{"id":96242,"date":"2020-10-09T19:42:33","date_gmt":"2020-10-09T17:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza"},"modified":"2020-10-09T19:42:33","modified_gmt":"2020-10-09T17:42:33","slug":"dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","title":{"rendered":"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>( faleminderit p\u00ebr iden\u00eb e titullit Sergey G. Brester <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/users\/sebres\/\" class=\"user_link\">sebres<\/a><\/noindex>)<\/p>\n<p>T\u00eb dashur koleg\u00eb, q\u00ebllimi i k\u00ebtij artikulli \u00ebsht\u00eb t\u00eb ndaj p\u00ebrvoj\u00ebn e nj\u00eb viti t\u00eb p\u00ebrdorimit testues t\u00eb nj\u00eb klase t\u00eb re t\u00eb zgjidhjeve IDS bazuar n\u00eb teknologjit\u00eb Deception. <\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/f641b6735cf846d12a0081c7709662e7.png\" style=\"display:block;margin: 0 auto;\" \/><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>P\u00ebr t\u00eb ruajtur koherenc\u00ebn logjike t\u00eb materialit, mendoj se \u00ebsht\u00eb e nevojshme t\u00eb fillojm\u00eb me parakushte. Ja, problemi:<\/p>\n<ol>\n<li>Sulmet e drejtuara jan\u00eb lloji m\u00eb i rreziksh\u00ebm i sulmeve, megjith\u00ebse pesh\u00eb e tyre n\u00eb numrin e p\u00ebrgjithsh\u00ebm t\u00eb k\u00ebrc\u00ebnimeve nuk \u00ebsht\u00eb e madhe. <\/li>\n<li>Nj\u00eb mjet efektiv t\u00eb garantuar p\u00ebr mbrojtjen e perimetrave (ose nj\u00eb grup i till\u00eb) ende nuk \u00ebsht\u00eb shpikur. <\/li>\n<li>Si rregull, sulmet e drejtuara kalojn\u00eb n\u00eb disa faza. Kalimi i perimetrave \u00ebsht\u00eb vet\u00ebm nj\u00eb nga fazat fillestare, e cila (mund t\u00eb m\u00eb goditni me gur\u00eb) nuk ka shum\u00eb d\u00ebme p\u00ebr 'viktim\u00ebn' n\u00ebse nuk \u00ebsht\u00eb nj\u00eb sulm DEoS (Destruction of service) (kriptuesit, etj.). E v\u00ebrteta fillon m\u00eb von\u00eb, kur asetet e kapura fillojn\u00eb t\u00eb p\u00ebrdoren p\u00ebr pivotim dhe zhvillimin e sulmit 'n\u00eb thell\u00ebsi', dhe ne nuk e kemi v\u00ebn\u00eb re k\u00ebt\u00eb. <\/li>\n<li>Duke qen\u00eb se fillojm\u00eb t\u00eb p\u00ebrjetojm\u00eb humbje t\u00eb v\u00ebrteta kur kriminel\u00ebt arrijn\u00eb t\u00eb q\u00ebllimet e sulmit (serverat e aplikacioneve, DBMS, depozat e t\u00eb dh\u00ebnave, repositor\u00ebt, element\u00eb t\u00eb infrastruktur\u00ebs s\u00eb kritike), \u00ebsht\u00eb logjike q\u00eb nj\u00eb nga detyrat e sh\u00ebrbimit t\u00eb siguris\u00eb \u00ebsht\u00eb nd\u00ebrprerja e sulmeve para se t\u00eb ndodhin k\u00ebto ngjarje t\u00eb trishtueshme. Por p\u00ebr t\u00eb nd\u00ebrprer\u00eb di\u00e7ka, s\u00eb pari duhet t\u00eb jemi n\u00eb dijeni. Dhe sa m\u00eb par\u00eb \u2013 aq m\u00eb mir\u00eb. <\/li>\n<li>K\u00ebshtu, p\u00ebr menaxhimin e suksessh\u00ebm t\u00eb rreziqeve (dometh\u00ebn\u00eb, p\u00ebr t\u00eb reduktuar d\u00ebmin nga sulmet e drejtuara) \u00ebsht\u00eb kritike t\u00eb kemi mjete q\u00eb sigurojn\u00eb nj\u00eb TTD minimal (koh\u00eb deri n\u00eb zbulim \u2013 koha nga momenti i nd\u00ebrhyrjes deri n\u00eb momentin e zbulimit t\u00eb sulmit). N\u00eb var\u00ebsi t\u00eb industris\u00eb dhe rajonit, kjo periudh\u00eb mesatarisht \u00ebsht\u00eb 99 dit\u00eb n\u00eb SHBA, 106 dit\u00eb n\u00eb rajonin EMEA, 172 dit\u00eb n\u00eb rajonin APAC (M-Trends 2017, A View From the Front Lines, Mandiant). <\/li>\n<li>\u00c7far\u00eb ofron tregu?\n<ul>\n<li>\"Kuti r\u00ebnie\". Nj\u00eb tjet\u00ebr kontroll parandalues, i cili \u00ebsht\u00eb larg nga perfekti. Ekzistojn\u00eb nj\u00eb mori teknikash efektive p\u00ebr zbulimin dhe anashkalimin e kuti r\u00ebnie ose zgjidhjeve t\u00eb whitelisting. Djemt\u00eb nga \"ana e err\u00ebt\" k\u00ebtu jan\u00eb ende nj\u00eb hap p\u00ebrpara. \n<\/li>\n<li>UEBA (sistemat e profilizimit t\u00eb sjelljes dhe identifikimit t\u00eb devijimeve) \u2013 n\u00eb teori mund t\u00eb jet\u00eb shum\u00eb efektiv. Por, sipas mendimit tim, kjo \u00ebsht\u00eb di\u00e7ka q\u00eb ndodhi n\u00eb nj\u00eb t\u00eb ardhme t\u00eb larg\u00ebt. N\u00eb praktik\u00eb \u2013 kjo \u00ebsht\u00eb akoma shum\u00eb e shtrenjt\u00eb, e pasigurt dhe k\u00ebrkon nj\u00eb infrastruktur\u00eb IT dhe sigurie shum\u00eb t\u00eb zhvilluar dhe t\u00eb q\u00ebndrueshme, ku tashm\u00eb ka t\u00eb gjitha mjetet q\u00eb do t\u00eb gjenerojn\u00eb t\u00eb dh\u00ebna p\u00ebr analiz\u00ebn e sjelljes.\n<\/li>\n<li>SIEM \u2013 \u00ebsht\u00eb nj\u00eb mjet i mir\u00eb p\u00ebr hetime, por nuk \u00ebsht\u00eb n\u00eb gjendje t\u00eb shoh\u00eb dhe t\u00eb tregoj\u00eb di\u00e7ka t\u00eb re, origjinale, p\u00ebr shkak se rregullat e korrelacionit jan\u00eb n\u00eb thelb t\u00eb nj\u00ebjtat n\u00ebnshkrime. <\/li>\n<\/ul>\n<p>\n <\/li>\n<li>Si rezultat, ka ardhur koha p\u00ebr nj\u00eb mjet t\u00eb till\u00eb, i cili:\n<ul>\n<li>t\u00eb funksionoj\u00eb me sukses n\u00eb kushte t\u00eb nj\u00eb perimetri tashm\u00eb t\u00eb komprometuar,\n<\/li>\n<li>t\u00eb zbuloj\u00eb sulme t\u00eb suksesshme n\u00eb nj\u00eb periudh\u00eb shum\u00eb af\u00ebr t\u00eb v\u00ebrtet\u00ebs, pavar\u00ebsisht nga mjetet dhe luhatjet q\u00eb p\u00ebrdoren,<\/li>\n<li>t\u00eb mos varet nga n\u00ebnshkrimet\/rregullat\/skenar\u00ebt\/politikat\/profilet dhe gj\u00ebrat e tjera statike,<\/li>\n<li>t\u00eb mos k\u00ebrkoj\u00eb ekzistenc\u00ebn e sasis\u00eb s\u00eb m\u00ebdha t\u00eb dh\u00ebnash dhe burimeve t\u00eb tyre p\u00ebr analizim,<\/li>\n<li>t\u00eb lejoj\u00eb q\u00eb sulmet t\u00eb p\u00ebrcaktohen jo si nj\u00eb lloj risku n\u00eb rezultatet e \"matematik\u00ebs m\u00eb t\u00eb mir\u00eb n\u00eb bot\u00eb, e patentuar dhe prandaj e mbyllur\", e cila k\u00ebrkon hetim t\u00eb m\u00ebtejsh\u00ebm, por praktikisht si nj\u00eb ngjarje binare \u2013 \"Po, po na sulmojn\u00eb\" ose \"Jo, gjith\u00e7ka \u00ebsht\u00eb OK\",<\/li>\n<li>t\u00eb ishte nj\u00eb universale, efikase n\u00eb shkall\u00ebzim dhe realisht e zbatueshme n\u00eb \u00e7do mjedis heterogjen, pavar\u00ebsisht nga topologjia fizike dhe logjike e rrjetit q\u00eb p\u00ebrdoret.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>\nAktualisht, p\u00ebr rolin e nj\u00eb mjeti t\u00eb till\u00eb, pretendojn\u00eb, t\u00eb ashtuquajturat, zgjidhjet e mashtrimit. K\u00ebto jan\u00eb zgjidhje q\u00eb bazohen n\u00eb konceptin e njohur t\u00eb honeypots, por me nj\u00eb nivel realizimi krejt t\u00eb ndrysh\u00ebm. Ky tem\u00eb \u00ebsht\u00eb padyshim n\u00eb rritje tani.<\/p>\n<p>Sipas rezultateve <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gartner.com\/newsroom\/id\/3744917\">Samiti i Menaxhimit t\u00eb Siguris\u00eb dhe Rrezikut Gartner 2017<\/a><\/noindex> Zgjidhjet e mashtrimit jan\u00eb n\u00eb TOP-3 strategjive dhe mjeteve q\u00eb rekomandohet t\u00eb p\u00ebrdoren. <\/p>\n<p>Sipas raportit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tag-cyber.com\/Annual\/2017\/\">Raporti Vjetor mbi Sigurin\u00eb Kibernetike TAG 2017<\/a><\/noindex> Mashtrimi \u00ebsht\u00eb nj\u00eb nga drejtimet kryesore t\u00eb zhvillimit t\u00eb zgjidhjeve IDS (Sistemet e Zbulimit t\u00eb Infiltrimit).<\/p>\n<p>Nj\u00eb seksion i t\u00eb fundit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/security\/security-reports.html\">raporti Cisco mbi gjendjen e Siguris\u00eb IT<\/a><\/noindex>, i kushtohet SCADA, \u00ebsht\u00eb nd\u00ebrtuar mbi t\u00eb dh\u00ebnat e nj\u00eb prej lider\u00ebve t\u00eb k\u00ebtij tregu, TrapX Security (Izrael), zgjidhja e t\u00eb cilit tashm\u00eb nj\u00eb vit funksionon n\u00eb zon\u00ebn ton\u00eb t\u00eb testimit. <\/p>\n<p>TrapX Deception Grid lejon\u00eb t\u00eb nd\u00ebrtosh dhe t\u00eb menaxhosh IDS t\u00eb shp\u00ebrndara masivisht n\u00eb m\u00ebnyr\u00eb qendrore, pa rritur ngarkes\u00ebn e licencave dhe k\u00ebrkesat p\u00ebr burimet harduerike. N\u00eb fakt, TrapX \u00ebsht\u00eb nj\u00eb nd\u00ebrtues q\u00eb lejon krijimin e nj\u00eb mekanizmi t\u00eb madh p\u00ebr zbulojn\u00eb sulmet n\u00eb nivelin e gjithansh\u00ebm t\u00eb nd\u00ebrmarrjes, nj\u00eb lloj \"alarm\" rrjetor t\u00eb shp\u00ebrndar\u00eb. <\/p>\n<h3>Struktura e Zgjidhjes<\/h3>\n<p>\nN\u00eb laboratorin ton\u00eb, ne vazhdimisht studiojm\u00eb dhe testojm\u00eb novitete t\u00eb ndryshme n\u00eb fush\u00ebn e siguris\u00eb IT. Aktualisht jan\u00eb t\u00eb vendosura rreth 50 server\u00eb virtual\u00eb t\u00eb ndrysh\u00ebm, duke p\u00ebrfshir\u00eb komponent\u00ebt e TrapX Deception Grid.<\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/9c9c21101020c1005edc938a3a7ca393.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPra, nga lart posht\u00eb:<\/p>\n<ol>\n<li>TSOC (TrapX Security Operation Console) \u00ebsht\u00eb truri i sistemit. Kjo \u00ebsht\u00eb konsola qendrore e menaxhimit, p\u00ebrmes s\u00eb cil\u00ebs b\u00ebhet konfigurimi, shp\u00ebrndarja e zgjidhjes dhe e gjith\u00eb puna ditore. Si\u00e7 \u00ebsht\u00eb nj\u00eb sh\u00ebrbim n\u00eb web, mund t\u00eb vendoset kudo - n\u00eb perimeter, n\u00eb cloud ose tek ofruesi MSSP. <\/li>\n<li>TrapX Appliance (TSA) \u00ebsht\u00eb nj\u00eb server virtual, n\u00eb t\u00eb cilin lidhim me portin trunk subnetet q\u00eb duam t\u00eb mbikqyrim. Gjithashtu, k\u00ebtu n\u00eb fakt \"jetojn\u00eb\" t\u00eb gjitha sensor\u00ebt tan\u00eb rrjetor\u00eb.\n<p>N\u00eb laboratorin ton\u00eb \u00ebsht\u00eb vendosur nj\u00eb TSA (mwsapp1), por n\u00eb t\u00eb v\u00ebrtet\u00eb mund t\u00eb ket\u00eb shum\u00eb. Kjo mund t\u00eb jet\u00eb e nevojshme n\u00eb rrjeta t\u00eb m\u00ebdha, ku nuk ka lidhshm\u00ebri L2 mes segmenteve (nj\u00eb shembull tipik - \"Holding dhe n\u00ebnnd\u00ebrmarrjet\" ose \"Selia e bank\u00ebs dhe deg\u00ebt\") ose n\u00ebse ka segmente t\u00eb izoluar n\u00eb rrjet, p\u00ebr shembull, ASUTP. N\u00eb secilin filiale\/segment t\u00eb till\u00eb mund t\u00eb vendoset TSA e vet dhe ta lidhim me nj\u00eb TSOC t\u00eb vet\u00ebm, ku t\u00eb gjith\u00eb informacioni do t\u00eb trajtohet qendrorisht. Kjo arkitektur\u00eb lejon nd\u00ebrtimin e sistemeve t\u00eb shp\u00ebrndara t\u00eb mbikqyrjes pa nevoj\u00ebn p\u00ebr ristrukturim t\u00eb thell\u00eb t\u00eb rrjetit ose nd\u00ebrlikimin e segmentimit ekzistues.<\/p>\n<p>Gjithashtu, n\u00eb TSA ne mund t\u00eb d\u00ebrgojm\u00eb nj\u00eb kopje t\u00eb trafikut q\u00eb del p\u00ebrmes TAP\/SPAN. N\u00eb rast se zbulojm\u00eb lidhje me botnetet e njohura, serverat e komand\u00ebs, sesionet TOR, ne gjithashtu do t\u00eb marrim rezultatet n\u00eb konsol\u00eb. K\u00ebt\u00eb e menaxhon Sensor-i i Inteligjenc\u00ebs Rrjetore (NIS). N\u00eb ambientin ton\u00eb, ky funksionalitet \u00ebsht\u00eb realizuar n\u00eb firewall, prandaj k\u00ebtu nuk e kemi p\u00ebrdorur. <\/li>\n<li>Aplikacionet Traps (Sistem t\u00eb Plot\u00eb) \u2013 honeypot tradicional mbi servera Windows. Nuk jan\u00eb t\u00eb nevojshme shum\u00eb, sepse detyra kryesore e k\u00ebtyre serverave \u00ebsht\u00eb t\u00eb ofrojn\u00eb sh\u00ebrbime IT p\u00ebr nivele t\u00eb tjera sensor\u00ebsh ose t\u00eb zbulojn\u00eb sulme n\u00eb aplikacione biznesi q\u00eb mund t\u00eb vendosen n\u00eb mjedisin Windows. N\u00eb laboratorin ton\u00eb kemi instaluar nj\u00eb server t\u00eb till\u00eb (FOS01)\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/8de44215efff4a49f3b773da10185a73.png\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li>Traps t\u00eb emuluara \u2013 komponenti kryesor i zgjidhjes, i cili na lejon q\u00eb me nj\u00eb makin\u00eb virtuale t\u00eb vetme t\u00eb krijojm\u00eb nj\u00eb \"min\u00eb\" shum\u00eb t\u00eb dendur p\u00ebr sulmuesit dhe t\u00eb mbushim rrjetin e nd\u00ebrmarrjes, t\u00eb gjitha vlan-et e saj, me sensor\u00ebt tan\u00eb. Sulmuesi e sheh nj\u00eb sensor t\u00eb till\u00eb, ose host fantazm\u00eb, si nj\u00eb PC ose server Windows t\u00eb v\u00ebrtet\u00eb, nj\u00eb server Linux ose nj\u00eb pajisje tjet\u00ebr q\u00eb ne vendosim t'i tregojm\u00eb.\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/306c21046c5baadd591b66cdfe153ec2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr t\u00eb p\u00ebrfituar dhe p\u00ebr kuriozitet, ne kemi vendosur \"nga \u00e7do lloj dy\" \u2014 PC dhe servera Windows t\u00eb versioneve t\u00eb ndryshme, servera Linux, nj\u00eb ATM me Windows embedded, SWIFT Web Access, printues rrjet, switch Cisco, kamera IP Axis, MacBook, pajisje PLC dhe madje edhe nj\u00eb llamb\u00eb t\u00eb men\u00e7ur. N\u00eb total \u2014 13 host. N\u00eb p\u00ebrgjith\u00ebsi, furnizuesi rekomandon q\u00eb t\u00eb vendosen t\u00eb till\u00eb sensor\u00eb n\u00eb nj\u00eb num\u00ebr minimal prej 10% t\u00eb numrit t\u00eb hosteve reale. Kufiri i sip\u00ebrm \u00ebsht\u00eb hap\u00ebsira e adresave t\u00eb disponueshme. <\/p>\n<p>Nj\u00eb pik\u00eb shum\u00eb e r\u00ebnd\u00ebsishme \u00ebsht\u00eb se \u00e7do host i till\u00eb \u2013 nuk \u00ebsht\u00eb nj\u00eb makin\u00eb virtuale e plot\u00eb, e cila k\u00ebrkon burime dhe licenca. Kjo \u00ebsht\u00eb nj\u00eb \"mashtim\", nj\u00eb emulim, nj\u00eb proces n\u00eb TSA, i cili ka nj\u00eb grup parametrash dhe nj\u00eb adres\u00eb IP. Prandaj, me nj\u00eb TSA t\u00eb vet\u00ebm mund t\u00eb mbushim rrjetin me qindra t\u00eb till\u00eb hostesh fantazm\u00eb, t\u00eb cil\u00ebt do t\u00eb funksionojn\u00eb si sensor\u00eb n\u00eb sistemin e alarmit. Kjo teknologji e b\u00ebn t\u00eb mundur zgjerimin ekonomikisht efikas t\u00eb konceptit t\u00eb \"honeypots\" n\u00eb shkall\u00ebn e \u00e7do nd\u00ebrmarrjeje t\u00eb madhe dhe t\u00eb shp\u00ebrndar\u00eb. <\/p>\n<p>K\u00ebta host\u00eb n\u00eb syt\u00eb e sulmuesit jan\u00eb t\u00ebrheq\u00ebs, sepse p\u00ebrmbajn\u00eb vulnerabilitete dhe duken si q\u00ebllime relativisht t\u00eb lehta. Sulmuesi sheh sh\u00ebrbimet n\u00eb k\u00ebta host\u00eb dhe mund t\u00eb interaktoj\u00eb me to, t'i sulmoj\u00eb ato duke p\u00ebrdorur mjete dhe protokolle standarde (smb\/wmi\/ssh\/telnet\/web\/dnp\/bonjour\/Modbus etj.). Por t\u00eb p\u00ebrdorim k\u00ebta host\u00eb p\u00ebr t\u00eb zhvilluar nj\u00eb sulm ose p\u00ebr t\u00eb nisur kodin e vet nuk \u00ebsht\u00eb e mundur.\n<\/li>\n<li>Kombinimi i k\u00ebtyre dy teknologjive (FullOS dhe grackat e emuluara) lejon t\u00eb arrihet nj\u00eb probabilitet i lart\u00eb statistikor q\u00eb nj\u00eb sulmues do t\u00eb p\u00ebrballet me ndonj\u00eb element t\u00eb rrjetit ton\u00eb t\u00eb sinjalizimit sooner ose later. Por si mund ta b\u00ebjm\u00eb q\u00eb kjo probabilitet t\u00eb jet\u00eb sa m\u00eb af\u00ebr 100%?\n<p>N\u00eb betej\u00eb hyjn\u00eb t\u00eb ashtuquajturat tokene (Deception tokens). Fal\u00eb tyre, ne mund t\u00eb p\u00ebrfshijm\u00eb n\u00eb IDS ton\u00eb t\u00eb shp\u00ebrndar\u00eb t\u00eb gjitha PC-t\u00eb dhe server\u00ebt e nd\u00ebrmarrjes. Tokene vendosen n\u00eb PC-t\u00eb reale t\u00eb p\u00ebrdoruesve. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptohet se tokenet nuk jan\u00eb agjent\u00eb q\u00eb konsumojn\u00eb burime dhe mund t\u00eb shkaktojn\u00eb konflikte. Tokene jan\u00eb element\u00eb informativ\u00eb pasiv\u00eb, nj\u00eb lloj 'buk\u00eb rrugore' p\u00ebr an\u00ebn sulmuese, q\u00eb i \u00e7ojn\u00eb ata n\u00eb grack\u00eb. P\u00ebr shembull, disqet rrjet\u00eb q\u00eb jan\u00eb t\u00eb lidhura, sh\u00ebnimet p\u00ebr admin t\u00eb falsifikuara n\u00eb shfletues dhe fjal\u00ebkalimet e ruajtura p\u00ebr to, sesionet e ruajtura ssh\/rdp\/winscp, grackat tona me komente n\u00eb skedar\u00ebt hosts, fjal\u00ebkalimet e ruajtura n\u00eb kujtes\u00eb, kredencialet e p\u00ebrdoruesve q\u00eb nuk ekzistojn\u00eb, skedar\u00ebt e zyr\u00ebs, hapja e t\u00eb cil\u00ebve do t\u00eb shkaktonte aktivizimin e sistemit, dhe shum\u00eb m\u00eb tep\u00ebr. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, ne e vendosim sulmuesin n\u00eb nj\u00eb ambient t\u00eb deformuar, t\u00eb mbushur me ata vektor\u00eb sulmi q\u00eb n\u00eb t\u00eb v\u00ebrtet\u00eb nuk paraqesin k\u00ebrc\u00ebnim p\u00ebr ne, p\u00ebrkundrazi. Dhe ata nuk kan\u00eb mund\u00ebsi t\u00eb identifikojn\u00eb se ku \u00ebsht\u00eb informacioni i v\u00ebrtet\u00eb dhe ku \u00ebsht\u00eb i rreme. K\u00ebshtu, ne jo vet\u00ebm q\u00eb sigurojm\u00eb identifikimin e shpejt\u00eb t\u00eb sulmit, por gjithashtu e ngadal\u00ebsojm\u00eb ndjesh\u00ebm at\u00eb. <\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/812409dca0c8bc991c7e9812f16d77cf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Shembulli i krijimit t\u00eb nj\u00eb gracke rrjeti dhe konfigurimit t\u00eb tokeneve. Nj\u00eb nd\u00ebrfaqe miq\u00ebsore dhe asnj\u00eb redaktim manual t\u00eb konfigurimeve, skenar\u00ebve etj.<\/i><\/p>\n<p>N\u00eb ambientin ton\u00eb kemi konfiguruar dhe vendosur nj\u00eb s\u00ebr\u00eb tokene n\u00eb FOS01 n\u00ebn menaxhimin e Windows Server 2012R2 dhe PC-s\u00eb testuese n\u00ebn Windows 7. N\u00eb k\u00ebto makina \u00ebsht\u00eb aktivizuar RDP dhe ne her\u00eb pas here i 'dhejm\u00eb' ata n\u00eb DMZ, ku po ashtu jan\u00eb vendosur disa prej sensor\u00ebve tan\u00eb (grackat e emuluara). K\u00ebshtu, ne sigurojm\u00eb nj\u00eb flux t\u00eb vazhduesh\u00ebm incidentesh, p\u00ebr t\u00eb th\u00ebn\u00eb ashtu natyrsh\u00ebm. <\/p>\n<p>K\u00ebshtu, nj\u00eb statistik\u00eb e shkurt\u00ebr p\u00ebr vitin:<\/p>\n<p>56 208 \u2013 incidente jan\u00eb regjistruar,<br \/>\n2 912 \u2013 burime sulmuesish jan\u00eb identifikuar. <\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/0b2404084a997ba5fe4ad33303501612.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Nj\u00eb hart\u00eb interaktive, klikueshme e sulmeve<\/i><\/p>\n<p>Megjithat\u00eb, zgjidhja nuk gjeneron nj\u00eb mega-log ose nj\u00eb rrjedh\u00eb ngjarjesh ku duhet t\u00eb merremi me t\u00eb p\u00ebr nj\u00eb koh\u00eb t\u00eb gjat\u00eb. N\u00eb vend t\u00eb k\u00ebsaj, zgjidhja vet\u00eb klasifikon ngjarjet sipas llojeve t\u00eb tyre dhe lejon ekipin e siguris\u00eb t\u00eb fokusoj\u00eb s\u00eb pari n\u00eb ato m\u00eb t\u00eb rrezikshmet \u2013 kur pala sulmuese p\u00ebrpiqet t\u00eb ngrej\u00eb seanca t\u00eb menaxhimit (interaction) ose kur n\u00eb trafikun ton\u00eb shfaqen payload binar\u00eb (infection). <\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/d0ad109bae7dc0fb80182d43be713d4e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb gjitha informacionet mbi ngjarjet jan\u00eb t\u00eb lexueshme dhe, sipas mendimit tim, paraqiten n\u00eb nj\u00eb format t\u00eb leht\u00eb p\u00ebr t'u kuptuar edhe p\u00ebr p\u00ebrdoruesin me njohuri bazike n\u00eb fush\u00ebn e siguris\u00eb informative. <\/p>\n<p>Shumica e incidenteve t\u00eb regjistruara jan\u00eb p\u00ebrpjekje p\u00ebr skanimin e hosteve tan\u00eb ose lidhje t\u00eb izoluara. <\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/ea87b3592b2d3727815050b9fd1f708e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOse p\u00ebrpjekje p\u00ebr t\u00eb nd\u00ebrruar fjal\u00ebkalimet p\u00ebr RDP.<\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/645b5984d1ffaf31758fb23e9a23c9eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPor kan\u00eb pasur edhe raste m\u00eb interesante, sidomos kur agresor\u00ebt ia kan\u00eb dal\u00eb t\u00eb gjejn\u00eb fjal\u00ebkalimin p\u00ebr RDP dhe t\u00eb fitojn\u00eb qasje n\u00eb rrjetin lokal. <\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/3cde5beadaa306d32c382f66bd67ec33.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAggresori p\u00ebrpiqet t\u00eb ekzekutoj\u00eb kodin duke p\u00ebrdorur psexec.<\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/1356ef44f3581b37c3163ce454fecf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAggresori ka gjetur nj\u00eb sesion t\u00eb ruajtur, i cili e \u00e7oi at\u00eb n\u00eb nj\u00eb kurth si nj\u00eb server Linux. Menj\u00ebher\u00eb pas lidhjes, me nj\u00eb grup t\u00eb paracaktuar komandash, ai p\u00ebrpiqet t\u00eb shkat\u00ebrroj\u00eb t\u00eb gjith\u00eb skedar\u00ebt e regjistrave dhe variablat p\u00ebrkat\u00ebs sistemor.<\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/6d8994cd3bb2268e45540e5bbcdc74a4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAggresori p\u00ebrpiqet t\u00eb kryej\u00eb nj\u00eb sulm SQL-injection n\u00eb kurthin, i cili imiton SWIFT Web Access.<\/p>\n<p>P\u00ebrve\u00e7 k\u00ebtyre sulmeve \"natyrale\", ne kemi kryer edhe disa teste tona. Nj\u00eb nga testet m\u00eb demonstrative \u00ebsht\u00eb testi i koh\u00ebs p\u00ebr zbulimin e nj\u00eb krimbi n\u00eb rrjet. P\u00ebr k\u00ebt\u00eb, ne p\u00ebrdor\u00ebm nj\u00eb mjet nga GuardiCore t\u00eb quajtur <noindex><a rel=\"nofollow\" href=\"http:\/\/www.guardicore.com\/infectionmonkey\/\">Infection Monkey<\/a><\/noindex>. Ky \u00ebsht\u00eb nj\u00eb krimb rrjeti, i cili mund t\u00eb kap\u00eb Windows dhe Linux, por pa ndonj\u00eb \"ngarkes\u00eb\" t\u00eb dobishme. <br \/>\nNe kemi ngritur nj\u00eb qend\u00ebr komandimi lokale, n\u00eb nj\u00eb nga makina kemi nisur exemplarin e par\u00eb t\u00eb krimbit dhe mor\u00ebm njoftimin e par\u00eb n\u00eb konsol\u00ebn TrapX p\u00ebr m\u00eb pak se nj\u00eb minut\u00eb e gjysm\u00eb. TTD 90 sekonda p\u00ebrball\u00eb 106 dit\u00ebve n\u00eb mes\u2026 <\/p>\n<p>Fal\u00eb mund\u00ebsis\u00eb p\u00ebr t'u integruar me klasat e tjera t\u00eb zgjidhjeve, ne mund t\u00eb kalojm\u00eb nga zbulimi i shpejt\u00eb t\u00eb k\u00ebrc\u00ebnimeve n\u00eb p\u00ebrgjigje automatike ndaj tyre. <\/p>\n<p>P\u00ebr shembull, integrimi me sistemet NAC (Kontrolli i Qasjes n\u00eb Rrjet) ose me CarbonBlack do t\u00eb lejoj\u00eb automatikisht shk\u00ebputjen e kompjuter\u00ebve t\u00eb komprometuar nga rrjeti. <\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/4364d6374b57e5741e33f8981b4cb0ad.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIntegrimi me sandboxes lejon automatikisht d\u00ebrgimin p\u00ebr analiz\u00eb t\u00eb skedar\u00ebve t\u00eb p\u00ebrfshir\u00eb n\u00eb sulm. <\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/c66b8051d0dbd31c1215329d1b55930b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Integrimi me McAfee<\/h3>\n<p>\nZgjidhja gjithashtu ka sistemin e saj t\u00eb integruar p\u00ebr korrelacionin e ngjarjeve.<\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/d4030212690f3ee1f1a641c49bc90960.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPor ne nuk ishim t\u00eb k\u00ebnaqur me mund\u00ebsit\u00eb e saj, prandaj e integrojm\u00eb me HP ArcSight.<\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/f08d607c5b4abf8dc354f65ed2591ebc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNj\u00eb sistem i integruar i biletave ndihmon n\u00eb p\u00ebrballimin e k\u00ebrc\u00ebnimeve t\u00eb zbuluara \"me gjith\u00eb bot\u00ebn\".<\/p>\n<p><img decoding=\"async\" alt=\"Dob\u00ebsia si mjet sigurie \u2013 2, ose si t\u00eb kapni APT \u201cme karrem t\u00eb gjall\u00eb\u201d\" src=\"\/wp-content\/uploads\/2020\/10\/0e78fa59b2f2b114fa9bdf572f37ea96.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDuke qen\u00eb se zgjidhja \"nga fillimi\" u zhvillua p\u00ebr nevojat e institucioneve shtet\u00ebrore dhe segmentit t\u00eb madh t\u00eb korporatave, natyrisht \u00ebsht\u00eb implementuar nj\u00eb model i rolit t\u00eb aksesit, integrimi me AD, nj\u00eb sistem i zhvilluar raportoresh dhe ngjarjesh (njoftime t\u00eb ngjarjeve), orkestrimi p\u00ebr strukturat e m\u00ebdha t\u00eb mbajtjes ose ofruesit MSSP. <\/p>\n<h3>N\u00eb vend t\u00eb p\u00ebrmbledhjes<\/h3>\n<p>\nN\u00ebse ekziston nj\u00eb sistem i till\u00eb monitorimi, i cili, figurativisht, na mbulon prapa, at\u00ebher\u00eb kompromisi i perimetrin vet\u00ebm fillon. E r\u00ebnd\u00ebsishmja \u00ebsht\u00eb se krijohet mund\u00ebsia reale p\u00ebr t\u00eb luftuar kund\u00ebr incidenteve t\u00eb siguris\u00eb, dhe jo thjesht p\u00ebr t\u00eb pastruar pasojat e tyre.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/softline\/blog\/413893\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G. Brester sebres) \u041a\u043e\u043b\u043b\u0435\u0433\u0438, \u0446\u0435\u043b\u044c\u044e \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0433\u043e\u0434\u0438\u0447\u043d\u043e\u0439 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 IDS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Deception-\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439. \u0427\u0442\u043e\u0431\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u0441\u0447\u0438\u0442\u0430\u044e \u043d\u0443\u0436\u043d\u044b\u043c \u043d\u0430\u0447\u0430\u0442\u044c \u0441 \u043f\u0440\u0435\u0434\u043f\u043e\u0441\u044b\u043b\u043e\u043a. \u0418\u0442\u0430\u043a, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0442\u0438\u043a\u0430: \u041d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u2013 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0432\u0438\u0434 \u0430\u0442\u0430\u043a, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432 \u043e\u0431\u0449\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0433\u0440\u043e\u0437 \u0438\u0445 \u0443\u0434\u0435\u043b\u044c\u043d\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0414\u044b\u0440\u0430 \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2013 2, \u0438\u043b\u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u044c APT \u00ab\u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T17:42:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T17:42:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aty ku \u00ebsht\u00eb hap\u00ebsira si nj\u00eb veg\u00ebl sigurie \u2013 2, ose si t\u00eb kapim APT \"me gjall\u00eb\" | ProHoster","description":"(faleminderit Sergey G p\u00ebr iden\u00eb e titullit.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u044b\u0440\u0430 \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2013 2, \u0438\u043b\u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u044c APT \u00ab\u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb | ProHoster","og:description":"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T17:42:33+00:00","article:modified_time":"2020-10-09T17:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:47:24","updated":"2022-10-03 07:10:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/96242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=96242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/96242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/96243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=96242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=96242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=96242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}