{"id":54400,"date":"2019-12-25T00:00:00","date_gmt":"2019-12-24T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii"},"modified":"2020-02-18T14:02:24","modified_gmt":"2020-02-18T11:02:24","slug":"kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","title":{"rendered":"Kinesiska hackers f\u00e5ngade p\u00e5 att kringg\u00e5 tv\u00e5faktorsautentisering","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kinesiska hackers f\u00e5ngade<\/a><\/noindex> p\u00e5 att kringg\u00e5 tv\u00e5faktorsautentisering, men det \u00e4r inte s\u00e4kert. Nedan f\u00f6ljer antaganden fr\u00e5n det nederl\u00e4ndska f\u00f6retaget Fox-IT, som \u00e4r specialiserat p\u00e5 konsulttj\u00e4nster inom cybers\u00e4kerhet. Det antas, utan direkta bevis, att en grupp hackers som f\u00e5tt namnet APT20 arbetar f\u00f6r den kinesiska regeringen.<\/p>\n

\"Kinesiska<\/p>\n

Den f\u00f6rsta g\u00e5ngen hackeraktiviteten som tillskrevs gruppen APT20 uppt\u00e4cktes var 2011. Mellan 2016 och 2017 f\u00f6rsvann gruppen fr\u00e5n experternas radar, men nyligen hittade Fox-IT sp\u00e5r av APT20:s intr\u00e5ng i n\u00e4tverket hos en av sina kunder som bad om att f\u00e5 utreda cybers\u00e4kerhets\u00f6vertr\u00e4delser.<\/p>\n

Enligt Fox-IT har gruppen APT20 under de senaste tv\u00e5 \u00e5ren \u00e4gnat sig \u00e5t intr\u00e5ng och tillg\u00e5ng till data hos statliga institutioner, stora f\u00f6retag och tj\u00e4nsteleverant\u00f6rer i USA, Frankrike, Tyskland, Italien, Mexiko, Portugal, Spanien, Storbritannien och Brasilien. APT20-hackers har \u00e4ven varit aktiva inom omr\u00e5den som flyg, h\u00e4lsov\u00e5rd, finans, f\u00f6rs\u00e4kring, energi och till och med inom omr\u00e5den som spel och elektroniska l\u00e5s.<\/p>\n

<\/center><\/p>\n

Som regel anv\u00e4nde hackarna fr\u00e5n APT20 s\u00e5rbarheter i webbservrar och s\u00e4rskilt i plattformen f\u00f6r f\u00f6retagsapplikationen Jboss f\u00f6r att f\u00e5 \u00e5tkomst till sina offrets system. Efter att ha f\u00e5tt tillg\u00e5ng och installerat shell kunde hackarna navigera inom offrens n\u00e4tverk till alla m\u00f6jliga system. De hittade konton till\u00e4t angriparna att stj\u00e4la data med hj\u00e4lp av standardverktyg, utan att beh\u00f6va installera skadlig programvara. Men det st\u00f6rsta problemet \u00e4r att APT20-gruppen p\u00e5st\u00e5s ha lyckats kringg\u00e5 tv\u00e5faktorsautentiseringen med hj\u00e4lp av tokens.<\/p>\n

\"Kinesiska<\/p>\n

Forskare h\u00e4vdar att de har hittat sp\u00e5r av att hackarna har kopplat upp sig mot VPN-konton som skyddas av tv\u00e5faktorsautentisering. Hur detta gick till kan Fox-IT:s experter endast spekulera i. Det mest sannolika antagandet \u00e4r att hackarna kunde stj\u00e4la den programvarutoken fr\u00e5n RSA SecurID fr\u00e5n det hackade systemet. Med hj\u00e4lp av den stulna programvaran kunde hackarna generera eng\u00e5ngskoder f\u00f6r att kringg\u00e5 tv\u00e5faktorsskyddet.<\/p>\n

Under normala f\u00f6rh\u00e5llanden \u00e4r detta om\u00f6jligt. Den programvarutoken fungerar inte utan att den \u00e4r ansluten till det lokala systemet med h\u00e5rdvarutoken. Utan det ger RSA SecurID-programmet ett felmeddelande. Programvarutoken skapas f\u00f6r ett specifikt system, och genom att ha tillg\u00e5ng till offrets \"h\u00e5rdvara\" kan man f\u00e5 fram ett specifikt nummer f\u00f6r att aktivera programvarutoken.<\/p>\n

\"Kinesiska<\/p>\n

Specialister fr\u00e5n Fox-IT h\u00e4vdar att det inte kr\u00e4vs n\u00e5gon \u00e5tkomst till offret dator eller h\u00e5rdvarutoken f\u00f6r att aktivera (den stulna) programvaru-token. Hela komplexet av inledande verifiering genomf\u00f6rs endast vid import av det initiala vektorn f\u00f6r genereringen \u2013 ett slumpm\u00e4ssigt 128-bitarsnummer som motsvarar det specifika tokenet (SecurID Token Seed<\/a><\/noindex>). Detta nummer har ingen relation till det startnummer som sedan h\u00e4nf\u00f6rs till genereringen av den faktiska programvaru-token. Om verifieringen av SecurID Token Seed kan omg\u00e5s p\u00e5 n\u00e5got s\u00e4tt (genom patchning), s\u00e5 finns det inget f\u00f6r att senare f\u00f6rhindra generering av koder f\u00f6r tv\u00e5faktorsautentisering. Fox-IT p\u00e5st\u00e5r att det g\u00e5r att kringg\u00e5 verifieringen genom att \u00e4ndra bara en instruktion. Efter detta kommer offrets system att vara helt och lagligt \u00f6ppet f\u00f6r angriparen utan anv\u00e4ndning av specialverktyg och gr\u00e4nssnitt.<\/p>\n

<\/p>\n

<\/center><\/p>\n

\t\t\t\t


\n\t\t\t\t\t\t\t\t<\/center>
K\u00e4lla: 3dnews.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u043d\u043e \u044d\u0442\u043e \u043d\u0435 \u0442\u043e\u0447\u043d\u043e. \u041d\u0438\u0436\u0435 \u0431\u0443\u0434\u0443\u0442 \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0433\u043e\u043b\u043b\u0430\u043d\u0434\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Fox-IT, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0443\u0441\u043b\u0443\u0433\u0430\u0445 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0435\u043c\u0443 \u043d\u0435\u0442 \u043f\u0440\u044f\u043c\u044b\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432, \u0447\u0442\u043e \u043d\u0430 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0433\u0440\u0443\u043f\u043f\u0430 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u0438\u043c\u044f APT20. \u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0443\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0435 APT20, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432 2011 \u0433\u043e\u0434\u0443. \u0412 2016–2017 \u0433\u043e\u0434\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54400","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kinesiska hackare f\u00e5ngades p\u00e5 att kringg\u00e5 tv\u00e5faktorsautentisering | ProHoster","description":"Kinesiska hackare f\u00e5ngades p\u00e5 att kringg\u00e5 tv\u00e5faktorsauth.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e\u0439\u043c\u0430\u043b\u0438 \u043d\u0430 \u043e\u0431\u0445\u043e\u0434\u0435 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/kitajskih-hakerov-pojmali-na-obhode-dvuhfaktornoj-avtorizatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-24T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54400","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:13:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:06:38","updated":"2026-01-24 11:13:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/54400","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=54400"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/54400\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=54400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=54400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=54400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}