{"id":6516,"date":"2021-01-13T07:27:50","date_gmt":"2021-01-13T06:27:50","guid":{"rendered":"https:\/\/webhosting.de\/?p=6516"},"modified":"2021-01-13T07:27:51","modified_gmt":"2021-01-13T06:27:51","slug":"solarwinds-hack-loud-caspersky-connection-between-sunburst-and-kazuar","status":"publish","type":"post","link":"https:\/\/webhosting.de\/da\/solarwinds-hack-laut-kaspersky-verbindung-zwischen-sunburst-und-kazuar\/","title":{"rendered":"Solarwinds hack - Kaspersky siger, at der er en forbindelse mellem Sunburst og Kazuar"},"content":{"rendered":"

If\u00f8lge en it-sikkerhedsekspert fra firmaet Kaspersky er den Blogindl\u00e6g<\/a> p\u00e5 den nylige Solarwinds hack<\/a>som infiltrerede NASA, Pentagon og andre f\u00f8lsomme m\u00e5l, var forbundet med Kazuar-malware. Ved analysen af Sunburst-bagd\u00f8ren fandt forskerne forskellige funktioner, som allerede blev brugt i Kazuar-bagd\u00f8ren, der er skabt i .NET Framework.<\/p>\n\n\n\n

\"Lighederne i koden indikerede en forbindelse mellem Kazuar og Sunburst, om end af en endnu ubestemt art.\"<\/p>Kaspersky<\/cite><\/blockquote><\/figure>\n\n\n\n

Kazuar malware kendt siden 2017<\/h2>\n\n\n\n

If\u00f8lge Kaspersky blev Kazuar-malwaren f\u00f8rst opdaget i 2017 og blev sandsynligvis udviklet af APT-akt\u00f8ren Turla, som siges at have udf\u00f8rt cyberspionage rundt om i verden ved hj\u00e6lp af Kazuar. Flere hundrede milit\u00e6re og statslige m\u00e5l siges at v\u00e6re blevet infiltreret i processen. Turla blev f\u00f8rst rapporteret af Kaspersky og Symantec p\u00e5 Black Hat 2014-konferencen i Vegas.<\/p>\n\n\n\n

\"\"
Kazuar <\/em>Udviklingsperiode (kilde: securelist.com)<\/figcaption><\/figure>\n\n\n\n

Det betyder dog ikke automatisk, at Turla ogs\u00e5 er ansvarlig for Solarwinds-hacket, hvor 18.000 myndigheder, virksomheder og organisationer blev angrebet via en trojaniseret version af it-styringsprogrammet Orion.<\/p>\n\n\n\n

Genereringsalgoritme, wake-up-algoritme og FNV1a hash<\/h2>\n\n\n\n

If\u00f8lge Kaspersky-analysen er de mest sl\u00e5ende ligheder mellem Sunburst og Kazuar wake-up-algoritmen, algoritmen til generering af offer-ID og brugen af FNV1a-hash. Den kode, der anvendes i disse tilf\u00e6lde, har store ligheder, men er ikke helt identisk. Sunburst og Kazuar ser derfor ud til at v\u00e6re \"relateret\", men det er endnu ikke muligt at f\u00e5 n\u00e6rmere oplysninger om den n\u00f8jagtige relation mellem de to skadelige programmer.<\/p>\n\n\n\n

En sandsynlig forklaring er, at Sunburst og Kazuar blev skrevet af de samme udviklere. Det kan dog ogs\u00e5 v\u00e6re, at Sunburst er udviklet af en anden gruppe, der har brugt den vellykkede Kazuar-malware som skabelon. Der er ogs\u00e5 mulighed for, at enkelte udviklere fra Kazuar-gruppen har sluttet sig til Sunburst-teamet.<\/p>\n\n\n\n

Operation under falsk flag<\/h2>\n\n\n\n

Det er dog ogs\u00e5 muligt, at lighederne mellem Kazuar og Sunburst bevidst blev indbygget for at skabe falske indikationer i de forventede malware-analyser.<\/p>\n\n\n\n

\"Det fundne link afsl\u00f8rer ikke, hvem der st\u00e5r bag Solarwinds' angreb, men giver yderligere indsigt, som kan hj\u00e6lpe forskerne med at g\u00e5 videre med denne analyse.\"<\/p>Costin Raiu<\/cite><\/blockquote><\/figure>","protected":false},"excerpt":{"rendered":"

En analyse af Sunburst-malware viser store ligheder med Kazuar. Det er dog endnu ikke muligt at identificere udviklerne.<\/p>","protected":false},"author":2,"featured_media":6461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_crdt_document":"","inline_featured_image":false,"footnotes":""},"categories":[685],"tags":[965,237],"class_list":["post-6516","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-allgemein","tag-kaspersky","tag-malware"],"acf":[],"_wp_attached_file":null,"_wp_attachment_metadata":null,"litespeed-optimize-size":null,"litespeed-optimize-set":null,"_elementor_source_image_hash":null,"_wp_attachment_image_alt":null,"stockpack_author_name":null,"stockpack_author_url":null,"stockpack_provider":null,"stockpack_image_url":null,"stockpack_license":null,"stockpack_license_url":null,"stockpack_modification":null,"color":null,"original_id":null,"original_url":null,"original_link":null,"unsplash_location":null,"unsplash_sponsor":null,"unsplash_exif":null,"unsplash_attachment_metadata":null,"_elementor_is_screenshot":null,"surfer_file_name":null,"surfer_file_original_url":null,"envato_tk_source_kit":null,"envato_tk_source_index":null,"envato_tk_manifest":null,"envato_tk_folder_name":null,"envato_tk_builder":null,"envato_elements_download_event":null,"_menu_item_type":null,"_menu_item_menu_item_parent":null,"_menu_item_object_id":null,"_menu_item_object":null,"_menu_item_target":null,"_menu_item_classes":null,"_menu_item_xfn":null,"_menu_item_url":null,"_trp_menu_languages":null,"rank_math_primary_category":"685","rank_math_title":null,"inline_featured_image":null,"_yoast_wpseo_primary_category":"685","rank_math_schema_blogposting":null,"rank_math_schema_videoobject":null,"_oembed_049c719bc4a9f89deaead66a7da9fddc":null,"_oembed_time_049c719bc4a9f89deaead66a7da9fddc":null,"_yoast_wpseo_focuskw":null,"_yoast_wpseo_linkdex":null,"_oembed_27e3473bf8bec795fbeb3a9d38489348":null,"_oembed_c3b0f6959478faf92a1f343d8f96b19e":null,"_trp_translated_slug_en_us":null,"_wp_desired_post_slug":null,"_yoast_wpseo_title":null,"tldname":null,"tldpreis":null,"tldrubrik":null,"tldpolicylink":null,"tldsize":null,"tldregistrierungsdauer":null,"tldtransfer":null,"tldwhoisprivacy":null,"tldregistrarchange":null,"tldregistrantchange":null,"tldwhoisupdate":null,"tldnameserverupdate":null,"tlddeletesofort":null,"tlddeleteexpire":null,"tldumlaute":null,"tldrestore":null,"tldsubcategory":null,"tldbildname":null,"tldbildurl":null,"tldclean":null,"tldcategory":null,"tldpolicy":null,"tldbesonderheiten":null,"tld_bedeutung":null,"_oembed_d167040d816d8f94c072940c8009f5f8":null,"_oembed_b0a0fa59ef14f8870da2c63f2027d064":null,"_oembed_4792fa4dfb2a8f09ab950a73b7f313ba":null,"_oembed_33ceb1fe54a8ab775d9410abf699878d":null,"_oembed_fd7014d14d919b45ec004937c0db9335":null,"_oembed_21a029d076783ec3e8042698c351bd7e":null,"_oembed_be5ea8a0c7b18e658f08cc571a909452":null,"_oembed_a9ca7a298b19f9b48ec5914e010294d2":null,"_oembed_f8db6b27d08a2bb1f920e7647808899a":null,"_oembed_168ebde5096e77d8a89326519af9e022":null,"_oembed_cdb76f1b345b42743edfe25481b6f98f":null,"_oembed_87b0613611ae54e86e8864265404b0a1":null,"_oembed_27aa0e5cf3f1bb4bc416a4641a5ac273":null,"_oembed_time_27aa0e5cf3f1bb4bc416a4641a5ac273":null,"_tldname":null,"_tldclean":null,"_tldpreis":null,"_tldcategory":null,"_tldsubcategory":null,"_tldpolicy":null,"_tldpolicylink":null,"_tldsize":null,"_tldregistrierungsdauer":null,"_tldtransfer":null,"_tldwhoisprivacy":null,"_tldregistrarchange":null,"_tldregistrantchange":null,"_tldwhoisupdate":null,"_tldnameserverupdate":null,"_tlddeletesofort":null,"_tlddeleteexpire":null,"_tldumlaute":null,"_tldrestore":null,"_tldbildname":null,"_tldbildurl":null,"_tld_bedeutung":null,"_tldbesonderheiten":null,"_oembed_ad96e4112edb9f8ffa35731d4098bc6b":null,"_oembed_8357e2b8a2575c74ed5978f262a10126":null,"_oembed_3d5fea5103dd0d22ec5d6a33eff7f863":null,"_eael_widget_elements":null,"_oembed_0d8a206f09633e3d62b95a15a4dd0487":null,"_oembed_time_0d8a206f09633e3d62b95a15a4dd0487":null,"_aioseo_description":null,"_eb_attr":null,"_eb_data_table":null,"_oembed_819a879e7da16dd629cfd15a97334c8a":null,"_oembed_time_819a879e7da16dd629cfd15a97334c8a":null,"_acf_changed":null,"_wpcode_auto_insert":null,"_edit_last":"1","_edit_lock":"1610519271:1","_oembed_e7b913c6c84084ed9702cb4feb012ddd":"{{unknown}}","_oembed_bfde9e10f59a17b85fc8917fa7edf782":"