{"id":2543,"date":"2023-07-18T10:53:48","date_gmt":"2023-07-18T10:53:48","guid":{"rendered":"https:\/\/chuyendoiso.haiphong.gov.vn\/?p=2543"},"modified":"2024-04-23T10:58:05","modified_gmt":"2024-04-23T10:58:05","slug":"tin-tac-nham-muc-tieu-toi-cac-thiet-bi-linux-va-iot-de-phuc-vu-viec-dao-tien-so","status":"publish","type":"post","link":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/2023\/07\/18\/tin-tac-nham-muc-tieu-toi-cac-thiet-bi-linux-va-iot-de-phuc-vu-viec-dao-tien-so\/","title":{"rendered":"Tin t\u1eb7c nh\u1eafm m\u1ee5c ti\u00eau t\u1edbi c\u00e1c thi\u1ebft b\u1ecb Linux v\u00e0 IoT \u0111\u1ec3 ph\u1ee5c v\u1ee5 vi\u1ec7c \u0111\u00e0o ti\u1ec1n s\u1ed1"},"content":{"rendered":"
<\/p>\n
\"\"<\/a><\/div>\n

<\/p>\n

\n

V\u1eeba qua, Microsoft \u0111\u00e3 \u0111\u01b0a ra c\u00e1c th\u00f4ng tin r\u1eb1ng c\u00e1c nh\u00f3m tin t\u1eb7c \u0111ang th\u1ef1c hi\u1ec7n c\u00e1c chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng m\u1ea1ng nh\u1eafm t\u1edbi c\u00e1c thi\u1ebft b\u1ecb ch\u1ea1y h\u1ec7 \u0111i\u1ec1u h\u00e0nh Linux v\u00e0 IoT \u0111\u1ec3 \u0111\u00e1nh c\u1eafp t\u00e0i nguy\u00ean ph\u1ea7n c\u1ee9ng c\u00e1c thi\u1ebft b\u1ecb n\u00e0y nh\u1eb1m ph\u1ee5c v\u1ee5 cho c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u00e0o ti\u1ec1n s\u1ed1.<\/strong><\/p>\n

\n
\"Tin<\/a><\/div>\n<\/div>\n

Theo c\u00e1c chuy\u00ean gia b\u1ea3o m\u1eadt t\u1ea1i Microsoft, chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng \u0111\u01b0\u1ee3c tin t\u1eb7c\u00a0th\u1ef1c hi\u1ec7n b\u1eb1ng vi\u1ec7c\u00a0s\u1eed d\u1ee5ng backdoor tr\u00ean c\u00e1c thi\u1ebft b\u1ecb \u0111\u1ec3 tri\u1ec3n khai m\u00e3 \u0111\u1ed9c v\u00e0 IRC bot \u0111\u1ec3 \u0111\u00e1nh c\u1eafp, chi\u1ebfm \u0111o\u1ea1t t\u00e0i nguy\u00ean thi\u1ebft b\u1ecb. Tin t\u1eb7c b\u1eaft \u0111\u1ea7u b\u1eb1ng chu\u1ed7i\u00a0t\u1ea5n c\u00f4ng Brute-force\u00a0c\u00e1c th\u00f4ng tin x\u00e1c th\u1ef1c \u0111\u1ec3 x\u00e2m nh\u1eadm v\u00e0o c\u00e1c thi\u1ebft b\u1ecb Linux v\u00e0 IoT c\u00f3 c\u1ea5u h\u00ecnh sai ho\u1eb7c \u0111\u1ec3 c\u1ea5u h\u00ecnh x\u00e1c th\u1ef1c y\u1ebfu theo m\u1eb7c \u0111\u1ecbnh ban \u0111\u1ea7u c\u1ee7a nh\u00e0 s\u1ea3n xu\u1ea5t.<\/p>\n

Sau khi x\u00e2m nh\u1eadp v\u00e0o thi\u1ebft b\u1ecb, m\u1ed9t phi\u00ean b\u1ea3n OpenSSH c\u00f3 ch\u1ee9a Trojan t\u1eeb m\u1ed9t m\u00e1y ch\u1ee7 \u1edf xa s\u1ebd \u0111\u01b0\u1ee3c t\u1ea3i v\u1ec1 v\u00e0 c\u00e0i \u0111\u1eb7t tr\u00ean thi\u1ebft b\u1ecb m\u1ee5c ti\u00eau nh\u1eb1m chi\u1ebfm \u0111o\u1ea1n c\u00e1c th\u00f4ng tin x\u00e1c th\u1ef1c SSH, gi\u00fap tin t\u1eb7c di chuy\u1ec3n \u0111\u01b0\u1ee3c b\u00ean trong m\u1ea1ng v\u00e0 che gi\u1ea5u c\u00e1c k\u1ebft n\u1ed1i SSH b\u1ea5t h\u1ee3p ph\u00e1p t\u1edbi c\u00e1c thi\u1ebft b\u1ecb b\u1ecb x\u00e2m h\u1ea1i. \u0110\u1ec3 duy tr\u00ec t\u1ea5n c\u00f4ng v\u00e0 che gi\u1ea5u c\u00e1c h\u00e0nh \u0111\u1ed9ng x\u00e2m ph\u1ea1m, tin t\u1eb7c c\u00f2n \u0111\u01b0\u1ee3c cho l\u00e0 \u0111\u00e3 c\u00e0i \u0111\u1eb7t th\u00eam c\u00e1c rootkit m\u00e3 ngu\u1ed3n m\u1edf nh\u01b0 Diamorphine v\u00e0 Reptile (c\u00f3 m\u00e3 ngu\u1ed3n tr\u00ean Github) \u0111\u1ec3 x\u00f3a c\u00e1c b\u1ea3n ghi v\u00e0 nh\u1eadt k\u00fd h\u1ec7 th\u1ed1ng tr\u00ean thi\u1ebft b\u1ecb m\u1ee5c ti\u00eau (H\u00ecnh 1).<\/p>\n

\n
\"Tin<\/a><\/div>\n<\/div>\n

H\u00ecnh 1. Chu\u1ed7i t\u1ea5n c\u00f4ng \u0111\u00e0o ti\u1ec1n s\u1ed1 tr\u00ean thi\u1ebft b\u1ecb Linux ho\u1eb7c IoT c\u1ee7a tin t\u1eb7c<\/em><\/p>\n

\u0110\u1ec3 \u0111\u1ea3m b\u1ea3o quy\u1ec1n truy c\u1eadp SSH li\u00ean t\u1ee5c v\u00e0o thi\u1ebft b\u1ecb, tin t\u1eb7c ti\u1ebfn h\u00e0nh ch\u00e8n th\u00eam hai kh\u00f3a c\u00f4ng khai v\u00e0o trong t\u1eadp tin c\u1ea5u h\u00ecnh kh\u00f3a x\u00e1c th\u1ef1c SSH c\u1ee7a t\u1ea5t c\u1ea3 ng\u01b0\u1eddi d\u00f9ng tr\u00ean h\u1ec7 th\u1ed1ng thi\u1ebft b\u1ecb m\u1ee5c ti\u00eau. Sau khi x\u00e2m nh\u1eadp v\u00e0o thi\u1ebft b\u1ecb, c\u00e1c m\u00e3 \u0111\u1ed9c ch\u1ea1y ti\u1ebfn tr\u00ecnh \u0111\u00e0o ti\u1ec1n s\u1ed1 tr\u00ean thi\u1ebft b\u1ecb, th\u1eadm ch\u00ed ch\u00fang c\u00f2n \u01b0u ti\u00ean ch\u1ea1y c\u00e1c ti\u1ebfn tr\u00ecnh \u0111\u00e0o do m\u00ecnh t\u1ea1o ra v\u00e0 lo\u1ea1i b\u1ecf c\u00e1c ti\u1ebfn tr\u00ecnh \u0111\u00e0o ti\u1ec1n s\u1ed1 kh\u00e1c \u0111\u00e3 c\u00e0i b\u1edfi nh\u00f3m tin t\u1eb7c kh\u00e1c tr\u01b0\u1edbc \u0111\u00f3 n\u1ebfu c\u00f3.<\/p>\n

H\u01a1n n\u1eefa, tin t\u1eb7c c\u00f2n tri\u1ec3n khai th\u00eam m\u1ed9t phi\u00ean b\u1ea3n ch\u1ec9nh s\u1eeda c\u1ee7a m\u00e3 \u0111\u1ed9c \u201cZiggyStarTux\u201d nh\u1eb1m bi\u1ebfn thi\u1ebft b\u1ecb th\u00e0nh m\u1ed9t IRC bot c\u00f3 kh\u1ea3 n\u0103ng nh\u1eadn l\u1ec7nh t\u1eeb xa b\u1edfi m\u00e1y ch\u1ee7 \u0111\u01b0\u1ee3c \u0111i\u1ec1u khi\u1ec3n b\u1edfi tin t\u1eb7c (C2 Server \u2013 M\u00e1y ch\u1ee7 IRC \u0111\u01b0\u1ee3c \u0111i\u1ec1u khi\u1ec3n b\u1edfi tin t\u1eb7c) \u0111\u1ec3 th\u1ef1c hi\u1ec7n t\u1ea5n c\u00f4ng t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 ph\u00e2n t\u00e1n. M\u00e3 \u0111\u1ed9c n\u00e0y \u0111\u01b0\u1ee3c ch\u1ec9nh s\u1eeda t\u1eeb m\u00e3 \u0111\u1ed9c botnet kh\u00e1c c\u00f3 t\u00ean l\u00e0 \u201cKaiten\u201d (hay c\u00f2n g\u1ecdi l\u00e0 \u201cTsunami\u201d).<\/p>\n

ZiggyStartux \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd ch\u1ea1y nh\u01b0 m\u1ed9t d\u1ecbch v\u1ee5 h\u1ec7 th\u1ed1ng tr\u00ean thi\u1ebft b\u1ecb m\u1ee5c ti\u00eau\u00a0v\u00e0 \u0111\u01b0\u1ee3c c\u1ea5u h\u00ecnh d\u1ecbch v\u1ee5 t\u1ea1i t\u1ec7p tin \/etc\/systemd\/system\/network-check.service. S\u1ef1 giao ti\u1ebfp gi\u1eefa ZiggyStartux Bots t\u1edbi m\u00e1y ch\u1ee7 C2 \u0111\u01b0\u1ee3c che gi\u1ea5u v\u00e0 duy tr\u00ec th\u00f4ng qua vi\u1ec7c s\u1eed d\u1ee5ng t\u00ean mi\u1ec1n ph\u1ee5 c\u1ee7a m\u1ed9t t\u1ed5 ch\u1ee9c t\u00e0i ch\u00ednh \u0110\u00f4ng Nam \u00c1 h\u1ee3p ph\u00e1p.<\/p>\n

Microsoft quy k\u1ebft chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng n\u00e0y cho ng\u01b0\u1eddi d\u00f9ng c\u00f3 t\u00ean \u201cAsterzeu\u201d tr\u00ean di\u1ec5n \u0111\u00e0n t\u1ea5n c\u00f4ng m\u1ea1ng l\u00e0 cardingforum.cx. Ng\u01b0\u1eddi d\u00f9ng n\u00e0y \u0111\u00e3 cung c\u1ea5p nhi\u1ec1u c\u00f4ng c\u1ee5 t\u1ea5n c\u00f4ng \u0111\u1ec3 b\u00e1n \u0111\u1ed1i v\u1edbi c\u00e1c n\u1ec1n t\u1ea3ng linux, bao g\u1ed3m c\u1ea3 backdoor SSH.<\/p>\n

C\u00e1c c\u00f4ng b\u1ed1 v\u1ec1 chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng n\u00e0y c\u1ee7a Microsoft di\u1ec5n ra hai ng\u00e0y sau khi m\u1ed9t b\u00e1o c\u00e1o v\u1ec1 chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng t\u01b0\u01a1ng t\u1ef1 \u0111\u00e3 \u0111\u01b0\u1ee3c xu\u1ea5t b\u1ea3n b\u1edfi Trung t\u00e2m \u1ee9ng ph\u00f3 b\u1ea3o m\u1eadt kh\u1ea9n c\u1ea5p Ahnlab. Chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng bao g\u1ed3m m\u00e3 \u0111\u1ed9c Tsunami \u2013 m\u1ed9t t\u00ean kh\u00e1c cho Kaiten hay m\u1ed9t d\u1ea1ng DDoS Bot \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t tr\u00ean c\u00e1c m\u00e1y ch\u1ee7 Linux SSH \u0111\u01b0\u1ee3c c\u1ea5u h\u00ecnh y\u1ebfu. Theo ph\u00e2n t\u00edch c\u1ee7a c\u00e1c chuy\u00ean gia an ninh m\u1ea1ng Microsoft, Tsunami \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 c\u00e0i \u0111\u1eb7t nhi\u1ec1u c\u00f4ng c\u1ee5 \u0111\u1ed9c h\u1ea1i v\u00e0 \u0111\u00e0o ti\u1ec1n \u0111i\u1ec7n t\u1eed kh\u00e1c nhau, nh\u01b0 shellbot, xmrig coinminer v\u00e0 log Cleaner.<\/p>\n

Ngu\u1ed3n: https:\/\/antoanthongtin.vn\/hacker-malware\/tin-tac-nham-muc-tieu-toi-cac-thiet-bi-linux-va-iot-de-phuc-vu-viec-dao-tien-so-109102<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

V\u1eeba qua, Microsoft \u0111\u00e3 \u0111\u01b0a ra c\u00e1c th\u00f4ng tin r\u1eb1ng c\u00e1c nh\u00f3m tin t\u1eb7c \u0111ang th\u1ef1c hi\u1ec7n c\u00e1c chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng m\u1ea1ng nh\u1eafm t\u1edbi c\u00e1c thi\u1ebft b\u1ecb ch\u1ea1y h\u1ec7 \u0111i\u1ec1u h\u00e0nh Linux v\u00e0 IoT \u0111\u1ec3 \u0111\u00e1nh c\u1eafp t\u00e0i nguy\u00ean ph\u1ea7n c\u1ee9ng c\u00e1c thi\u1ebft b\u1ecb n\u00e0y nh\u1eb1m ph\u1ee5c v\u1ee5 cho c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u00e0o ti\u1ec1n […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[13],"tags":[],"class_list":{"0":"post-2543","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-tin-tuc"},"_links":{"self":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts\/2543","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/comments?post=2543"}],"version-history":[{"count":1,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts\/2543\/revisions"}],"predecessor-version":[{"id":2554,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts\/2543\/revisions\/2554"}],"wp:attachment":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/media?parent=2543"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/categories?post=2543"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/tags?post=2543"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}