{"id":77300,"date":"2019-03-29T19:17:11","date_gmt":"2019-03-29T15:17:11","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T20:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/ucnoqta.az\/?p=77300","title":{"rendered":"\u201cKaspersky Lab\u201d<\/b><\/font>: d\u00fcnyada 1 milyondan \u00e7ox istifad\u0259\u00e7i t\u0259hl\u00fck\u0259 alt\u0131ndad\u0131r"},"content":{"rendered":"

“Kaspersky Lab” t\u0259darük z\u0259ncirin\u0259 h\u0259d\u0259fl\u0259nmi\u015f yeni hücum a\u015fkarlay\u0131b.<\/strong><\/p>\n

Ucnoqta.az x\u0259b\u0259r verir ki, “Kaspersky Lab”dan Trend-\u0259 veril\u0259n m\u0259lumata gör\u0259, t\u0259darük z\u0259ncirin\u0259 h\u0259d\u0259fl\u0259nmi\u015f yeni hücum a\u015fkarlay\u0131b. \u015eirk\u0259tin apard\u0131\u011f\u0131 ara\u015fd\u0131rma n\u0259tic\u0259sind\u0259 m\u0259lum olub ki, “ShadowHammer” f\u0131r\u0131ldaqç\u0131lar\u0131n\u0131n \u0259sas h\u0259d\u0259fi onlayn rejimd\u0259 drayverl\u0259ri yenil\u0259y\u0259n ASUS Live Update proqram\u0131n\u0131n istifad\u0259çil\u0259ri olub.<\/p>\n

2018-ci ilin iyun-noyabr aylar\u0131nda hücumçular bu proqram t\u0259minat\u0131na bekdor t\u0259tbiq edibl\u0259r. “Kaspersky Lab” müt\u0259x\u0259ssisl\u0259rinin fikrinc\u0259, bunun n\u0259tic\u0259sind\u0259 dünyada 1 milyondan çox istifad\u0259çinin t\u0259hlük\u0259sizliyi sual alt\u0131nda qal\u0131b.<\/p>\n

T\u0259darük z\u0259ncirin\u0259 h\u0259d\u0259fl\u0259nmi\u015f hücumlar son zamanlar tez-tez istifad\u0259 olunan \u0259n t\u0259hlük\u0259li v\u0259 effektiv yoluxma vektorlar\u0131ndan biridir. Buna nümun\u0259 olaraq “ShadowPad” v\u0259 “CCleane”i misal ç\u0259km\u0259k olar. Bel\u0259 hallarda f\u0131r\u0131ldaqç\u0131lar m\u0259hsulun yaranmas\u0131ndan istifad\u0259çiy\u0259 çatd\u0131\u011f\u0131 ana q\u0259d\u0259r olan m\u0259rh\u0259l\u0259l\u0259rd\u0259 sistemd\u0259 ola bil\u0259c\u0259k çat\u0131\u015fmazl\u0131qlar\u0131 a\u015fkarl\u0131y\u0131r, laz\u0131m olan z\u0259if nöqt\u0259l\u0259ri axtar\u0131rlar. Vendor tamamil\u0259 qoruna bil\u0259r, amma bununla bel\u0259, onun t\u0259darükçüsünün infrastrukturunda z\u0259iflik bütün t\u0259chizat z\u0259ncirl\u0259rin\u0259 z\u0259r\u0259r ver\u0259 bil\u0259r. Bu da m\u0259lumat s\u0131zmas\u0131n\u0131n \u0259sas s\u0259b\u0259bi olur.<\/p>\n

“ShadowHammer” yarad\u0131c\u0131lar\u0131 “ASUS Live Update”i ilkin yoluxma m\u0259nb\u0259yi kimi istifad\u0259 edir. Bu proqram \u0259ks\u0259r yeni ASUS kompüterl\u0259rind\u0259 proqram t\u0259minat\u0131n\u0131n (B\u0130OS, UEF\u0130, t\u0259tbiq v\u0259 drayverl\u0259r daxil olmaqla) avtomatik yenil\u0259nm\u0259si üçün qura\u015fd\u0131r\u0131l\u0131r. Hücumçular “ASUS”un legitim fayllar\u0131 imzalamaq üçün istifad\u0259 etdiyi r\u0259q\u0259msal sertifikatlar\u0131 o\u011furlayaraq, proqram\u0131n köhn\u0259 versiyalar\u0131na z\u0259r\u0259rli kodu t\u0259tbiq edirl\u0259r. Bundan sonra, troyan qura\u015fd\u0131r\u0131lm\u0131\u015f proqramlar qanuni sertifikatlarla imzalan\u0131r v\u0259 “ASUS”un r\u0259smi yenil\u0259nm\u0259 serverl\u0259rind\u0259n yay\u0131l\u0131r. Bu da onlar\u0131 dem\u0259k olar ki, \u0259ks\u0259r müdafi\u0259 h\u0259ll\u0259ri üçün görünm\u0259z edir.<\/p>\n

Müvafiq proqram t\u0259minat\u0131ndan istifad\u0259 ed\u0259n h\u0259r k\u0259sin bu hücumun potensial qurban\u0131na çevrilm\u0259si ehtimal\u0131 oldu\u011fu halda, “ShadowHammer”in yarad\u0131c\u0131lar\u0131n\u0131n \u0259sas m\u0259qs\u0259di konkret bir neç\u0259 yüz cihaz\u0131 \u0259l\u0259 keçirm\u0259k olub. “Kaspersky Lab”in ara\u015fd\u0131rmaç\u0131lar\u0131 a\u015fkar edibl\u0259r ki, h\u0259r bir bekdorun kodu özünd\u0259 mü\u0259yy\u0259n MAC ünvanlar\u0131n\u0131n siyah\u0131s\u0131n\u0131, y\u0259ni unikal identifikasiya kodlar\u0131n\u0131 c\u0259ml\u0259yib. Bunlar \u015f\u0259b\u0259k\u0259 kartlar\u0131na t\u0259tbiq olunur ki, onlar da öz növb\u0259sind\u0259 kompüterin \u015f\u0259b\u0259k\u0259y\u0259 daxil olmas\u0131na z\u0259min yarad\u0131r. Potensial qurban kompüteri i\u015f\u0259 sald\u0131qda is\u0259 f\u0131r\u0131ldaqç\u0131 bu MAC ünvan\u0131n\u0131n siyah\u0131da olub olmad\u0131\u011f\u0131n\u0131 yoxlay\u0131r.<\/p>\n

\u018fg\u0259r siyah\u0131da varsa, o zaman növb\u0259ti z\u0259r\u0259rli kod modulu yükl\u0259nir. \u018fks t\u0259qdird\u0259, bu proqram heç bir f\u0259alliyy\u0259t göst\u0259rmir v\u0259 m\u0259hz buna gör\u0259 hücum uzun müdd\u0259t gözd\u0259n yay\u0131na bilib. Ümumilikd\u0259 ara\u015fd\u0131rmaç\u0131lar siyah\u0131da 600-d\u0259n çox MAC ünvan a\u015fkarlaya bilibl\u0259r. Onlar 230-dan çox unikal z\u0259r\u0259rverici proqram t\u0259minat\u0131n\u0131n h\u0259d\u0259fi olub. Bunlar\u0131n h\u0259r birinin müxt\u0259lif \u015fell-kodu olub.<\/p>\n

Z\u0259r\u0259rli kodun icras\u0131 zaman\u0131 modul yana\u015fma istifad\u0259 olunub v\u0259 kodun v\u0259 ya m\u0259lumatlar\u0131n t\u0259sadüf\u0259n s\u0131zmas\u0131n\u0131n qar\u015f\u0131s\u0131n\u0131 almaq üçün \u0259lav\u0259 t\u0259dbirl\u0259r görülüb. Bu, hücumçular\u0131n a\u015fkarlanmamaq üçün c\u0259rrah d\u0259qiqliyi il\u0259 çal\u0131\u015fd\u0131qlar\u0131n\u0131 göst\u0259rir. D\u0259rin texniki analiz göst\u0259rir ki, ShadowHammer çox inki\u015faf edib v\u0259 qrupda son d\u0259r\u0259c\u0259 yüks\u0259k inki\u015faf s\u0259viyy\u0259sini n\u0259z\u0259rd\u0259 tutur.<\/p>\n

B\u0259nz\u0259r z\u0259r\u0259rli proqram t\u0259minat\u0131n\u0131n axtar\u0131\u015f\u0131 zaman\u0131 Asiya regionunda daha 3 vendorun sistemind\u0259 bekdorlar a\u015fkar olunub. “Kaspersky Lab” “ASUS” v\u0259 dig\u0259r \u015firk\u0259tl\u0259r\u0259 a\u015fkarlanm\u0131\u015f probleml\u0259r bar\u0259d\u0259 m\u0259lumat verib.<\/p>\n

“Seçilmi\u015f \u015firk\u0259tl\u0259r öz geni\u015f mü\u015ft\u0259ri bazalar\u0131 il\u0259 f\u0131r\u0131ldaqç\u0131lar\u0131n h\u0259d\u0259fin\u0259 tu\u015f g\u0259lib. F\u0131r\u0131ldqaç\u0131lar\u0131n m\u0259qs\u0259di bu \u015firk\u0259tl\u0259rin mü\u015ft\u0259ri bazalar\u0131n\u0131 öz m\u0259qs\u0259dl\u0259ri üçün istifad\u0259 etm\u0259kdir. Biz bu hücumun m\u0259qs\u0259dinin n\u0259 oldu\u011funu h\u0259l\u0259 ayd\u0131nla\u015fd\u0131ra bilm\u0259mi\u015fik. H\u0259mçinin bu hücumun arxas\u0131nda kimin durdu\u011fu ara\u015fd\u0131r\u0131l\u0131r. Lakin, sanksiyala\u015fd\u0131r\u0131lmam\u0131\u015f kodun istifad\u0259 olunmas\u0131 üçün t\u0259tbiq olunmu\u015f metodlar v\u0259 dig\u0259r faktlar BAR\u0130UM hücumlar\u0131na aid edil\u0259 bil\u0259r. Bu kampaniya t\u0259darük z\u0259nciri vasit\u0259sil\u0259 h\u0259yata keçiril\u0259n hücumlar\u0131n nec\u0259 ç\u0259tin v\u0259 t\u0259hlük\u0259li oldu\u011funu bir daha sübut edir”- dey\u0259 “Kaspesky Lab”in Asiya-Sakit Okean regionu üzr\u0259 ara\u015fd\u0131rma m\u0259rk\u0259zinin r\u0259hb\u0259ri Vitaliy Kamlyuk bildirib.<\/p>\n

“Kaspersky Lab” “ShadowHammer”in istifad\u0259 etdiyi z\u0259r\u0259rverici proqram t\u0259minat\u0131n\u0131 bloklay\u0131r.
\nHücumlara m\u0259ruz qalmamaq üçün “Kaspersky Lab” a\u015fa\u011f\u0131dak\u0131lar qaydalara riay\u0259t etm\u0259yi tövsiy\u0259 edir:<\/p>\n

Cihaza mütl\u0259q qorumadan ba\u015fqa, h\u0259m d\u0259 korporativ t\u0259hlük\u0259sizlik üçün çoxs\u0259viyy\u0259li h\u0259ll yükl\u0259yin. M\u0259s\u0259l\u0259n, Kaspersky Anti Targeted Attack Platform t\u0259kmill\u0259\u015fdirilmi\u015f hücumlar\u0131 ilkin m\u0259rh\u0259l\u0259d\u0259 a\u015fkarlay\u0131r.<\/p>\n

Cihazlar\u0131n qorunmas\u0131, h\u0259mçinin insidentl\u0259rin a\u015fkarlanmas\u0131, ara\u015fd\u0131r\u0131lmas\u0131 v\u0259 zaman\u0131nda l\u0259\u011fv olunmas\u0131 üçün EDR h\u0259llinin t\u0259tbiq olunmas\u0131 m\u0259sl\u0259h\u0259tdir. Bunun üçün “Kaspersky Endpoint Detection and Response”dan istifad\u0259 etm\u0259k v\u0259 ya müt\u0259x\u0259ssisl\u0259rd\u0259n ibar\u0259t “insidentl\u0259r\u0259 reaksiya” komandas\u0131na müraci\u0259t etm\u0259k laz\u0131md\u0131r.<\/p>\n

\u015e\u0259xsi S\u0130EM sisteml\u0259rinizi v\u0259 dig\u0259r t\u0259hlük\u0259sizlik elemetl\u0259rinizi “t\u0259hlük\u0259l\u0259r bar\u0259d\u0259 m\u0259lumatland\u0131rma” servisin\u0259 inteqrasiya edin ki, daha aktual t\u0259hlük\u0259l\u0259r bar\u0259d\u0259 \u0259trafl\u0131 m\u0259lumat ala bil\u0259siniz.<\/p>\n

“Kaspersky Lab” “ShadowHammer”in hücum kampaniyas\u0131 haqq\u0131nda 9-11 apreld\u0259 Sinqapurda ba\u015f tutacaq “Security Analyst Summit 2019” konferensiyas\u0131nda \u0259trafl\u0131 m\u0259lumat ver\u0259c\u0259k.<\/p>\n","protected":false},"excerpt":{"rendered":"

“Kaspersky Lab” t\u0259darük z\u0259ncirin\u0259 h\u0259d\u0259fl\u0259nmi\u015f yeni hücum a\u015fkarlay\u0131b. Ucnoqta.az x\u0259b\u0259r verir ki, “Kaspersky Lab”dan Trend-\u0259 veril\u0259n m\u0259lumata gör\u0259, t\u0259darük z\u0259ncirin\u0259 h\u0259d\u0259fl\u0259nmi\u015f yeni hücum a\u015fkarlay\u0131b. \u015eirk\u0259tin apard\u0131\u011f\u0131 ara\u015fd\u0131rma n\u0259tic\u0259sind\u0259 m\u0259lum olub…<\/p>\n","protected":false},"author":1,"featured_media":251278,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_lmt_disableupdate":"","_lmt_disable":"","footnotes":""},"categories":[],"tags":[],"class_list":["post-77300","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/ucnoqta.az\/index.php?rest_route=\/wp\/v2\/posts\/77300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ucnoqta.az\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ucnoqta.az\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ucnoqta.az\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ucnoqta.az\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=77300"}],"version-history":[{"count":0,"href":"https:\/\/ucnoqta.az\/index.php?rest_route=\/wp\/v2\/posts\/77300\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ucnoqta.az\/index.php?rest_route=\/wp\/v2\/media\/251278"}],"wp:attachment":[{"href":"https:\/\/ucnoqta.az\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=77300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ucnoqta.az\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=77300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ucnoqta.az\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=77300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}