eb nxjerr\u00eb \u00e7el\u00ebsat vet\u00ebm duke \"d\u00ebgjuar\" trafikun n\u00eb interface, prandaj na duhet t\u00eb simulojm\u00eb nj\u00eb sesion VNC p\u00ebr t\u00eb me an\u00eb t\u00eb tcpreplay. E dyta \u00ebsht\u00eb e p\u00ebrbashk\u00ebt me Chaosreader: t\u00eb dy nuk tregojn\u00eb p\u00ebrmbajtjen e buferit t\u00eb kopjimit. P\u00ebr k\u00ebt\u00eb na duhej t\u00eb p\u00ebrdorim Wireshark. <\/p>\n<p><b><\/p>\n<h3>T\u00ebrheqim haker\u00ebt<\/h3>\n<p><\/b><br \/>\nKrijuam nj\u00eb honeypot p\u00ebr ta sulmuar. P\u00ebr ta arritur k\u00ebt\u00eb, ne inskenuam nj\u00eb rrjedhje informacioni p\u00ebr t\u00eb t\u00ebrhequr v\u00ebmendjen e potencialeve sulmuesve. N\u00eb honeypot ishin hapur portet e m\u00ebposhtme: <\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/0defa27d76010837c00aa7b97e993ac0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nPorti RDP duhej mbyllur shpejt pas fillimit t\u00eb funksionimit, p\u00ebr shkak t\u00eb sasis\u00eb s\u00eb madhe t\u00eb trafikut t\u00eb skanimit q\u00eb shkaktoi probleme me performanc\u00ebn n\u00eb rrjetin ton\u00eb.<br \/>\nTerminalet VNC fillimisht funksionuan n\u00eb modalitetin \"vet\u00ebm shikim\" pa fjal\u00ebkalim, dhe m\u00eb pas ne \"rast\u00ebsisht\" i kaluam ato n\u00eb modalitetin e qasjes s\u00eb plot\u00eb. <\/p>\n<p>P\u00ebr t\u00eb t\u00ebrhequr sulmuesit, ne publikuan dy postime me informacion \"t\u00eb rrjedhur\" mbi nj\u00eb sistem industrial t\u00eb disponuesh\u00ebm n\u00eb PasteBin.<\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/2db7cc5aa60da13a6bf70a6f5e88a934.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Nj\u00eb nga postimet e publikuara n\u00eb PasteBin p\u00ebr t\u00eb t\u00ebrhequr sulme. Burimi: Trend Micro<\/i><\/p>\n<p><b><\/p>\n<h3>Sulmet<\/h3>\n<p><\/b><br \/>\nHoneypoti ka qen\u00eb online p\u00ebr rreth shtat\u00eb muaj. Sulmi i par\u00eb ndodhi nj\u00eb muaj pas aktivizimit t\u00eb honeypotit. <\/p>\n<p><b>Skaner\u00ebt<\/b><\/p>\n<p>Ishte shum\u00eb trafik nga skanerer t\u00eb kompanive t\u00eb njohura \u2014 ip-ip, Rapid, Shadow Server, Shodan, ZoomEye dhe t\u00eb tjer\u00ebt. Ishin kaq shum\u00eb sa na duhej t'i p\u00ebrjashtonim ata <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sq\/lir\/ipv4\/\"   title=\"Adresa IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"676\">Adresa IP<\/a> nga analiza: 610 nga 9452 ose 6,45% e t\u00eb gjith\u00eb adresave IP unike i takonin skanereve t\u00eb domosdosh\u00ebm.<\/p>\n<p><b>Mashtruesit<\/b><\/p>\n<p>Nj\u00eb nga rreziqet m\u00eb t\u00eb m\u00ebdha q\u00eb na \u00ebsht\u00eb dashur t\u00eb p\u00ebrballemi ishte p\u00ebrdorimi i sistemit ton\u00eb p\u00ebr q\u00ebllime kriminale: p\u00ebr t\u00eb bler\u00eb smartphone p\u00ebrmes fatur\u00ebs s\u00eb abonentit, p\u00ebr t\u00eb konvertuar miljet e linjave ajrore p\u00ebrmes kartave dhurat\u00eb dhe forma t\u00eb tjera mashtrimi.<\/p>\n<p><b>Miner\u00ebt<\/b><\/p>\n<p>Nj\u00eb nga vizitor\u00ebt e par\u00eb t\u00eb sistemit ton\u00eb u zbulua si miner. Ai ngarkoi softuer p\u00ebr minimin e Monero. Nuk do t\u00eb arrinte t\u00eb merrte shum\u00eb nga sistemi yn\u00eb t\u00eb ve\u00e7ant\u00eb p\u00ebr shkak t\u00eb performanc\u00ebs s\u00eb ul\u00ebt. Megjithat\u00eb, n\u00ebse do t\u00eb bashkohej p\u00ebrpjekja e disa dhjet\u00ebra ose madje qindra sistemeve t\u00eb tilla, mund t\u00eb kishte dal\u00eb nj\u00eb rezultat mjaft i mir\u00eb. <\/p>\n<p><b>K\u00ebrkuesit e shp\u00ebrblimeve <\/b><\/p>\n<p>Gjat\u00eb pun\u00ebs s\u00eb honeypot-it, ne u p\u00ebrball\u00ebm dy her\u00eb me viruse ransomware t\u00eb v\u00ebrtet\u00eb. N\u00eb rastin e par\u00eb, ishte Crysis. Operator\u00ebt e tij hyn\u00eb n\u00eb sistem p\u00ebrmes VNC, por m\u00eb pas instaluan TeamViewer dhe me t\u00eb kryen veprimet e tjera. Duke pritur mesazhin e k\u00ebrkes\u00ebs p\u00ebr shp\u00ebrblim prej 10 mij\u00eb dollar\u00ebsh n\u00eb BTC, ne hyjm\u00eb n\u00eb bised\u00eb me kriminel\u00ebt, duke k\u00ebrkuar prej tyre t\u00eb na dekriptojn\u00eb nj\u00eb nga skedar\u00ebt. Ata p\u00ebrmbush\u00ebn k\u00ebrkes\u00ebn dhe p\u00ebrs\u00ebrit\u00ebn k\u00ebrkes\u00ebn p\u00ebr shp\u00ebrblim. Na arriti t\u00eb negociojm\u00eb deri n\u00eb 6 mij\u00eb dollar\u00eb, pas s\u00eb cil\u00ebs thjesht ritakuam sistemin n\u00eb nj\u00eb virtual machine, pasi mor\u00ebm t\u00eb gjith\u00eb informacionin e nevojsh\u00ebm. <\/p>\n<p>Ransomware-i i dyt\u00eb doli t\u00eb ishte Phobos. Hakeri q\u00eb e instaloi at\u00eb n\u00eb nj\u00eb or\u00eb skanoi sistemin e skedar\u00ebve t\u00eb honeypot-it dhe skanoi rrjetin, dhe m\u00eb pas e instaloi ransomware-in. <br \/>\nSulmi i tret\u00eb i ransomware-it doli t\u00eb ishte fals. Nj\u00eb \"haker\" shkarkoi skedarin haha.bat n\u00eb sistemin ton\u00eb, pas s\u00eb cil\u00ebs ne e v\u00ebzhguam p\u00ebr nj\u00eb koh\u00eb t\u00eb gjat\u00eb se si p\u00ebrpiqej ta b\u00ebnte at\u00eb t\u00eb funksiononte. Nj\u00eb nga p\u00ebrpjekjet ishte rinaming-i i haha.bat n\u00eb haha.rnsmwr. <\/p>\n<p><img decoding=\"async\" alt=\"T\u00eb mrekulluesh\u00ebm: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet\" src=\"\/wp-content\/uploads\/2020\/10\/cab8571ce84fd25eed10d3f14ed3bff6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>\"Hakeri\" rriti d\u00ebmshm\u00ebrin\u00eb e skedarit bat duke ndryshuar p\u00ebrfundimin e tij n\u00eb .rnsmwr. Burimi: Trend Micro<\/i><\/p>\n<p>Kur skedari bat p\u00ebrfundimisht filloi t\u00eb ekzekutohej, \"hakeri\" e redaktoi at\u00eb, duke rritur shp\u00ebrblimin nga 200 n\u00eb 750 dollar\u00eb. Pas k\u00ebsaj, ai \"e enkriptoi\" t\u00eb gjith\u00eb skedar\u00ebt, la nj\u00eb mesazh k\u00ebrc\u00ebnimi n\u00eb desktop dhe u zhduk, duke ndryshuar fjal\u00ebkalimet n\u00eb VNC-n\u00eb ton\u00eb. <\/p>\n<p>Pas disa dit\u00ebsh, hakeri u rikthye dhe p\u00ebr t\u00eb na rikujtuar p\u00ebr veten, ekzekutoi skedarin bat, i cili hapte shum\u00eb dritare me nj\u00eb faqe porno. Me sa duket, n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb ai p\u00ebrpiqej t\u00eb t\u00ebrhiqte v\u00ebmendjen p\u00ebr k\u00ebrkes\u00ebn e tij.<\/p>\n<p><b><\/p>\n<h3>P\u00ebrfundime<\/h3>\n<p><\/b><br \/>\nGjat\u00eb hulumtimit u zbulua se sa her\u00eb q\u00eb informatat rreth dob\u00ebsis\u00eb u publikuan, honeypot-i t\u00ebrhoqi v\u00ebmendjen, dhe aktiviteti rritej nga dita n\u00eb dit\u00eb. Q\u00eb kur kapa t\u00ebrheq v\u00ebmendjen, duhej t\u00eb lejohej nj\u00eb s\u00ebr\u00eb shkeljesh t\u00eb siguris\u00eb s\u00eb kompanis\u00eb son\u00eb t\u00eb trilluar. Fatkeq\u00ebsisht, nj\u00eb situat\u00eb e till\u00eb nuk \u00ebsht\u00eb e rrall\u00eb mes shum\u00eb kompanive reale q\u00eb nuk kan\u00eb staf IT-osh dhe sigurie informacioni.<\/p>\n<p>N\u00eb p\u00ebrgjith\u00ebsi, organizatat duhet t\u00eb p\u00ebrdorin parimin e privilegjeve t\u00eb minimizuara, nd\u00ebrsa ne realizuam pik\u00ebrisht t\u00eb kund\u00ebrt\u00ebn p\u00ebr t\u00eb t\u00ebrhequr sulmuesit. Dhe sa m\u00eb gjat\u00eb t\u00eb shihnim sulmet, aq m\u00eb t\u00eb sofistikuara b\u00ebheshin ato krahasuar me metodat standarde t\u00eb testimit t\u00eb penetrimit.<\/p>\n<p>Dhe m\u00eb e r\u00ebnd\u00ebsishmja: t\u00eb gjith\u00eb k\u00ebto sulme do t\u00eb d\u00ebshtonin n\u00ebse do t\u00eb ishin zbatuar masa adekuate sigurie gjat\u00eb konfigurimit t\u00eb rrjetit. Organizatat duhet t\u00eb sigurojn\u00eb q\u00eb pajisjet e tyre dhe komponent\u00ebt e infrastruktur\u00ebs industriale t\u00eb mos jen\u00eb t\u00eb aksesuesh\u00ebm nga interneti, si\u00e7 b\u00ebra ne me q\u00ebllim n\u00eb grack\u00ebn ton\u00eb. <\/p>\n<p>Megjith\u00ebse ne nuk regjistruam asnj\u00eb sulm ndaj ARM-s\u00eb s\u00eb inxhinierit, pavar\u00ebsisht p\u00ebrdorimit t\u00eb s\u00eb nj\u00ebjt\u00ebs fjal\u00ebkalim p\u00ebr administrat\u00ebn lokale n\u00eb t\u00eb gjitha kompjuter\u00ebt, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb shmangim k\u00ebt\u00eb praktik\u00eb p\u00ebr t\u00eb minimizuar mund\u00ebsin\u00eb e dep\u00ebrtimit. Siguria e dob\u00ebt sh\u00ebrben si nj\u00eb ftes\u00eb shtes\u00eb p\u00ebr sulme ndaj sistemeve industriale, t\u00eb cilat prej koh\u00ebsh kan\u00eb t\u00ebrhequr v\u00ebmendjen e kriminel\u00ebve kibernetik\u00eb.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/trendmicro\/blog\/490406\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0418\u0411-\u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u044b \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b-\u043f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u2014 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u044b, \u0447\u0442\u043e\u0431\u044b \u00ab\u043f\u043e\u0439\u043c\u0430\u0442\u044c \u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb \u0441\u0432\u0435\u0436\u0443\u044e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0438\u0440\u0443\u0441\u0430 \u0438\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0442\u0430\u043a\u0442\u0438\u043a\u0443. \u0425\u0430\u043d\u0438\u043f\u043e\u0442\u044b \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e, \u0447\u0442\u043e \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u043e\u0432 \u0432\u044b\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0441\u044f \u0441\u0432\u043e\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0439 \u0438\u043c\u043c\u0443\u043d\u0438\u0442\u0435\u0442: \u043e\u043d\u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u044e\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434 \u043d\u0438\u043c\u0438 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044e\u0442 \u0435\u0451. \u0427\u0442\u043e\u0431\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0442\u0430\u043a\u0442\u0438\u043a\u0443 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u044b\u0439 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041d\u0435\u0432\u044b\u0440\u0430\u0437\u0438\u043c\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u0435\u043d: \u043a\u0430\u043a \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0438\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T17:42:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T17:42:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00ebrjashtuesh\u00ebm t\u00ebrheq\u00ebs: si krijuam nj\u00eb honeypot q\u00eb nuk mund t\u00eb zbulohet | ProHoster","description":"Anti-virus\u00ebt.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435\u0432\u044b\u0440\u0430\u0437\u0438\u043c\u043e \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u0435\u043d: \u043a\u0430\u043a \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0438\u0442\u044c | ProHoster","og:description":"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nevyrazimo-privlekatelen-kak-my-sozdali-hanipot-kotoryj-nelzya-razoblachit","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T17:42:19+00:00","article:modified_time":"2020-10-09T17:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:48:22","updated":"2026-02-08 20:24:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/96228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=96228"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/96228\/revisions"}],"predecessor-version":[{"id":157867,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/96228\/revisions\/157867"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/96229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=96228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=96228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=96228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}