Izinkampani ezilwa nama-antivirus, ochwepheshe bezokuphepha kolwazi kanye nabashisekeli be-honeypot bafaka izinhlelo ze-honeypot ku-inthanethi ukuze "babambe" uhlobo olusha lwaleli gciwane noma bahlonze amaqhinga angajwayelekile abaduni. Izimbiza zoju zivame kakhulu kangangokuthi izigebengu ze-inthanethi zenze uhlobo lokuzivikela: zisheshe zibone ukuthi ziphambi kogibe futhi zivele zinganaki. Ukuhlola amaqhinga ezigebengu zesimanje, sidale i-honeypot engokoqobo ehlala ku-inthanethi izinyanga eziyisikhombisa, iheha ukuhlaselwa okuhlukahlukene. Sixoxe ngokuthi lokhu kwenzeke kanjani esifundweni sethu "" Amanye amaqiniso avela ocwaningweni akulokhu okuthunyelwe.
Ukuthuthukiswa kwe-honeypot: uhlu lokuhlola
Umsebenzi omkhulu ekudaleni i-supertrap yethu bekuwukusivimba ukuthi singavezwa abaduni abakhombise ukuyithakasela. Lokhu kwakudinga umsebenzi omningi:
- Dala inganekwane engokoqobo mayelana nenkampani, okuhlanganisa amagama aphelele nezithombe zabasebenzi, izinombolo zocingo nama-imeyili.
- Ukuqhamuka nokusebenzisa imodeli yengqalasizinda yezimboni ehambisana nenganekwane emayelana nemisebenzi yenkampani yethu.
- Nquma ukuthi yiziphi izinsiza zenethiwekhi ezizofinyeleleka ngaphandle, kodwa ungathatheki ngokuvula izimbobo ezisengozini ukuze kungabonakali njengogibe lwabancelayo.
- Hlela ukubonakala kokuvuza kolwazi mayelana nesistimu esengozini futhi usabalalise lolu lwazi phakathi kwabangase babe abahlaseli.
- Sebenzisa ukuqapha okuhlakaniphile kwemisebenzi yama-hacker engqalasizinda ye-honeypot.
Futhi manje izinto zokuqala kuqala.
Ukudala inganekwane
Izigebengu ze-Cybercriminal sezivele zijwayele ukuhlangana nezimbiza eziningi zoju, ngakho ingxenye ethuthuke kakhulu yazo yenza uphenyo olunzulu lwesistimu ngayinye esengozini ukuze kuqinisekiswe ukuthi akulona ugibe. Ngesizathu esifanayo, sifuna ukuqinisekisa ukuthi i-honeypot yayingelona iqiniso kuphela ngokuklama kanye nezici zobuchwepheshe, kodwa futhi ukudala ukubukeka kwenkampani yangempela.
Ngokuzifaka ezicathulweni ze-Hacker epholile ecatshangelwayo, sithuthukise i-algorithm yokuqinisekisa ezohlukanisa isistimu yangempela kumgibe. Bekuhlanganisa ukusesha amakheli e-IP enkampani ezinhlelweni zesithunzi, ucwaningo lokuhlehlisa emlandweni wamakheli e-IP, ukusesha amagama namagama angukhiye ahlobene nenkampani, kanye nabalingani bayo, nezinye izinto eziningi. Ngenxa yalokho, le nganekwane yabonakala ikholisa futhi iheha.
Sinqume ukubeka ifektri ye-decoy njengendawo encane ye-prototyping boutique yezimboni esebenzela amaklayenti amakhulu kakhulu angaziwa esigabeni sezempi nesezindiza. Lokhu kusikhulule ezinkingeni zomthetho ezihlobene nokusebenzisa umkhiqizo okhona.
Okulandelayo bekumele siqhamuke nombono, inhloso kanye negama lenhlangano. Sanquma ukuthi inkampani yethu izoba yisiqalo nenani elincane labasebenzi, ngamunye wabo ongumsunguli. Lokhu kwengeze ukwethembeka endabeni yesimo esikhethekile sebhizinisi lethu, elivumela ukuthi liphathe amaphrojekthi abucayi kumakhasimende amakhulu nabalulekile. Besifuna inkampani yethu ibonakale ibuthaka ngokombono we-cybersecurity, kodwa ngesikhathi esifanayo kwakusobala ukuthi sasisebenza nezimpahla ezibalulekile kumasistimu okuhlosiwe.
Isithombe-skrini sewebhusayithi ye-honeypot ye-MeTech. Umthombo: Trend Micro
Sikhethe igama elithi MeTech njengegama lenkampani. Isayithi lenziwe ngokusekelwe kusifanekiso samahhala. Izithombe zithathwe emabhange ezithombe, kusetshenziswa ezingathandwa kakhulu futhi zilungiswa ukuze zingabonakali.
Besifuna inkampani ibukeke ingokoqobo, ngakho-ke besidinga ukungeza abasebenzi abanamakhono ochwepheshe afana nephrofayili yomsebenzi. Siqhamuke namagama nobuntu babo bese sizama ukukhetha izithombe emabhange ezithombe ngokwezinhlanga.
Isithombe-skrini sewebhusayithi ye-honeypot ye-MeTech. Umthombo: Trend Micro
Ukuze sigweme ukutholwa, sibheke izithombe zeqembu zekhwalithi enhle esingakhetha kuzo ubuso esibudingayo. Kodwa-ke, sibe sesiyishiya le nketho, njengoba isigebengu esinamandla singasebenzisa ukusesha kwesithombe esihlanekezelwe futhi sithole ukuthi “izisebenzi” zethu zihlala emabhange ezithombe kuphela. Ekugcineni, sasebenzisa izithombe zabantu abangekho ezidalwe kusetshenziswa amanethiwekhi emizwa.
Amaphrofayela ezisebenzi ashicilelwe kusayithi aqukethe ulwazi olubalulekile mayelana namakhono abo obuchwepheshe, kodwa sigweme ukuhlonza izikole ezithile noma amadolobha.
Ukwakha amabhokisi eposi, sasebenzisa iseva yomhlinzeki wokusingatha, bese saqasha izinombolo zocingo ezimbalwa e-United States futhi sazihlanganisa zibe i-PBX ebonakalayo enemenyu yezwi nomshini wokuphendula.
Ingqalasizinda ye-honeypot
Ukuze sigweme ukuchayeka, sinqume ukusebenzisa inhlanganisela yehardware yangempela yezimboni, amakhompyutha aphathekayo kanye nemishini ebonakalayo evikelekile. Uma sibheka phambili, sizosho ukuthi sihlole umphumela wemizamo yethu ngokusebenzisa injini yokusesha ye-Shodan, futhi yabonisa ukuthi i-honeypot ibukeka njengesistimu yezimboni zangempela.
Umphumela wokuskena ibhodwe lezinyosi usebenzisa i-Shodan. Umthombo: Trend Micro
Sisebenzise ama-PLC amane njengehadiwe yesicupho sethu:
- I-Siemens S7-1200,
- amabili AllenBradley MicroLogix 1100,
- I-Omron CP1L.
Lawa ma-PLC akhethelwe ukuthandwa kwawo emakethe yesistimu yokulawula yomhlaba. Futhi isilawuli ngasinye sisebenzisa iphrothokholi yaso, esivumele ukuthi sihlole ukuthi yimaphi ama-PLC azohlaselwa kaningi nokuthi angathakasela noma ngubani ngokomgomo.
Izisetshenziswa "fectory" yethu -trap. Umthombo: Trend Micro
Asizange nje sifake izingxenyekazi zekhompuyutha futhi sizixhume ku-inthanethi. Sihlele isilawuli ngasinye ukuthi senze imisebenzi, okuhlanganisa
- ukuhlanganisa,
- i-burner kanye nokulawula ibhande lokuhambisa,
- i-palletizing usebenzisa i-robotic manipulator.
Futhi ukwenza inqubo yokukhiqiza ibe ngokoqobo, sihlele okunengqondo ukuze siguqule amapharamitha wempendulo ngokungahleliwe, silingise amamotho aqalayo noma amile, nezimbawula ezikhanyisa futhi zivale.
Imboni yethu yayinamakhompiyutha amathathu abonakalayo neyodwa ebonakalayo. Amakhompyutha abonakalayo asetshenziswa ukulawula isitshalo, irobhothi le-palletizer, nanjengendawo yokusebenza kanjiniyela wesoftware we-PLC. Ikhompyutha ephathekayo yasebenza njengeseva yefayela.
Ngaphezu kokuqapha ukuhlaselwa kwama-PLC, besifuna ukuqapha isimo sezinhlelo ezilayishwa kumadivayisi ethu. Ukwenza lokhu, sidale isixhumi esibonakalayo esisivumele ukuthi sinqume ngokushesha ukuthi izimo zama-activator ethu abonakalayo zilungiswe kanjani. Kakade esigabeni sokuhlela, sithole ukuthi kulula kakhulu ukwenza lokhu kusetshenziswa uhlelo lokulawula kunokuhlela okuqondile kokunengqondo yesilawuli. Sivule ukufinyelela kusixhumi esibonakalayo sokuphatha idivayisi se-honeypot yethu nge-VNC ngaphandle kwephasiwedi.
Amarobhothi ezimboni ayingxenye ebalulekile yokukhiqiza okuhlakaniphile kwesimanje. Mayelana nalokhu, sinqume ukwengeza irobhothi nendawo yokusebenza ezenzakalelayo ukuze siyilawule ezintweni zefekthri yethu yokucupha. Ukuze senze "imboni" ibe ngokoqobo ngokwengeziwe, sifake isofthiwe yangempela endaweni yokusebenzela yokulawula, onjiniyela abayisebenzisayo ukuze bahlele ngokuningiliziwe ukuqonda kwerobhothi. Nokho, njengoba amarobhothi ezimboni ngokuvamile atholakala kunethiwekhi yangaphakathi eyodwa, sinqume ukushiya ukufinyelela okungavikelekile nge-VNC kuphela endaweni yokusebenza yokulawula.
Imvelo yeRobotStudio enemodeli ye-3D yerobhothi lethu. Umthombo: Trend Micro
Sifake imvelo yezinhlelo zeRobotStudio kusuka ku-ABB Robotics emshinini obonakalayo onendawo yokusebenza yokulawula irobhothi. Ngemva kokumisa i-RobotStudio, savula ifayela lokulingisa elinerobhothi yethu kulo ukuze isithombe sayo se-3D sibonakale esikrinini. Ngenxa yalokho, i-Shodan nezinye izinjini zokusesha, lapho zithola iseva ye-VNC engavikelekile, izobamba lesi sithombe sesikrini futhi isibonise kulabo abafuna amarobhothi ezimboni anokufinyelela okuvulekile kokulawula.
Iphuzu lalokhu kunakekela emininingwaneni kwakuwukudala ithagethi ekhangayo nengokoqobo yabahlaseli, okuthi uma sebeyitholile, babuyele kuyo njalonjalo.
Indawo yokusebenza yonjiniyela
Ukuze sihlele i-PLC enengqondo, sengeze ikhompuyutha yobunjiniyela kungqalasizinda. Isoftware yezimboni yohlelo lwe-PLC yafakwa kuyo:
- I-TIA Portal yakwa-Siemens,
- I-MicroLogix yesilawuli se-Allen-Bradley,
- I-CX-One ka-Omron.
Sinqume ukuthi indawo yokusebenza yobunjiniyela ngeke ifinyeleleke ngaphandle kwenethiwekhi. Esikhundleni salokho, sisetha igama-mfihlo elifanayo le-akhawunti yomqondisi njengasendaweni yokusebenzela yokulawula irobhothi kanye nendawo yokusebenzela yokulawula ifekthri efinyeleleka ku-inthanethi. Lokhu kumiswa kuvame kakhulu ezinkampanini eziningi.
Ngeshwa, naphezu kwayo yonke imizamo yethu, akekho noyedwa umhlaseli owafika endaweni yokusebenza kanjiniyela.
Iseva yefayela
Besiyidinga njengesiyengo sabahlaseli nanjengendlela yokusekela “umsebenzi” wethu efektri yokukhohlisa. Lokhu kusivumele ukuthi sabelane ngamafayela ne-honeypot yethu sisebenzisa amadivaysi e-USB ngaphandle kokushiya umkhondo kunethiwekhi ye-honeypot. Sifake i-Windows 7 Pro njenge-OS yeseva yefayela, lapho sidale khona ifolda eyabelwe engafundwa futhi ibhalwe yinoma ubani.
Ekuqaleni asizange senze noma iyiphi i-hierarchy yamafolda namadokhumenti kuseva yefayela. Nokho, kamuva sathola ukuthi abahlaseli babeyifunda ngenkuthalo le folda, ngakho-ke sanquma ukuyigcwalisa ngamafayela ahlukahlukene. Ukuze senze lokhu, sibhale umbhalo we-python owakha ifayela lobukhulu obungahleliwe ngesinye sezandiso ezinikeziwe, sakha igama elisekelwe kusichazamazwi.
Iskripthi sokukhiqiza amagama wamafayela akhangayo. Umthombo: Trend Micro
Ngemva kokusebenzisa iskripthi, sithole umphumela esiwufunayo ngendlela yefolda egcwele amafayela anamagama athakazelisa kakhulu.
Umphumela weskripthi. Umthombo: Trend Micro
Imvelo yokuqapha
Ngemva kokuchitha umzamo omkhulu kangaka sidala inkampani engokoqobo, asikwazanga ukwehluleka ukuqapha “izivakashi” zethu. Besidinga ukuthola yonke imininingwane ngesikhathi sangempela ngaphandle kokuthi abahlaseli babone ukuthi bebebukiwe.
Sisebenzise lokhu sisebenzisa ama-adaptha amane e-USB kuya ku-Ethernet, ompompi abane be-SharkTap Ethernet, i-Raspberry Pi 3, nedrayivu yangaphandle enkulu. Umdwebo wethu wenethiwekhi ububukeka kanje:
Umdwebo wenethiwekhi ye-Honeypot enemishini yokuqapha. Umthombo: Trend Micro
Sibeke ompompi abathathu be-SharkTap ukuze kuqashwe yonke ithrafikhi yangaphandle eya ku-PLC, efinyeleleka kuphela kunethiwekhi yangaphakathi. I-SharkTap yesine igade ithrafikhi yezihambeli zomshini obonakalayo osengozini.
I-SharkTap Ethernet Tap kanye ne-Sierra Wireless AirLink RV50 Router. Umthombo: Trend Micro
I-Raspberry Pi yenza ukuthwebula kwethrafikhi nsuku zonke. Sixhume ku-inthanethi sisebenzisa irutha yeselula ye-Sierra Wireless AirLink RV50, evame ukusetshenziswa kumabhizinisi ezimboni.
Ngeshwa, le router ayizange isivumele ukuthi sivimbe ngokukhetha ukuhlasela okungahambisani nezinhlelo zethu, ngakho-ke sengeze i-firewall ye-Cisco ASA 5505 kunethiwekhi ngemodi esobala ukuze senze ukuvinjwa okunomthelela omncane kunethiwekhi.
Ukuhlaziywa kwethrafikhi
I-Tshark ne-tcpdump zifanelekile ukuxazulula ngokushesha izinkinga zamanje, kodwa esimweni sethu amakhono abo ayenganele, njengoba sasinamagigabhayithi amaningi omgwaqo, ahlaziywa abantu abaningana. Sisebenzise i-open-source-Moloch analyzer eyakhiwe yi-AOL. Iqhathaniseka ekusebenzeni ne-Wireshark, kodwa inamakhono amaningi okubambisana, ukuchaza nokumaka amaphakheji, ukuthumela ngaphandle neminye imisebenzi.
Njengoba sasingafuni ukucubungula idatha eqoqiwe kumakhompiyutha e-honeypot, izindawo zokulahlwa kwe-PCAP zazithunyelwa nsuku zonke kusitoreji se-AWS, lapho sesivele sizingenise khona emshinini we-Moloch.
Ukuqoshwa kwesikrini
Ukubhala izenzo zabaduni ku-honeypot yethu, sibhale umbhalo othathe izithombe-skrini zomshini obonakalayo ngesikhathi esithile, futhi, siqhathanisa nesithombe-skrini sangaphambilini, sanquma ukuthi kukhona okwenzekayo lapho noma cha. Lapho umsebenzi utholwa, iskripthi sasihlanganisa ukurekhodwa kwesikrini. Le ndlela ibonakale iphumelela kakhulu. Siphinde sazama ukuhlaziya ithrafikhi ye-VNC kusuka endaweni yokulahla i-PCAP ukuze siqonde ukuthi yiziphi izinguquko ezenzeke ohlelweni, kodwa ekugcineni ukuqoshwa kwesikrini esikusebenzisile kubonakale kulula futhi kubonakala kakhulu.
Ukuqapha izikhathi ze-VNC
Kulokhu sisebenzise i-Chaosreader ne-VNCLogger. Zombili lezi zinsiza zikhipha izinkinobho zokulahla i-PCAP, kodwa i-VNCLogger iphatha okhiye abafana ne-Backspace, Enter, Ctrl ngendlela efanele.
I-VNCLogger inokungalungi okubili. Okokuqala: ingakwazi ukukhipha okhiye kuphela “ngokulalela” ithrafikhi kusixhumi esibonakalayo, ngakho-ke bekufanele silingise iseshini ye-VNC sisebenzisa i-tcpreplay. Ububi besibili be-VNCLogger bujwayelekile nge-Chaosreader: bobabili ababonisi okuqukethwe ebhodini lokunamathisela. Ukwenza lokhu kwakudingeka ngisebenzise i-Wireshark.
Siheha abaduni
Sakha ibhodwe lezinyosi ukuze sihlaselwe. Ukufeza lokhu, senze ukuputshuka kolwazi ukuze sihehe ukunaka kwabangase babe abahlaseli. Amachweba alandelayo avulwe ku-honeypot:
Ichweba le-RDP kudingeke ukuthi livalwe ngemva nje kokuba bukhoma ngoba inani elikhulu lokuskena kwethrafikhi kunethiwekhi yethu lalibangela izinkinga zokusebenza.
Amatheminali e-VNC aqale asebenza ngemodi yokubuka kuphela ngaphandle kwephasiwedi, bese “ngephutha” sawashintshela kumodi yokufinyelela egcwele.
Ukuze sihehe abahlaseli, sithumele okuthunyelwe okubili okunolwazi oluputshuziwe mayelana nesistimu yezimboni etholakalayo ku-PasteBin.
Okunye okuthunyelwe ku-PasteBin ukuheha ukuhlaselwa. Umthombo: Trend Micro
ukuhlasela
I-Honeypot iphile ku-inthanethi cishe izinyanga eziyisikhombisa. Ukuhlasela kokuqala kwenzeke ngenyanga ngemuva kokuthi i-honeypot ixhumeke ku-inthanethi.
Izikena
Kube nethrafikhi eningi evela kumaskena ezinkampani ezaziwayo - ip-ip, Rapid, Shadow Server, Shodan, ZoomEye nezinye. Ayemaningi kakhulu kangangokuthi kudingeke ukuthi singawafaki amakheli awo e-IP ekuhlaziyweni: angu-610 kwangu-9452 noma angu-6,45% awo wonke amakheli e-IP ayingqayizivele ayewezikena ezisemthethweni ngokuphelele.
Ama-Scammers
Enye yezingozi ezinkulu esiye sabhekana nazo ukusetshenziswa kwesistimu yethu ngezinjongo zobugebengu: ukuthenga ama-smartphone nge-akhawunti yobhalisile, ukukhipha amamayela endiza usebenzisa amakhadi esipho nezinye izinhlobo zokukhwabanisa.
Abavukuzi
Omunye wabavakashi bokuqala ohlelweni lwethu uvele waba ngumsebenzi wasemayini. Ukhiphe isofthiwe yezimayini ye-Monero kuyo. Ubengeke akwazi ukwenza imali eningi ohlelweni lwethu oluthile ngenxa yokukhiqiza okuncane. Kodwa-ke, uma sihlanganisa imizamo yeshumi nambili noma amakhulu ezinhlelo ezinjalo, kungahamba kahle kakhulu.
I-Ransomware
Ngesikhathi somsebenzi we-honeypot, sihlangabezane namagciwane wangempela we-ransomware kabili. Okokuqala kwakunguCrysis. Abaqhubi bayo bangene ohlelweni nge-VNC, kodwa base befaka iTeamViewer futhi bayisebenzisela ukwenza ezinye izenzo. Ngemva kokulinda umlayezo wokukhwabanisa ofuna isihlengo se-$ 10 ku-BTC, sangena ekubhaleni izigebengu, sabacela ukuba basuse ukubethela elinye lamafayela kithi. Bavumelana nesicelo futhi baphinda isicelo sesihlengo. Sikwazile ukuxoxisana ngamadola ayizinkulungwane eziyisi-6, ngemva kwalokho savele salayisha kabusha isistimu emshinini obonakalayo, njengoba sithole lonke ulwazi oludingekayo.
I-ransomware yesibili kwavela ukuthi i-Phobos. Isigebengu esilifakile sichithe ihora siphequlula uhlelo lwefayela le-honeypot futhi siskena inethiwekhi, sabe sesifaka i-ransomware.
Ukuhlasela kwe-ransomware kwesithathu kubonakale kuwumgunyathi. “I-hacker” engaziwa ilande ifayela le-haha.bat kusistimu yethu, ngemva kwalokho sabuka isikhashana njengoba izama ukulenza lisebenze. Omunye wemizamo kwaba ukuqamba kabusha i-haha.bat ibe yi-haha.rnsmwr.
"I-hacker" inyusa ubungozi befayela le-bat ngokushintsha isandiso sayo sibe yi-.rnsmwr. Umthombo: Trend Micro
Lapho ifayela le-batch ekugcineni liqala ukusebenza, "umdubuli" walihlela, wakhulisa isihlengo sisuka ku-$200 saya ku-$750. Ngemva kwalokho, "wabhala ngekhodi" wonke amafayela, washiya umlayezo wokukhwabanisa kudeskithophu futhi wanyamalala, eshintsha amagama ayimfihlo ku-VNC yethu.
Ezinsukwini ezimbalwa kamuva, isigebengu sabuya futhi, ukuze sizikhumbuze, sethula ifayela leqoqo elavula amafasitela amaningi ngesayithi lezocansi. Ngokusobala, ngale ndlela wazama ukudonsela ukunakekela esicelweni sakhe.
Imiphumela
Phakathi nocwaningo, kwavela ukuthi ngokushesha nje lapho ulwazi mayelana nokuba sengozini lushicilelwe, i-honeypot yakhanga ukunaka, nomsebenzi okhulayo usuku nosuku. Ukuze ugibe lunakwe, inkampani yethu engelona iqiniso kwadingeka yephule umthetho kaningi. Ngeshwa, lesi simo asivamile neze phakathi kwezinkampani eziningi zangempela ezingenayo i-IT yesikhathi esigcwele kanye nabasebenzi bezokuphepha bolwazi.
Ngokuvamile, izinhlangano kufanele zisebenzise umgomo wokuba amalungelo amancane, kuyilapho sisebenzisa okuphambene ncamashi nawo ukuze zihehe abahlaseli. Futhi isikhathi eside sibuka ukuhlasela, kwaba yinkimbinkimbi kakhulu uma kuqhathaniswa nezindlela ezijwayelekile zokuhlola ukungena.
Futhi okubaluleke kakhulu, konke lokhu kuhlasela bekungeke kuphumelele ukube bekusetshenziswe izinyathelo ezanele zokuphepha lapho kusethwa inethiwekhi. Izinhlangano kufanele ziqinisekise ukuthi amathuluzi azo kanye nezingxenye zengqalasizinda yezimboni azitholakali ku-inthanethi, njengoba senza ngokukhethekile ogibeni lwethu.
Nakuba singazange sirekhode ukuhlasela okukodwa endaweni yokusebenza kanjiniyela, naphezu kokusebenzisa iphasiwedi efanayo yomlawuli wasendaweni kuwo wonke amakhompyutha, lo mkhuba kufanele ugwenywe ukuze kuncishiswe amathuba okuba khona kokungena. Phela, ukuvikeleka okubuthakathaka kusebenza njengesimemo esengeziwe sokuhlasela izinhlelo zezimboni, osekunesikhathi eside zinesithakazelo kuma-cybercriminal.
Source: www.habr.com