Iinkampani ze-Antivirus, iingcali zokhuseleko lolwazi, kunye nabathandi nje babhengeza iinkqubo ze-honeypot kwi-Intanethi ukuze "babambe isiyeyelo esiphilayo" sohlobo olutsha lwentsholongwane okanye baveze amaqhinga angaqhelekanga e-hacker. I-Honeypots ixhaphake kangangokuba abaphuli be-intanethi baye bahlakulela uhlobo lokuzikhusela: baqaphela ngokukhawuleza ukuba kukho umgibe phambi kwabo kwaye bavele bangayinaki. Ukuphonononga amaqhinga abahlaseli bale mihla, senze i-honeypot enenyani ehlala kwi-Intanethi kangangeenyanga ezisixhenxe, itsala uhlaselo olwahlukeneyo. Bekunjani, sixelele kwisifundo sethu "". Ezinye iinyani zophononongo zikwesi sithuba.
Uphuhliso lwe-Honeypot: Uluhlu lokutshekisha
Umsebenzi oyintloko ekudaleni i-supertrap yethu yayingasivumeli ukuba sibonakaliswe ngabahlaseli ababonise umdla kuyo. Kwathatha umsebenzi omninzi ukwenza oku:
- Yenza intsomi enenyani malunga nenkampani, kubandakanya igama elipheleleyo kunye nefoto yabasebenzi, iinombolo zefowuni kunye nee-imeyile.
- Qamba kwaye uphumeze imodeli yeziseko ezingundoqo zemizi-mveliso ehambelana nentsomi yemisebenzi yenkampani yethu.
- Gqiba ukuba zeziphi iinkonzo zenethiwekhi eziza kufumaneka ngaphandle, kodwa musa ukuqhutyelwa ngokuvula amazibuko asemngciphekweni ukwenzela ukuba kungabonakali njengomgibe we-simps.
- Lungiselela ukubonakala kokuvuza kolwazi malunga nenkqubo esengozini kwaye usasaze olu lwazi phakathi kwabahlaseli abanokubakho.
- Ukuphumeza uhlolo olulumkileyo lwezenzo zabaduni kwisiseko somgibe.
Kwaye ngoku malunga nayo yonke into ngolungelelwano.
Yila ilivo
Izigebengu ze-Cybercriminals sele zijwayele ukubona i-honeypots ezininzi, ngoko ke eyona nxalenye iphambili kakhulu iqhuba uphando olunzulu lwenkqubo nganye esengozini ukuze kuqinisekiswe ukuba oku akusiyo umgibe. Ngesizathu esifanayo, sasifuna ukwenza i-honeypot ingabi yinyani kuphela ngokwemigaqo yoyilo kunye nezobugcisa, kodwa nokudala ukubonakala kwenkampani yangempela.
Ukuzibeka kwindawo ye-coolhacker ye-hypothetical, senze i-algorithm yokuqinisekisa eya kusivumela ukuba sahlule inkqubo yokwenyani kumgibe. Yayiquka ukukhangela iidilesi ze-IP zenkampani kwiinkqubo zodumo, ukubuyisela umva uphando kwimbali yeedilesi ze-IP, ukukhangela amagama kunye namagama angundoqo anxulumene nenkampani, kunye nabalingani bayo, kunye nezinye izinto ezininzi. Ngenxa yoko, le ntsomi iye yakholisa kwaye inomtsalane.
Saye sagqiba ekubeni sibeke umzi-mveliso womgibe njengendawo encinci yeprototyping boutique, esebenzela abathengi abakhulu abangaziwayo abavela kwicandelo lomkhosi kunye nenqwelomoya. Oku kusisindise kwiingxaki zomthetho ezinxulumene nokusebenzisa uphawu olukhoyo.
Okulandelayo, kwafuneka size nombono, injongo kunye negama lombutho. Sagqiba kwelokuba inkampani yethu iya kuba sisiqalo kunye nenani elincinci labasebenzi, elowo engumseki. Oku kongeze ukuthembeka kwintsomi yobungcali beshishini lethu, elivumela ukuba lisebenze ngeeprojekthi ezibuthathaka kubathengi abakhulu nababalulekileyo. Sasifuna ukwenza inkampani yethu ibonakale ibuthathaka ngokwemigaqo yokhuseleko lwe-cyber, kodwa kwangaxeshanye kwacaca ukuba sisebenza kunye nempahla ebalulekileyo kwiinkqubo ekujoliswe kuzo.
Umfanekiso weskrini weMeTech honeypot iwebhusayithi. Umthombo: Trend Micro
Sikhethe igama elithi MeTech njengegama lenkampani. Isiza senziwe ngesiseko setemplate yasimahla. Imifanekiso ithathwe kwii-photobanks, kusetyenziswa ezona zingathandwa kakhulu kwaye zilungiswa ukuze zingabonakali.
Sasifuna ukuba inkampani ibonakale yokwenyani, ngoko ke kwafuneka ukuba songeze abasebenzi abanezakhono zobuchwephesha ezihambelana neprofayile yomsebenzi. Saza namagama kunye nezazisi kubo, kwaye emva koko wazama ukukhetha imifanekiso photobanks ngokobuhlanga.
Umfanekiso weskrini weMeTech honeypot iwebhusayithi. Umthombo: Trend Micro
Ukuze singabhaqwa, siye sajonga iifoto zeqela ezisemgangathweni esinokukhetha kuzo ubuso esibufunayo. Nangona kunjalo, kamva salushiya olu khetho, kuba umntu onokuthi asebenzise i-hacker enokuthi asebenzise ukukhangela umfanekiso ongemva kwaye afumanise ukuba "abasebenzi" bethu bahlala kuphela kwiibhanki zeefoto. Ekugqibeleni, sasebenzisa iifoto zabantu abangekhoyo abadalwe kusetyenziswa inethiwekhi ye-neural.
Iiprofayili zabasebenzi ezipapashwe kwisayithi ziqulethe ulwazi olubalulekileyo malunga nezakhono zabo zobugcisa, kodwa sakuphepha ukucacisa amaziko athile emfundo kunye nezixeko.
Ukwenza iibhokisi zeposi, sasebenzisa iseva yomnikezeli wokusingatha, kwaye emva koko saqesha iinombolo zefowuni ezininzi eUnited States kwaye sizidibanise kwi-PBX ebonakalayo kunye nemenyu yezwi kunye nomatshini wokuphendula.
Isiseko se-Honeypot
Ukunqanda ukuvezwa, sigqibe kwelokuba sisebenzise indibaniselwano yezixhobo zokwenyani zamashishini, iikhompyuter zenyama, kunye noomatshini abakhuselekileyo. Ukujonga phambili, sihlolisise umphumo wemigudu yethu usebenzisa i-injini yokukhangela ye-Shodan, kwaye yabonisa ukuba i-honeypot ibonakala ngathi yinkqubo yokwenene yoshishino.
Isiphumo sokuskena i-honeypot kunye noShodan. Umthombo: Trend Micro
Sisebenzise ii-PLC ezine njenge-hardware yomgibe wethu:
- Siemens S7-1200,
- ezimbini Allen-Bradley MicroLogix 1100s,
- Omron CP1L.
Ezi PLCs zakhethwa ngenxa yokuthandwa kwazo kwimarike yeenkqubo zolawulo lwehlabathi. Kwaye ngamnye kwaba balawuli usebenzisa iprotocol yakhe, eyasivumela ukuba sijonge ukuba yeyiphi i-PLCs enokuthi ihlaselwe rhoqo kwaye ingaba iya kuba nomdla kuye nabani na ngokomgaqo.
Izixhobo "zefektri" yethu ngumgibe. Umthombo: Trend Micro
Asizange nje sifake iziqwenga zentsimbi size sizidibanise ne-Intanethi. Sacwangcisa umlawuli ngamnye ukuba enze imisebenzi, phakathi kwayo kwakukho
- ukuxuba,
- isitshisi kunye nolawulo lwebhanti lokuhambisa,
- ipalletizing usebenzisa ingalo yerobhothi.
Kwaye ukwenza inkqubo yemveliso ibe yeyokwenene, sicwangcise ingqiqo yokutshintsha ngokungenamkhethe iiparamitha zempendulo, ukulinganisa ukuqala kunye nokumisa iimotor, ukucima isitshisi kunye nokucima.
Umzi-mveliso wethu wawuneekhompyutha ezintathu zekhompyutha kunye neyomzimba. Oomatshini ababonakalayo basetyenziswa ukulawula isityalo, i-robot palletizer nanjengendawo yokusebenza yenjineli yesoftware yePLC. Ikhompyuter isebenze njengeseva yefayile.
Ukongeza ekubekeni iliso kuhlaselo kwii-PLCs, besifuna ukubeka esweni ubume beenkqubo ezikhutshelwe kwizixhobo zethu. Ukwenza oku, senze ujongano olusivumelayo ukuba siqonde ngokukhawuleza ukuba ii-activators zethu zenyani kunye nofakelo zilungiswe njani na. Sele sikwinqanaba lokucwangcisa, sifumene ukuba kulula kakhulu ukuphumeza oku ngenkqubo yolawulo kunokusebenzisa inkqubo ethe ngqo yengqiqo yomlawuli. Sivule ukufikelela kwi-interface yolawulo lwesixhobo se-honeypot yethu nge-VNC ngaphandle kwegama lokugqitha.
Iirobhothi zemizi-mveliso yinxalenye ephambili yokwenziwa kobuchule bale mihla. Kulo mba, sagqiba ekubeni songeze irobhothi kunye nendawo yokusebenzela ukuyilawula kwizixhobo zomzi-mveliso wethu womgibe. Ukwenza "ifektri" ibe yinyani ngakumbi, sifakele isoftware yokwenyani kwindawo yokusebenzela yolawulo, esetyenziswa ziinjineli xa kusenziwa igraphical programming yelogic yerobhothi. Ewe, kuba iirobhothi zemizi-mveliso zihlala zibekwe kuthungelwano lwangaphakathi olulodwa, sigqibe kwelokuba sishiye ukufikelela okungakhuselekanga ngeVNC kuphela kwindawo yolawulo.
Indawo yeRobotStudio enemodeli ye-3D yerobhothi yethu. Umthombo: Trend Micro
Kumatshini obonakalayo onendawo yokusebenzela yokulawula irobhothi, sifake indawo yenkqubo yeRobotStudio ukusuka kwi-ABB Robotics. Emva kokuseta iRobotStudio, savula ifayile yokulinganisa kunye nerobhothi yethu kuyo ukuze umfanekiso wayo we-3D ubonakale esikrinini. Ngenxa yoko, uShodan kunye nezinye iinjini zokukhangela, xa befumana iseva yeVNC engakhuselekanga, baya kufumana lo mfanekiso wesikrini kwaye ubonise abo bafuna iirobhothi zoshishino kunye nokufikelela okuvulekileyo kulawulo.
Ingongoma yale ngqalelo kwiinkcukacha yayikukudala into ekujoliswe kuyo ekhangayo kunye neyinyani njengoko kunokwenzeka kubahlaseli abathi, xa beyifumene, babuyele kuyo kwakhona kwaye kwakhona.
Indawo yokusebenza yeNjineli
Ukucwangcisa i-PLC logic, songeze ikhompyutha yobunjineli kwiziseko ezingundoqo. Isoftware yeshishini yenkqubo yePLC yafakwa kuyo:
- I-TIA Portal ye-Siemens,
- I-MicroLogix yomlawuli we-Allen-Bradley,
- CX-Enye kaOmron.
Siye sagqiba kwelokuba indawo yokusebenza yobunjineli ayizukufumaneka ngaphandle kwenethiwekhi. Endaweni yoko, siseta igama eligqithisiweyo leakhawunti yomlawuli kuyo njengakwindawo yokusebenza yerobhothi efikelelekayo kwi-Intanethi kunye nendawo yokusebenzela yolawulo lwasefektri. Olu lungelelwaniso luqhelekile kwiinkampani ezininzi.
Ngelishwa, phezu kwayo yonke imigudu yethu, akukho namnye umhlaseli owafika kwindawo yokusebenzela yenjineli.
Umncedisi Wefayile
Sasiyifuna njengesithiyelo sabangeneleli kwaye njengendlela yokuxhasa "imisebenzi" yethu kumzi-mveliso womgibe. Oku kusivumele ukuba sabelane ngeefayile kunye ne-honeypot yethu usebenzisa izixhobo ze-USB ngaphandle kokushiya umkhondo kwinethiwekhi yomgibe. Njenge-OS yeseva yefayile, sifake iWindows 7 Pro, apho senze khona ifolda ekwabelwana ngayo ukuze kufundwe nokubhalela nabani na.
Ekuqaleni, asizange senze naluphi na uhlobo lweefolda kunye namaxwebhu kwiseva yefayile. Nangona kunjalo, kamva kwavela ukuba abahlaseli babefunda ngenkuthalo le folda, ngoko ke sagqiba ekubeni siyigcwalise ngeefayile ezahlukeneyo. Ukwenza oku, sibhale iscript yepython eyenza ifayile yobungakanani obungahleliweyo kunye nesinye sezandiso ezinikiweyo, senza igama elisekelwe kwisichazi-magama.
Ushicilelo ukuvelisa amagama efayile anomtsalane. Umthombo: Trend Micro
Emva kokuqhuba iskripthi, sifumene isiphumo esifunekayo kwifom yefolda ezaliswe ziifayile ezinamagama anomdla kakhulu.
Isiphumo sombhalo. Umthombo: Trend Micro
Indawo yokubeka iliso
Emva kokuba senze umzamo omkhulu kangaka ekudaleni inkampani enenyani, asikwazanga ukukwazi ukuyijija le ndawo ukuze sibeke iliso βabatyeleliβ bethu. Sasidinga ukufumana yonke idatha ngexesha langempela ngendlela yokuba abahlaseli bangaboni ukuba bajongwe.
Senze oku sisebenzisa i-USB ezine kwiadaptha ze-Ethernet, iimpompo ezine zeSharkTap Ethernet, iRaspberry Pi 3, kunye nedrive enkulu yangaphandle. Umzobo wethu womnatha wawujongeka ngolu hlobo:
Idayagram yenethiwekhi ye-Honeypot enezixhobo zokubeka iliso. Umthombo: Trend Micro
Sibeke iimpompo ezintathu zeSharkTap ngendlela yokubeka esweni zonke iitrafikhi zangaphandle kwi-PLC, zifikeleleka kuphela kwinethiwekhi yangaphakathi. I-SharkTap yesine ilandelele itrafikhi yeendwendwe zomatshini wenyani osesichengeni.
Itephu ye-SharkTap Ethernet kunye ne-Sierra Wireless AirLink RV50 umzila. Umthombo: Trend Micro
I-Raspberry Pi yenza ukubamba i-traffic yemihla ngemihla. Siqhagamshele kwi-Intanethi sisebenzisa i-Sierra Wireless AirLink RV50 umzila weselula, odla ngokusetyenziswa kumashishini oshishino.
Ngelishwa, le router ayizange isivumele ukuba sithintele ngokukhetha uhlaselo olungahambelani nezicwangciso zethu, ngoko songeze i-firewall yeCisco ASA 5505 kuthungelwano kwimowudi ecacileyo ukwenzela ukubhloka ngempembelelo encinci kwinethiwekhi.
Uhlalutyo lwetrafikhi
I-Tshark kunye ne-tcpdump zifanelekile ngokukhawuleza ukusombulula imiba yangoku, kodwa kwimeko yethu amandla abo ayenganelanga, ekubeni sasine-gigabytes ezininzi ze-traffic, ezihlalutywe ngabantu abaninzi. Sisebenzise i-analyzer ye-open-source-Moloch ephuhliswe yi-AOL. Ngokumalunga nokusebenza, ithelekiseka neWireshark, kodwa inokhetho oluninzi lwentsebenziswano, ukuchaza kunye nokuthegiswa kweepakethi, ukuthumela ngaphandle, kunye neminye imisebenzi.
Ekubeni asizange sifune ukucubungula idatha eqokelelweyo kumatshini we-honeypot, i-PCAP yokulahla yathunyelwa ngaphandle kwansuku zonke kwindawo yokugcina i-AWS, ukusuka apho sele siyingenise kumatshini weMoloch.
Ukurekhoda kwesikrini
Ukubhala izenzo zabahlaseli kwi-honeypot yethu, sibhale iskripthi esithatha imifanekiso yesikrini somatshini obonakalayo ngexesha elithile kwaye, xa sithelekisa neskrini sangaphambili, sagqiba ukuba kukho into eyenzekayo apho okanye hayi. Xa umsebenzi ufunyenwe, iskripthi savula ukurekhoda kwesikrini. Le ndlela yangqineka iyeyona iphumelelayo. Siphinde sazama ukuhlalutya i-VNC ye-traffic kwi-PCAP yokulahla ukuze siqonde ukuba zeziphi iinguqu ezenzeke kwinkqubo, kodwa ekugqibeleni, ukurekhodwa kwesikrini esiphunyeziweyo kwaba lula kwaye kubonakala ngakumbi.
Ukubeka iliso kwiiseshoni zeVNC
Kule nto sasebenzisa i-Chaosreader kunye neVNCLogger. Zombini eziluncedo zikhupha izitshixo zokulahla i-PCAP, kodwa i-VNCLogger ibamba izitshixo ezifana ne-Backspace, Ngena, Ctrl ngokuchanekileyo.
I-VNCLogger ineziphene ezimbini. Okokuqala, inokubuyisela kuphela izitshixo "ngokumamela" kwitrafikhi kujongano, ke kuye kwafuneka ukuba silingise iseshoni yeVNC kuyo sisebenzisa i-tcpreplay. I-drawback yesibini ye-VNCLogger iqhelekile nge-Chaosreader: zombini azibonisi imixholo yebhodi eqhotyoshwayo. Kule nto kwafuneka ndisebenzise iWireshark.
Sitsala abahlaseli
Sakha imbiza yobusi ukuba ihlaselwe. Ukufezekisa oku, senze ulwazi oluvuzayo oluyilelwe ukutsala umdla wabo banokuba ngabarhwebi. La mazibuko alandelayo avuliwe kwimbiza yobusi:
I-port ye-RDP kwafuneka ivalwe kungekudala emva kokuqala komsebenzi, kuba ngenxa yobuninzi bezithuthi zokuskena kwinethiwekhi yethu, kwakukho iingxaki zokusebenza.
Iitheminali zeVNC zaqala zasebenza "kwimowudi yokujonga kuphela" ngaphandle kwegama eligqithisiweyo, kwaye emva koko "ngempazamo" sizitshintshele kwimowudi yofikelelo olupheleleyo.
Ukuze sitsale abahlaseli, sithumele izithuba ezibini ngolwazi "oluvuzayo" malunga nenkqubo yoshishino ekhoyo kwi-PasteBin.
Esinye sezithuba ezifakwe kwi-PasteBin ukutsala uhlaselo. Umthombo: Trend Micro
uhlaselo
I-Honeypot yayihlala kwi-intanethi malunga neenyanga ezisixhenxe. Uhlaselo lokuqala lwenzeka kwinyanga emva kokuba i-honeypot ihambe kwi-intanethi.
Iskena
Kwakukho i-traffic eninzi evela kwii-scanners zeenkampani ezaziwayo-ip-ip, i-Rapid, i-Shadow Server, i-Shodan, i-ZoomEye kunye nabanye. Zazininzi kakhulu kangangokuba kwafuneka singabandakanyi iidilesi zabo ze-IP kuhlalutyo: 610 ngaphandle kwe-9452 okanye i-6,45% yazo zonke iidilesi ze-IP ezikhethekileyo yayizezeskena ezisemthethweni ngokupheleleyo.
I-Scammers
Omnye wemingcipheko emikhulu esiye sajongana nayo kukusetyenziswa kwenkqubo yethu ngeenjongo zolwaphulo-mthetho: ukuthenga ii-smartphones ngeakhawunti yomrhumeli, ukukhupha iimayile zeenqwelo moya usebenzisa amakhadi esipho kunye nolunye uhlobo lobuqhophololo.
Abasebenzi basezimayini
Omnye wabatyeleli bokuqala kwinkqubo yethu wabonakala engumsebenzi-mgodini. Wayilayisha ngesoftware yemigodi yeMonero. Ngekhe akwazi ukufumana imali eninzi kwinkqubo yethu ethile ngenxa yokusebenza okuphantsi. Nangona kunjalo, ukuba sidibanisa iinzame zamashumi amaninzi okanye amakhulu eenkqubo ezinjalo, zingahamba kakuhle.
Intlawulelo
Ngexesha lokusebenza kwe-honeypot, sadibana neentsholongwane zangempela ze-ransomware kabini. Kwimeko yokuqala yayinguCrysis. Abaqhubi bakhe bangene kwinkqubo ngeVNC, kodwa emva koko bafaka iTeamViewer kwaye bayisebenzisela ukwenza ezinye izenzo. Emva kokulinda umyalezo wokukhwabanisa ofuna intlawulelo ye-10 yeedola kwi-BTC, sangena kwimbalelwano kunye nabaphuli-mthetho, sibacela ukuba bakhuphe enye yeefayile kuthi. Bavumelana nesicelo sabo baza baphinda intlawulelo. Sikwazile ukurhweba ukuya kuthi ga kwi-6 amawaka eedola, emva koko silayishe nje inkqubo kumatshini obonakalayo, kuba sifumene lonke ulwazi oluyimfuneko.
Iransomware yesibini yaba yiPhobos. I-hacker eyifakile yahamba kwinkqubo yefayile ye-honeypot kwaye yahlola inethiwekhi ngeyure, kwaye yafaka i-ransomware.
Uhlaselo lwesithathu lwe-ransomware luye lwaba lubunyani. "I-hacker" engaziwayo ikhuphe ifayile ye-haha.bat kwinkqubo yethu, emva koko sijonge ixesha elithile njengoko ezama ukuyenza isebenze. Enye inzame yayikukuthiya ngokutsha haha.bat ku haha.rnsmwr.
"IHacker" yonyusa ubugwenxa befayile ye-bat ngokutshintsha ulwandiso lwayo ukuya kwi-.rnsmwr. Umthombo: Trend Micro
Xa ifayile ye-batch ekugqibeleni yaqala ukusebenza, "i-hacker" yayihlela, inyusa intlawulelo ukusuka kwi-200 yeedola ukuya kwi-750 yeedola. Emva koko, "uguqulele" zonke iifayile, washiya umyalezo wokukhwabanisa kwi-desktop kwaye wanyamalala, etshintsha amagama ayimfihlo kwiVNC yethu.
Kwiintsuku ezimbalwa kamva, i-hacker yabuya kwaye, ukuze azikhumbuze, yasungula ifayile yebhetshi eyavula iifestile ezininzi ngesayithi ye-porn. Kuyabonakala ukuba, ngale ndlela wazama ukutsalela ingqalelo kwimfuno yakhe.
Iziphumo
Ngethuba lophononongo, kwavela ukuba ngokukhawuleza ukuba ulwazi malunga nokuba sesichengeni lupapashwe, i-honeypot yatsala ingqalelo, kwaye umsebenzi wakhula imihla ngemihla. Ukuze umgibe utsale umdla, uninzi lolwaphulo lokhuseleko lwenkampani yethu yobuxoki kwafuneka lwenziwe. Ngelishwa, le meko ayiqhelekanga phakathi kweenkampani ezininzi zangempela ezingenayo i-IT yexesha elizeleyo kunye nabasebenzi bokhuseleko lolwazi.
Ngokubanzi, imibutho kufuneka isebenzise umgaqo welona lungelo lincinci, ngelixa siphumeze ngokuchaseneyo ngokupheleleyo ukutsala abahlaseli. Kwaye okukhona sibukele uhlaselo, kokukhona baba nobuchule ngakumbi xa kuthelekiswa neendlela zovavanyo lokungena.
Kwaye okona kubaluleke kakhulu, zonke ezi hlaselo ziya kuba zisilele ukuba amanyathelo afanelekileyo okhuseleko aye aphunyezwa ngexesha lokuseta inethiwekhi. Imibutho kufuneka iqinisekise ukuba izixhobo zayo kunye namacandelo okwakhiwa kwemizi-mveliso ayifumaneki kwi-Intanethi, njengoko senzayo ngokukodwa kumgibe wethu.
Nangona singakhange sirekhode uhlaselo olunye kwindawo yokusebenza yenjineli, nangona kusetyenziswa igama eliyimfihlo lomlawuli wasekhaya kuzo zonke iikhompyuter, lo mkhuba kufuneka uphetshwe ukuze kuncitshiswe amathuba okungena. Emva kwayo yonke loo nto, ukhuseleko olubuthathaka lusebenza njengesimemo esongezelelweyo sokuhlasela iinkqubo zamashishini ekudala zinomdla kuma-cybercriminals.
umthombo: www.habr.com