{"id":27816,"date":"2024-08-15T10:14:55","date_gmt":"2024-08-15T03:14:55","guid":{"rendered":"https:\/\/cdcangiang.vn\/?p=27816"},"modified":"2024-08-15T11:09:37","modified_gmt":"2024-08-15T04:09:37","slug":"bai-17-08-24","status":"publish","type":"post","link":"https:\/\/cdcangiang.vn\/index.php\/2024\/08\/15\/bai-17-08-24\/","title":{"rendered":"Th\u00f4ng tin chi ti\u1ebft v\u1ec1 chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng MirrorFace"},"content":{"rendered":"

Trong qu\u00e1 tr\u00ecnh gi\u00e1m s\u00e1t an to\u00e0n th\u00f4ng tin tr\u00ean kh\u00f4ng gian m\u1ea1ng, Trung t\u00e2m Gi\u00e1m s\u00e1t an to\u00e0n kh\u00f4ng gian m\u1ea1ng qu\u1ed1c gia (NCSC), thu\u1ed9c C\u1ee5c An to\u00e0n th\u00f4ng tin, B\u1ed9 Th\u00f4ng tin v\u00e0 Truy\u1ec1n th\u00f4ng, \u0111\u00e3 ph\u00e1t hi\u1ec7n v\u00e0 ghi nh\u1eadn c\u00e1c th\u00f4ng tin li\u00ean quan \u0111\u1ebfn chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng m\u1ea1ng \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n b\u1edfi nh\u00f3m t\u1ea5n c\u00f4ng APT MirrorFace.<\/span><\/p>\n

M\u1ee5c ti\u00eau c\u1ee7a nh\u00f3m MirrorFace<\/strong>:<\/strong> l\u00e0 c\u00e1c t\u1ed5 ch\u1ee9c ch\u00ednh tr\u1ecb, c\u00e1c vi\u1ec7n nghi\u00ean c\u1ee9u, nh\u00e0 s\u1ea3n xu\u1ea5t.<\/span><\/p>\n

C\u00e1ch th\u1ee9c th\u1ef1c hi\u1ec7n chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng: <\/strong><\/span><\/p>\n

Ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c NOOPDOOR th\u00f4ng qua th\u1ef1c hi\u1ec7n khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng an to\u00e0n th\u00f4ng tin tr\u00ean s\u1ea3n ph\u1ea9m Array AG v\u00e0 FortiGate. Theo \u0111\u00f3, m\u00e3 \u0111\u1ed9c NOOPDOOR l\u00e0 m\u1ed9t shellcode \u0111\u01b0\u1ee3c g\u00e0i v\u00e0o \u1ee9ng d\u1ee5ng h\u1ee3p ph\u00e1p tr\u00ean h\u1ec7 th\u1ed1ng v\u00e0 c\u00f3 hai bi\u1ebfn th\u1ec3 d\u01b0\u1edbi d\u1ea1ng file .XML v\u00e0 .DLL. C\u1ea3 hai bi\u1ebfn th\u1ec3 n\u00e0y ch\u1ec9 kh\u00e1c v\u1ec1 b\u01b0\u1edbc x\u00e2m nh\u1eadp v\u00e0 gi\u1ed1ng nhau v\u1ec1 ch\u1ee9c n\u0103ng, cho ph\u00e9p nh\u00f3m MirrorFace thi\u1ebft l\u1eadp k\u1ebft n\u1ed1i th\u00f4ng qua c\u1ed5ng 443, c\u1ed5ng 47000 \u0111\u1ec3 t\u1ea3i xu\u1ed1ng file, th\u1ef1c thi c\u00e2u l\u1ec7nh.<\/span><\/p>\n

Sau khi ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c trong chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng, nh\u00f3m n\u00e0y th\u1ef1c hi\u1ec7n c\u00e1c h\u00e0nh tr\u00e1i ph\u00e9p nh\u01b0: truy c\u1eadp v\u00e0o n\u01a1i l\u01b0u tr\u1eef th\u00f4ng tin x\u00e1c th\u1ef1c c\u1ee7a h\u1ec7 th\u1ed1ng m\u1ea1ng, ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c t\u1edbi c\u00e1c thi\u1ebft b\u1ecb kh\u00e1c trong m\u1ea1ng c\u1ee5c b\u1ed9; th\u1ef1c hi\u1ec7n c\u00e1c h\u00e0nh vi theo d\u00f5i, tr\u00edch xu\u1ea5t th\u00f4ng tin ng\u01b0\u1eddi d\u00f9ng. Ngo\u00e0i ra, MirrorFace c\u00f2n s\u1eed d\u1ee5ng c\u00f4ng c\u1ee5 GO Simple Tunnel trong chi\u1ebfn d\u1ecbch. \u0110\u1ec3 tr\u00e1nh b\u1ecb ph\u00e1t hi\u1ec7n, nh\u00f3m \u0111\u1ed1i t\u01b0\u1ee3ng \u0111\u00e3 khai th\u00e1c MSBuild \u0111\u1ec3 th\u1ef1c thi file .XML ch\u1ee9a m\u00e3 \u0111\u1ed9c; ghi \u0111\u00e8 d\u1eef li\u1ec7u \u0111\u1ed9c h\u1ea1i l\u00ean registry c\u1ee7a file; ch\u1ec9nh s\u1eeda timestamp; th\u00eam lu\u1eadt v\u00e0o t\u01b0\u1eddng l\u1eeda h\u1ec7 th\u1ed1ng \u0111\u1ec3 cho ph\u00e9p m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c k\u1ebft n\u1ed1i t\u1edbi c\u00e1c c\u1ed5ng nh\u1ea5t \u0111\u1ecbnh; \u1ea9n \u0111i c\u00e1c d\u1ecbch v\u1ee5 \u0111\u01b0\u1ee3c k\u00edch ho\u1ea1t; x\u00f3a \u0111i ghi ch\u00e9p c\u1ee7a Windows Event; x\u00f3a file m\u00e3 \u0111\u1ed9c sau khi khai th\u00e1c. Chi\u1ebfn d\u1ecbch s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt DLL side-loading v\u00e0 khai th\u00e1c MSBuild \u0111\u1ec3 th\u1ef1c thi m\u00e3 \u0111\u1ed9c tr\u00ean h\u1ec7 th\u1ed1ng.<\/span><\/p>\n

Khuy\u1ebfn c\u00e1o ph\u00f2ng ng\u1eeba: <\/strong>Ki\u1ec3m tra, r\u00e0 so\u00e1t c\u00e1c thi\u1ebft b\u1ecb c\u00f3 li\u00ean quan \u0111\u1ebfn s\u1ea3n ph\u1ea9m Array AG v\u00e0 FortiGate. Ch\u1ee7 \u0111\u1ed9ng theo d\u00f5i c\u00e1c th\u00f4ng tin li\u00ean quan \u0111\u1ebfn chi\u1ebfn d\u1ecbch nh\u1eb1m th\u1ef1c hi\u1ec7n ng\u0103n ch\u1eb7n nh\u1eb1m tr\u00e1nh nguy c\u01a1 b\u1ecb t\u1ea5n c\u00f4ng.<\/span><\/p>\n

Trong tr\u01b0\u1eddng h\u1ee3p c\u1ea7n thi\u1ebft, c\u00f3 th\u1ec3 li\u00ean h\u1ec7 \u0111\u1ea7u m\u1ed1i h\u1ed7 tr\u1ee3: <\/strong><\/span><\/p>\n

– Th\u01b0\u1eddng tr\u1ef1c \u0110\u1ed9i \u1ee9ng c\u1ee9u \u2013 S\u1edf Th\u00f4ng tin v\u00e0 Truy\u1ec1n th\u00f4ng (th\u00f4ng qua Trung t\u00e2m C\u00f4ng ngh\u1ec7 Th\u00f4ng tin v\u00e0 Truy\u1ec1n th\u00f4ng), \u0111i\u1ec7n tho\u1ea1i: 02963856188, th\u01b0 \u0111i\u1ec7n t\u1eed: hotro@angiang.gov.vn<\/a>.<\/span><\/p>\n

– C\u1ee5c An to\u00e0n th\u00f4ng tin: Trung t\u00e2m Gi\u00e1m s\u00e1t an to\u00e0n kh\u00f4ng gian m\u1ea1ng qu\u1ed1c gia, \u0111i\u1ec7n tho\u1ea1i: 02432091616, th\u01b0 \u0111i\u1ec7n t\u1eed: ncsc@ais.gov.vn<\/a>.\u00a0<\/span><\/p>\n

Minh H\u1ea3i – Khoa TT-GDSK, TT.KSBT An Giang<\/em><\/span><\/strong><\/p>\n

(Ngu\u1ed3n C\u00f4ng v\u0103n s\u1ed1 1290 \/\u0110\u01afCSCATTTM ng\u00e0y 08\/08\/2024 c\u1ee7a \u0110\u1ed9i \u1ee9ng c\u1ee9u s\u1ef1 c\u1ed1 an to\u00e0n th\u00f4ng tin m\u1ea1ng)<\/em><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Trong qu\u00e1 tr\u00ecnh gi\u00e1m s\u00e1t an to\u00e0n th\u00f4ng tin tr\u00ean kh\u00f4ng gian m\u1ea1ng, Trung t\u00e2m Gi\u00e1m s\u00e1t an to\u00e0n kh\u00f4ng gian m\u1ea1ng qu\u1ed1c gia (NCSC), thu\u1ed9c C\u1ee5c An to\u00e0n th\u00f4ng tin, B\u1ed9 Th\u00f4ng tin v\u00e0 Truy\u1ec1n th\u00f4ng, \u0111\u00e3 ph\u00e1t hi\u1ec7n v\u00e0 ghi nh\u1eadn c\u00e1c th\u00f4ng tin li\u00ean quan \u0111\u1ebfn chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng m\u1ea1ng \u0111\u01b0\u1ee3c […]<\/p>\n","protected":false},"author":8,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"limit_modified_date":"","last_modified_date":"","footnotes":""},"categories":[312,324,322,54],"tags":[],"class_list":["post-27816","post","type-post","status-publish","format-standard","hentry","category-bai-cds","category-bai-viet","category-cham-nhuan-but","category-cong-nghe-thong-tin"],"_links":{"self":[{"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/posts\/27816","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/comments?post=27816"}],"version-history":[{"count":2,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/posts\/27816\/revisions"}],"predecessor-version":[{"id":27821,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/posts\/27816\/revisions\/27821"}],"wp:attachment":[{"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/media?parent=27816"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/categories?post=27816"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/tags?post=27816"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}