{"id":1699,"date":"2022-05-19T23:48:16","date_gmt":"2022-05-19T23:48:16","guid":{"rendered":"https:\/\/avestim.com\/infectarea-dispozitivelor-cu-malware-prin-folosirea-imaginii-unor-banci-din-romania\/"},"modified":"2022-05-23T06:10:30","modified_gmt":"2022-05-23T06:10:30","slug":"infectarea-dispozitivelor-cu-malware-prin-folosirea-imaginii-unor-banci-din-romania","status":"publish","type":"post","link":"https:\/\/avestim.com\/ro\/infectarea-dispozitivelor-cu-malware-prin-folosirea-imaginii-unor-banci-din-romania\/","title":{"rendered":"Infectarea dispozitivelor cu malware prin folosirea imaginii unor b\u0103nci din Rom\u00e2nia"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"1699\" class=\"elementor elementor-1699 elementor-1538\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-84b6255 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"84b6255\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-0196b45\" data-id=\"0196b45\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-0019188 elementor-widget elementor-widget-text-editor\" data-id=\"0019188\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<span style=\"font-weight: 400;\">Clien\u021bii b\u0103ncilor din Rom\u00e2nia sunt \u00een continuare \u021binta atacurilor cibernetice prin mai multe metode, una din ele fiind atacurile pe e-mail.<\/span>\r\n\r\n<span style=\"font-weight: 400;\">Un utilizator prime\u0219te pe e-mail \u00een care este informat despre faptul c\u0103 s-a efectuat o plat\u0103 din contul lui sau are de pl\u0103tit o anumit\u0103 sum\u0103 de bani pentru o anumit\u0103 factur\u0103, la mail fiind anexat un document PDF cu ordin de plat\u0103, precum \u0219i informa\u021bii suplimentare despre tranzac\u021bie, cu specificarea aprob\u0103rii pl\u0103\u021bii cu datele personale \u0219i num\u0103rul contului \u00een care se va efectua plata.<\/span>\r\n\r\n<span style=\"font-weight: 400;\">Sigur, acest mesaj este unul transmis de c\u0103tre atacatori, conceput pentru a p\u0103rea c\u0103 a fost expediat legitim de c\u0103tre banc\u0103, prin copierea identit\u0103\u021bii vizuale (font, logo, adresa), cu scopul de a nu ridica suspiciuni destinatarului.<\/span>\r\n\r\n<span style=\"font-weight: 400;\">Utilizatorul, aflat \u00een fa\u021ba acestei informa\u021bii se poate speria \u0219i poate ac\u021biona pripit, crez\u00e2nd c\u0103 i-au fost sustra\u0219i bani din cont, acceseaz\u0103 acel ata\u0219ament mali\u021bios din mail, care va duce automat la instalarea unei variante de malware. Ata\u0219amentul accesat denumit \u201cordin de plat\u0103\u201d sau \u201c factur\u0103 scadent\u0103\u201d, nu este un document, a\u0219a cum se spune \u00een e-mail, <\/span><span style=\"font-weight: 400;\">ci un fi\u0219ier executabil (.exe), care va instala pe dispozitive varianta de malware denumit\u0103 \u2018Agent Tesla\u2019.\u00a0<\/span>\r\n\r\n<span style=\"font-weight: 400;\">Acest tip de atac\u00a0 malware care are abilitatea de a \u00eenregistra ceea ce tasteaz\u0103 utilizatorul pe dispozitiv, dar \u0219i ce text copiaz\u0103 pe\u00a0<\/span><i><span style=\"font-weight: 400;\">clipboard<\/span><\/i><span style=\"font-weight: 400;\">, iar aceste informa\u021bii sunt transmise mai departe c\u0103tre un server de comand\u0103 \u0219i control (C2), manevrat de atacatori. Practic, atunci c\u00e2nd utilizatorul se conecteaz\u0103 pe conturile personale sau ale companiei pentru care lucreaz\u0103, acele creden\u021biale pot ajunge \u00een posesia atacatorilor f\u0103r\u0103 ca utilizatorul s\u0103 \u0219tie de cele \u00eent\u00e2mplate.<\/span>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-11392ec elementor-widget elementor-widget-heading\" data-id=\"11392ec\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Recomand\u0103ri<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6ed1853 elementor-widget elementor-widget-text-editor\" data-id=\"6ed1853\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ol>\r\n \t<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Pentru a evita astfel de situa\u021bii, se recomand\u0103 vigilen\u021b\u0103, atunci c\u00e2nd se utilieaz\u0103 mediul online. Este important s\u0103 se acorde o aten\u021bie suplimentar\u0103 deoarece po\u021bi primi mesaje-capcan\u0103 prin diverse canale cum ar fi\u00a0 &#8211; e-mail, SMS, re\u021bele sociale, apeluri telefonice &#8211; de la persoane care pretind a fi angaja\u021bi ai b\u0103ncii sau intermediari din partea b\u0103ncii, sau a altor institu\u021bii renumite etc. Analizeaz\u0103 mesajele primite \u00eenainte de a face click pe linkul sau documentul ata\u0219at \u00een aceste medii online;<\/span><\/li>\r\n \t<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Dac\u0103 primi\u021bi un e-mail sau un mesaj din partea b\u0103ncii, verifica\u021bi \u00een primul r\u00e2nd sursa mesajului, din header-ul mail-ului (pe c\u00e2t posibil), deoarece b\u0103ncile nu folosesc mailuri cu adrese care nu con\u021bin numele b\u0103ncii. Uneori expeditorul real este ascuns, adresa fiind\u00a0<\/span><i><span style=\"font-weight: 400;\">spoofed<\/span><\/i><span style=\"font-weight: 400;\">, dar alteori atacatorii se folosesc de un alias, adresa real\u0103 fiind u\u0219or vizibil\u0103 la accesarea sursei acelui mail. A\u0219adar, accesa\u021bi butonul\u00a0<\/span><i><span style=\"font-weight: 400;\">view source\u00a0<\/span><\/i><span style=\"font-weight: 400;\">(vizualizeaz\u0103 sursa mesajului) din mail sau din browserul de internet, pentru a detecta adresa real\u0103 a expeditorului. Este necesar sa confrun\u021bi adresa de email primit\u0103 cu adresa oficial\u0103 care se g\u0103se\u0219te pe site-ul official al b\u0103ncii la care sunte\u021bi client. A\u0219a cum se poate observa din imaginea anexat\u0103, e-mail-ul exemplificat provenea de la o adres\u0103 f\u0103r\u0103 nicio leg\u0103tur\u0103 oficial\u0103 cu banca pe care o impersoneaz\u0103 (tapizadosblanco[@]againtrnet[.]com)<\/span><\/li>\r\n \t<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Dac\u0103 ave\u021bi suspiciuni cu privire la mesajul primit, verifica\u021bi informa\u021bia, inclusiv validarea transmiterii ei c\u0103tre dumneavoastr\u0103 cu expeditorul sau consula\u021bi pagina oficial\u0103 a b\u0103ncii la care sunte\u021bi client.<\/span><\/li>\r\n \t<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Folosi\u021bi o solu\u021bie de securitate pe dispozitive (antivirus sau antimalware) pentru a scana eventuale link-uri sau ata\u0219amente mali\u021bioase. Alternativ, pute\u021bi accesa o astfel de solu\u021bie disponibil\u0103 gratis online, precum VirusTotal.<\/span><\/li>\r\n \t<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Men\u021bine\u021bi sistemul de operare \u0219i software-ul de pe dispozitive actualizat. Actualiz\u0103rile ajut\u0103 la prevenirea posibilelor atacuri de acest gen, ele fiind necesare pentru siguran\u021ba dispozitivelor utilizate de dumneavoastr\u0103.<\/span><\/li>\r\n \t<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Efectua\u021bi regulat copii de siguran\u021b\u0103 a fi\u0219ierelor importante \u0219i stoca\u021bi aceast\u0103 copie pe un mediu extern, deconectat de la dispozitiv. (ideal ar fi sa stoca\u021bi copiile de siguran\u021b\u0103 pe mai multe medii externe).<\/span><\/li>\r\n \t<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Dac\u0103 a\u021bi c\u0103zut victim\u0103 a unui atac de acest tip \u0219i sesiza\u021bi c\u0103 v-au fost extra\u0219i bani din cont, este important s\u0103 contacta\u021bi c\u00e2t mai repede banca, Poli\u021bia (petitii@politiaromana[.]ro) \u0219i\/\u00a0sau la num\u0103rul de urgen\u021b\u0103 1911 dedicat incidentelor de securitate cibernetic\u0103).<\/span><\/li>\r\n<\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-05f3103 elementor-widget elementor-widget-heading\" data-id=\"05f3103\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">De ce nu e indicat s\u0103 pl\u0103te\u0219ti sumele cerute de infactorii cibernetici?<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4fe3644 elementor-widget elementor-widget-text-editor\" data-id=\"4fe3644\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ul>\r\n \t<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Nu exist\u0103 niciun fel de garan\u021bie c\u0103 atacatorul va onora promisiunea \u0219i va reda accesul la date.<\/span><\/li>\r\n \t<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">\u00cen cazul \u00een care pl\u0103tesc, victimele pot fi \u021bintite din nou de atacatori, dat fiind c\u0103 \u00ee\u0219i construiesc \u00een fa\u021ba infractorilor un istoric de bun platnic.<\/span><\/li>\r\n \t<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Fiecare sum\u0103 de bani transferat\u0103 va ajuta dezvoltatorii de ransomware s\u0103 construiasc\u0103 versiuni \u0219i mai complexe \u0219i s\u0103 creasc\u0103 amploarea acestui fenomen. Atacatorii folosesc moneda virtual\u0103 (Bitcoin, Litecoin, Ethereum, etc.) \u0219i este practic imposibil ca banii respectivi s\u0103 fie urm\u0103ri\u021bi.<\/span><\/li>\r\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0ae104d elementor-widget elementor-widget-image\" data-id=\"0ae104d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"623\" height=\"342\" src=\"https:\/\/avestim.com\/wp-content\/uploads\/2022\/05\/Capture7.png\" class=\"attachment-large size-large wp-image-1541\" alt=\"\" srcset=\"https:\/\/avestim.com\/wp-content\/uploads\/2022\/05\/Capture7.png 623w, https:\/\/avestim.com\/wp-content\/uploads\/2022\/05\/Capture7-300x165.png 300w\" sizes=\"(max-width: 623px) 100vw, 623px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Clien\u021bii b\u0103ncilor din Rom\u00e2nia sunt \u00een continuare \u021binta atacurilor cibernetice prin mai multe metode, una din ele fiind atacurile pe e-mail. Un utilizator prime\u0219te pe e-mail \u00een care este informat despre faptul c\u0103 s-a efectuat o plat\u0103 din contul lui sau are de pl\u0103tit o anumit\u0103 sum\u0103 de bani pentru o anumit\u0103 factur\u0103, la mail [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1540,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[21],"tags":[],"class_list":["post-1699","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-ro"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/posts\/1699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/comments?post=1699"}],"version-history":[{"count":1,"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/posts\/1699\/revisions"}],"predecessor-version":[{"id":1700,"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/posts\/1699\/revisions\/1700"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/media\/1540"}],"wp:attachment":[{"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/media?parent=1699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/categories?post=1699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/avestim.com\/ro\/wp-json\/wp\/v2\/tags?post=1699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}