{"id":6516,"date":"2021-01-13T07:27:50","date_gmt":"2021-01-13T06:27:50","guid":{"rendered":"https:\/\/webhosting.de\/?p=6516"},"modified":"2021-01-13T07:27:51","modified_gmt":"2021-01-13T06:27:51","slug":"solarwinds-hack-loud-caspersky-connection-between-sunburst-and-kazuar","status":"publish","type":"post","link":"https:\/\/webhosting.de\/pl\/solarwinds-hack-laut-kaspersky-verbindung-zwischen-sunburst-und-kazuar\/","title":{"rendered":"Solarwinds hack - Kaspersky m\u00f3wi o po\u0142\u0105czeniu mi\u0119dzy Sunburstem i Kazuarem"},"content":{"rendered":"

Eksperci od bezpiecze\u0144stwa IT z firmy Kaspersky widz\u0105, wed\u0142ug Posterunek na blogu<\/a> w ostatnim czasie Hakowanie wiatr\u00f3w s\u0142onecznych<\/a>kt\u00f3ry infiltrowa\u0142 NASA, Pentagon i inne wra\u017cliwe cele, ma zwi\u0105zek ze z\u0142o\u015bliwym oprogramowaniem Kazuar. Analizuj\u0105c backdoora Sunburst, badacze znale\u017ali kilka cech, kt\u00f3re by\u0142y ju\u017c wykorzystywane w backdoorze Kazuar stworzonym w .NET Framework.<\/p>\n\n\n\n

\"Podobie\u0144stwa w kodzie wskazuj\u0105 na zwi\u0105zek pomi\u0119dzy Kazuarem i Sunburstem, cho\u0107 o nieokre\u015blonym jeszcze charakterze.\"<\/p>Kaspersky<\/cite><\/blockquote><\/figure>\n\n\n\n

Kazuarskie z\u0142o\u015bliwe oprogramowanie znane od 2017 r.<\/h2>\n\n\n\n

Wed\u0142ug Kaspersky'ego, z\u0142o\u015bliwe oprogramowanie Kazuara zosta\u0142o odkryte po raz pierwszy w 2017 roku i prawdopodobnie zosta\u0142o opracowane przez aktora APT Turl\u0119, kt\u00f3ry rzekomo wykorzystywa\u0142 Kazuara do prowadzenia cyberprzest\u0119pczo\u015bci na ca\u0142ym \u015bwiecie. Podobno w procesie tym infiltrowano kilkaset cel\u00f3w wojskowych i rz\u0105dowych. Turla zosta\u0142 po raz pierwszy zg\u0142oszony przez Kaspersky'ego i Symanteca na konferencji Black Hat 2014 w Vegas.<\/p>\n\n\n\n

\"\"
Kazuar <\/em>Okres rozwoju (\u017ar\u00f3d\u0142o: securelist.com)<\/figcaption><\/figure>\n\n\n\n

Nie oznacza to jednak automatycznie, \u017ce Turla jest r\u00f3wnie\u017c odpowiedzialna za hack Solarwinds, w kt\u00f3rym 18 000 agencji rz\u0105dowych, przedsi\u0119biorstw i organizacji zosta\u0142o zaatakowanych za pomoc\u0105 troja\u0144skiej wersji oprogramowania do zarz\u0105dzania IT Orion.<\/p>\n\n\n\n

Algorytm generowania, algorytm budzenia i hash FNV1a<\/h2>\n\n\n\n

Wed\u0142ug analizy Kaspersky'ego, najbardziej uderzaj\u0105ce podobie\u0144stwa mi\u0119dzy Sunburstem a Kazuarem to algorytm budzenia, algorytm generowania identyfikatora ofiary oraz u\u017cycie haszu FNV1a. Kod u\u017cywany w tych przypadkach jest bardzo podobny, ale nie jest ca\u0142kowicie identyczny. Sunburst i Kazuar wydaj\u0105 si\u0119 wi\u0119c \"spokrewnieni\", ale szczeg\u00f3\u0142y dotycz\u0105ce dok\u0142adnego zwi\u0105zku pomi\u0119dzy tymi dwoma malwarami nie zosta\u0142y jeszcze ustalone.<\/p>\n\n\n\n

Jednym z prawdopodobnych wyja\u015bnie\u0144 jest to, \u017ce Sunburst i Kazuar zosta\u0142y napisane przez tych samych deweloper\u00f3w. Mo\u017ce si\u0119 jednak zdarzy\u0107, \u017ce Sunburst zosta\u0142 opracowany przez inn\u0105 grup\u0119, kt\u00f3ra wykorzysta\u0142a jako szablon udane z\u0142o\u015bliwe oprogramowanie Kazuara. Istnieje r\u00f3wnie\u017c mo\u017cliwo\u015b\u0107, \u017ce do zespo\u0142u Sunburst do\u0142\u0105czyli indywidualni deweloperzy z grupy deweloperskiej Kazuar.<\/p>\n\n\n\n

Fa\u0142szywe flagi Operacja<\/h2>\n\n\n\n

Mo\u017cliwe jest jednak r\u00f3wnie\u017c, \u017ce podobie\u0144stwa mi\u0119dzy Kazuarem a Sunburstem zosta\u0142y celowo wbudowane w celu stworzenia fa\u0142szywych trop\u00f3w w oczekiwanych analizach z\u0142o\u015bliwego oprogramowania.<\/p>\n\n\n\n

\"Znalezione ogniwo nie ujawnia, kto sta\u0142 za atakiem Wiatrak\u00f3w S\u0142onecznych, ale oferuje dalszy wgl\u0105d, kt\u00f3ry mo\u017ce pom\u00f3c naukowcom kontynuowa\u0107 t\u0119 analiz\u0119\".<\/p>Costin Raiu<\/cite><\/blockquote><\/figure>","protected":false},"excerpt":{"rendered":"

Analiza z\u0142o\u015bliwego oprogramowania Sunburst wskazuje na du\u017ce podobie\u0144stwa z Kazuarem. Jednak\u017ce, to jeszcze nie identyfikuje programist\u00f3w.<\/p>","protected":false},"author":2,"featured_media":6461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_crdt_document":"","inline_featured_image":false,"footnotes":""},"categories":[685],"tags":[965,237],"class_list":["post-6516","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-allgemein","tag-kaspersky","tag-malware"],"acf":[],"_wp_attached_file":null,"_wp_attachment_metadata":null,"litespeed-optimize-size":null,"litespeed-optimize-set":null,"_elementor_source_image_hash":null,"_wp_attachment_image_alt":null,"stockpack_author_name":null,"stockpack_author_url":null,"stockpack_provider":null,"stockpack_image_url":null,"stockpack_license":null,"stockpack_license_url":null,"stockpack_modification":null,"color":null,"original_id":null,"original_url":null,"original_link":null,"unsplash_location":null,"unsplash_sponsor":null,"unsplash_exif":null,"unsplash_attachment_metadata":null,"_elementor_is_screenshot":null,"surfer_file_name":null,"surfer_file_original_url":null,"envato_tk_source_kit":null,"envato_tk_source_index":null,"envato_tk_manifest":null,"envato_tk_folder_name":null,"envato_tk_builder":null,"envato_elements_download_event":null,"_menu_item_type":null,"_menu_item_menu_item_parent":null,"_menu_item_object_id":null,"_menu_item_object":null,"_menu_item_target":null,"_menu_item_classes":null,"_menu_item_xfn":null,"_menu_item_url":null,"_trp_menu_languages":null,"rank_math_primary_category":"685","rank_math_title":null,"inline_featured_image":null,"_yoast_wpseo_primary_category":"685","rank_math_schema_blogposting":null,"rank_math_schema_videoobject":null,"_oembed_049c719bc4a9f89deaead66a7da9fddc":null,"_oembed_time_049c719bc4a9f89deaead66a7da9fddc":null,"_yoast_wpseo_focuskw":null,"_yoast_wpseo_linkdex":null,"_oembed_27e3473bf8bec795fbeb3a9d38489348":null,"_oembed_c3b0f6959478faf92a1f343d8f96b19e":null,"_trp_translated_slug_en_us":null,"_wp_desired_post_slug":null,"_yoast_wpseo_title":null,"tldname":null,"tldpreis":null,"tldrubrik":null,"tldpolicylink":null,"tldsize":null,"tldregistrierungsdauer":null,"tldtransfer":null,"tldwhoisprivacy":null,"tldregistrarchange":null,"tldregistrantchange":null,"tldwhoisupdate":null,"tldnameserverupdate":null,"tlddeletesofort":null,"tlddeleteexpire":null,"tldumlaute":null,"tldrestore":null,"tldsubcategory":null,"tldbildname":null,"tldbildurl":null,"tldclean":null,"tldcategory":null,"tldpolicy":null,"tldbesonderheiten":null,"tld_bedeutung":null,"_oembed_d167040d816d8f94c072940c8009f5f8":null,"_oembed_b0a0fa59ef14f8870da2c63f2027d064":null,"_oembed_4792fa4dfb2a8f09ab950a73b7f313ba":null,"_oembed_33ceb1fe54a8ab775d9410abf699878d":null,"_oembed_fd7014d14d919b45ec004937c0db9335":null,"_oembed_21a029d076783ec3e8042698c351bd7e":null,"_oembed_be5ea8a0c7b18e658f08cc571a909452":null,"_oembed_a9ca7a298b19f9b48ec5914e010294d2":null,"_oembed_f8db6b27d08a2bb1f920e7647808899a":null,"_oembed_168ebde5096e77d8a89326519af9e022":null,"_oembed_cdb76f1b345b42743edfe25481b6f98f":null,"_oembed_87b0613611ae54e86e8864265404b0a1":null,"_oembed_27aa0e5cf3f1bb4bc416a4641a5ac273":null,"_oembed_time_27aa0e5cf3f1bb4bc416a4641a5ac273":null,"_tldname":null,"_tldclean":null,"_tldpreis":null,"_tldcategory":null,"_tldsubcategory":null,"_tldpolicy":null,"_tldpolicylink":null,"_tldsize":null,"_tldregistrierungsdauer":null,"_tldtransfer":null,"_tldwhoisprivacy":null,"_tldregistrarchange":null,"_tldregistrantchange":null,"_tldwhoisupdate":null,"_tldnameserverupdate":null,"_tlddeletesofort":null,"_tlddeleteexpire":null,"_tldumlaute":null,"_tldrestore":null,"_tldbildname":null,"_tldbildurl":null,"_tld_bedeutung":null,"_tldbesonderheiten":null,"_oembed_ad96e4112edb9f8ffa35731d4098bc6b":null,"_oembed_8357e2b8a2575c74ed5978f262a10126":null,"_oembed_3d5fea5103dd0d22ec5d6a33eff7f863":null,"_eael_widget_elements":null,"_oembed_0d8a206f09633e3d62b95a15a4dd0487":null,"_oembed_time_0d8a206f09633e3d62b95a15a4dd0487":null,"_aioseo_description":null,"_eb_attr":null,"_eb_data_table":null,"_oembed_819a879e7da16dd629cfd15a97334c8a":null,"_oembed_time_819a879e7da16dd629cfd15a97334c8a":null,"_acf_changed":null,"_wpcode_auto_insert":null,"_edit_last":"1","_edit_lock":"1610519271:1","_oembed_e7b913c6c84084ed9702cb4feb012ddd":"{{unknown}}","_oembed_bfde9e10f59a17b85fc8917fa7edf782":"