发帖
扫码访问
 注册
 登录
首页 ›资讯› 安全 › 查看内容

荷兰网络安全公司Fox-IT遭遇中间人攻击

2017-12-22 00:54 |来自: 互联网 8577 0

摘要: 12月21日讯 位于荷兰的IT安全提供商Fox-IT披露，曾在2017年9月遭到不明身份的黑客发起的中间人攻击，攻击持续10个小时24分钟。攻击过程Fox-IT表示，黑客劫持了公司的域名，随后以Fox-IT的名义获取SSL证书。之后，黑 ...

12月21日讯 位于荷兰的IT安全提供商Fox-IT披露，曾在2017年9月遭到不明身份的黑客发起的中间人攻击，攻击持续10个小时24分钟。

攻击过程

Fox-IT表示，黑客劫持了公司的域名，随后以Fox-IT的名义获取SSL证书。之后，黑客将域名指向受控的私有VPS（虚拟专用服务器）服务器，进而执行中间人攻击，接收本应流向Fox-IT域名的流量，凭借SSL证书读取HTTPS连接的内容，随后将用户重定向回真正的Fox-IT服务器。

黑客仅以Fox-IT的用户门户网站为目标

Fox-IT表示，黑客只对拦截ClientPortal网站的流量感兴趣。攻击者拦截了登录尝试、凭证和发送给ClientPortal的文件，共拦截了9名用户的凭证和12份文件。

受影响用户数量不多的原因在于，Fox-IT在事发5个小时后检测到了这起域名劫持事件和中间人攻击，并禁用了双因素认证服务，从而有效地阻止用户登录并暴露其它重要的文件和数据。

除此之外，Fox-IT迅速通知了受影响的客户，并重置了遭拦截的密码。Fox-IT表示，遭拦截的文件中并不包含“机密”文件，只有少数文件包含敏感信息。其它文件和数据包含手机号码、ClientPortal用户的名称和电子邮箱，以及ClientPortal账户名。

Fox-IT遭遇攻击后如何响应？

Fox-IT表示，行业平均检测威胁所需时间为几周，而他们的速度明显超出平均水平。这家公司还表示已向荷兰执法机构上报了该事件。这起攻击从发生到披露的详细时间如下：

  • 2017年9月16日：攻击者针对Fox-IT的基础设施展开首次探测活动，包括常规的端口 扫描漏洞扫描和其它扫描活动。

  • 2017年9月19日, 00:38：攻击者第三方提供商处修改了fox-it.com 域名的DNS记录。

  • 2017年9月19日, 02:02： 这是Fox-IT能够确定clientportal.fox-it.com仍指向合法ClientPortal 服务器的最后时间，当时流向ClientPortal的流量未遭遇拦截。

  • 2017年9月19日, 02:05-02:15：攻击者临时重定向并拦截了Fox-IT的电子邮件，其目的是为了证明他们在为ClientPortal 注册虚假SSL证书的过程中获取了Fox-IT的域名。

  • 2017年9月19日, 02:21：真正开始启动针对ClientPortal中间人攻击。此时，ClientPortal的欺骗性SSL证书已到位，clientportal.fox-it.com的IPDNS记录已被修改指向国外VPS提供商。

  • 2017年9月19日, 07:25：经Fox-IT判断，fox-it.com的域名服务器已被重定向，而这种更改操作并未经过授权。Fox-IT将DNS设置改回自己的域名服务器，并修改了域名注册账户的密码。由于域名名称系统的缓存和分布式性质，修改需要一定的时间完全生效。

  • 2017年9月19日, 12:45：Fox-IT禁用了ClientPortal登录认证系统的双因素验证（通过文本信息），从而有效阻止ClientPortal用户成功登录后遭遇流量拦截。此外，为了不打草惊蛇Fox-IT仍保持ClientPortal正常运作。此时，从技术角度来讲中间人攻击仍然处于活跃状态，但却也无法接收流量实施拦截，因为用户无法执行双因素验证和登录操作。

  • 2017年9月19日-20日：Fox-IT对此展开完整的调查，同时通知了受影响的所有用户和荷兰数据保护局等相关方。警方为此展开调查。基于Fox-IT的调查，攻击已得到全面控制，该公司正准备在ClientPortal上重新启用双因素认证。

  • 2017年9月20日, 15:38：ClientPortal恢复正常运行。Fox-IT的内部调查工作仍在继续。

E安全注：本文系E安全独家编译报道，转载请联系授权，并保留出处与链接，不得删减内容。

, groupId: 6501915793624662541, itemId: 6501915793624662541, type: 1, subInfo: { isOriginal: true, source: E安全, time: 2017-12-21 16:33:59 }, tagInfo: { tags: [{"name":"网络安全"},{"name":"黑客"},{"name":"DNS"},{"name":"科技"}], groupId: 6501915793624662541, itemId: 6501915793624662541, repin: 0, }, has_extern_link: 1 }, commentInfo: { groupId: 6501915793624662541, itemId: 6501915793624662541, comments_count: 0, ban_comment: 0 }, mediaInfo: { uid: 5499921668, name: E安全, avatar: //p2.pstatp.com/large/8105/444289872, openUrl: /c/user/5499921668/, follow: false }, pgcInfo: {"media_info":{"open_url":"/c/user/5499921668/","avatar_url":"https://p2.pstatp.com/large/8105/444289872","media_id":5498191508,"name":"E安全","user_verified":false},"articles":[{"item_id":"6501921477770609165","url":"/item/6501921477770609165","title":"WAGO快速反应就其PLC部分产品漏洞发布缓解措施"},{"item_id":"6501915793624662541","url":"/item/6501915793624662541","title":"荷兰网络安全公司Fox-IT遭遇中间人攻击"},{"item_id":"6501877915821556237","url":"/item/6501877915821556237","title":"美陆军将调整结构，整合网络、电子战、信号和太空部队力量"},{"item_id":"6501874978592391693","url":"/item/6501874978592391693","title":"中国神秘黑客组织被曝专黑SQL类数据库"}]}, feedInfo: { url: /api/pc/feed/, category: __all__, initList: [{"comments_count":9,"media_avatar_url":"//p5a.pstatp.com/large/509500044769bf18d4e1","is_feed_ad":false,"is_diversion_page":false,"title":"小心这是为战争造势！美英先后宣称遭半岛北方攻击，可靠性存疑","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6501795599971516942/","source":"阿尔法军事","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":8,"image_url":"//p1.pstatp.com/list/190x124/4e7f0004c9d5751fbeff","group_id":"6501795599971516942","is_related":true,"media_url":"/c/user/60758115490/"},{"comments_count":1,"media_avatar_url":"//p1.pstatp.com/large/4b060003e2dee3ed9db1","is_feed_ad":false,"is_diversion_page":false,"title":"HADES创造了替代现实来误导黑客","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6499978670252229133/","source":"BaSierL","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e71000149b69ebbfb32","group_id":"6499978670252229133","is_related":true,"media_url":"/c/user/73486075662/"},{"comments_count":0,"media_avatar_url":"//p3.pstatp.com/large/46e80003c98b9bfd77be","is_feed_ad":false,"is_diversion_page":false,"title":"年度回顾：2017年值得关注的10起数据泄露事件","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6500690424875713037/","source":"黑客视界","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e74000352f7150b8051","group_id":"6500690424875713037","is_related":true,"media_url":"/c/user/76207630046/"},{"comments_count":60,"media_avatar_url":"//p3.pstatp.com/large/18a50002c201e30aaee5","is_feed_ad":false,"is_diversion_page":false,"title":"吹个口哨都能引爆核弹，这个全球最牛逼黑客，祸害了美国整整10年","single_mode":true,"gallary_image_count":16,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6500028511598674445/","source":"连锁人雷超","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e6d00039d170bc51bde","group_id":"6500028511598674445","is_related":true,"media_url":"/c/user/55578834374/"},{"comments_count":0,"media_avatar_url":"//p9.pstatp.com/large/150d0014d8ef8607e39f","is_feed_ad":false,"is_diversion_page":false,"title":"nginx设置HTTP响应头","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6501875066475659790/","source":"GDCA数安时代","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/50970004057fc1186192","group_id":"6501875066475659790","is_related":true,"media_url":"/c/user/55453293216/"},{"comments_count":226,"media_avatar_url":"//p7.pstatp.com/large/470a00032f201039b7fc","is_feed_ad":false,"is_diversion_page":false,"title":"教你通过正规渠道免费查看下载万方、知网、维普、超星等学术期刊","single_mode":true,"gallary_image_count":14,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6501562455045440013/","source":"程序狼","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":1,"image_url":"//p1.pstatp.com/list/190x124/509300035abc95c1b96b","group_id":"6501562455045440013","is_related":true,"media_url":"/c/user/6725356429/"},{"comments_count":340,"media_avatar_url":"//p3.pstatp.com/large/216c00024e2c87427b4c","is_feed_ad":false,"is_diversion_page":false,"title":"你上的可能是一个假的互联网！","single_mode":true,"gallary_image_count":7,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6501071988151288334/","source":"3N技术VC","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":6,"image_url":"//p9.pstatp.com/list/190x124/4e7c00027901e1d47e26","group_id":"6501071988151288334","is_related":true,"media_url":"/c/user/60991020340/"},{"comments_count":2,"media_avatar_url":"//p4.pstatp.com/large/46c500052acb6fa38178","is_feed_ad":false,"is_diversion_page":false,"title":"黑客界在平常交流的一些专业术语介绍","single_mode":true,"gallary_image_count":5,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499920143659827725/","source":"王文新","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e6b0002c355ed25ec55","group_id":"6499920143659827725","is_related":true,"media_url":"/c/user/5931095751/"},{"comments_count":6,"media_avatar_url":"//p3.pstatp.com/large/249a002445fa1f3d2ccd","is_feed_ad":false,"is_diversion_page":false,"title":"网络技术中的VPN技术","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6501096164148904461/","source":"无情河边柳","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/4e7c0002fbd82bba4987","group_id":"6501096164148904461","is_related":true,"media_url":"/c/user/4674407562/"},{"comments_count":30,"media_avatar_url":"//p3.pstatp.com/large/4e62000076739a91a535","is_feed_ad":false,"is_diversion_page":false,"title":"「菜鸟玩黑」学习黑客入门必备资料，5G黑客教程书籍（收藏备用）","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6501095095662543373/","source":"学习资料库","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/4e7b0003331b114e5f85","group_id":"6501095095662543373","is_related":true,"media_url":"/c/user/72072400351/"},{"comments_count":2,"media_avatar_url":"//p1.pstatp.com/large/e5800071d8f5b95be4f","is_feed_ad":false,"is_diversion_page":false,"title":"用Wireshark解密https流量","single_mode":true,"gallary_image_count":8,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6501814514084741646/","source":"课课家","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/509700030c0bddabbeb4","group_id":"6501814514084741646","is_related":true,"media_url":"/c/user/51034626603/"},{"comments_count":22,"media_avatar_url":"//p2.pstatp.com/large/2876/7008842189","is_feed_ad":false,"is_diversion_page":false,"title":"钉钉不停，快速响应，中国石化管道储运有限公司打赢病毒防卫战","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6501908982121103886/","source":"小E搞机","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/50970004970e3431664d","group_id":"6501908982121103886","is_related":true,"media_url":"/c/user/3722012104/"},{"comments_count":3,"media_avatar_url":"//p1.pstatp.com/large/4b0100026274e1b075d9","is_feed_ad":false,"is_diversion_page":false,"title":"数据库技术之读写分离","single_mode":true,"gallary_image_count":30,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6500704271288238605/","source":"我是一只燃烧的火鸟","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/4e76000348285bbd632b","group_id":"6500704271288238605","is_related":true,"media_url":"/c/user/5544662271/"},{"comments_count":0,"media_avatar_url":"//p3.pstatp.com/large/1545/5617118728","is_feed_ad":false,"is_diversion_page":false,"title":"联手摩拜实现“智能+出行”，腾讯云描绘智慧城市蓝图","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6501940589603324430/","source":"路北","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":12327,"image_url":"//p9.pstatp.com/list/190x124/509d000001e616788390","group_id":"6501940589603324430","is_related":true,"media_url":"/c/user/3661128501/"},{"media_avatar_url":"//p1.pstatp.com/large/6cb0000f96a0017fdc5","is_feed_ad":false,"is_diversion_page":false,"title":"榆林网警提醒：突然收到这类短信，里面的链接一定不能点！","single_mode":false,"gallary_image_count":0,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6501542686275666446/","source":"榆林网警巡查执法","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":1,"comments_count":2,"group_id":"6501542686275666446","is_related":true,"media_url":"/c/user/6566313126/"},{"comments_count":1,"media_avatar_url":"//p4.pstatp.com/large/46c500052acb6fa38178","is_feed_ad":false,"is_diversion_page":false,"title":"TCP/IP技术：DNS基础知识","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6501412660859372046/","source":"王文新","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/50920003986e39a0dbf2","group_id":"6501412660859372046","is_related":true,"media_url":"/c/user/5931095751/"},{"comments_count":0,"media_avatar_url":"//p3.pstatp.com/large/6cb002656015dc9db9f","is_feed_ad":false,"is_diversion_page":false,"title":"网易易盾：详解DDoS防护之TCP（二）","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6501916950334013965/","source":"网易邮报","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/509b000150f971235dea","group_id":"6501916950334013965","is_related":true,"media_url":"/c/user/6610089136/"},{"comments_count":19,"media_avatar_url":"//p3.pstatp.com/large/bc20017166607b65481","is_feed_ad":false,"is_diversion_page":false,"title":"感染型病毒一个传染俩 Win10用户用哪款杀软最放心？","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6501553270622781965/","source":"智科技世界","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/50960001cce66055d43c","group_id":"6501553270622781965","is_related":true,"media_url":"/c/user/50368702885/"},{"comments_count":66,"media_avatar_url":"//p3.pstatp.com/large/4372000323f4410377ab","is_feed_ad":false,"is_diversion_page":false,"title":"五五开事件后续，输入guabi.tv直达海鲜TV, 吓得海鲜台直接报警！","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6501601286138364430/","source":"王者小易","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":2,"image_url":"//p3.pstatp.com/list/190x124/4e7f0003ff02f0ab681e","group_id":"6501601286138364430","is_related":true,"media_url":"/c/user/74452869172/"},{"comments_count":7,"media_avatar_url":"//p3.pstatp.com/large/3afe000345b1c5d9dcd2","is_feed_ad":false,"is_diversion_page":false,"title":"网络配置命令Netsh","single_mode":true,"gallary_image_count":18,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499586835704971789/","source":"IT知识梳理","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/4e780003954047d6a020","group_id":"6499586835704971789","is_related":true,"media_url":"/c/user/69594148453/"}] }, shareInfo: { shareUrl: https://m.toutiao.com/group/6501915793624662541/, abstract: E安全12月21日讯 位于荷兰的IT安全提供商Fox-IT披露，曾在2017年9月遭到不明身份的黑客发起的中间人攻击，攻击持续10个小时24分钟。攻击过程Fox-IT表示，黑客劫持了公司的域名，随后以Fox-IT的名义获取SSL证书。
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系 [邮箱地址] 删除

路过
雷人
握手
鲜花
鸡蛋
收藏 分享 邀请
上一篇：WordPress插件后门影响30万个网站 新型安卓木马2天销毁一部手机下一篇：俄罗斯Windows XP ATM机轻松被黑：连按五次Shift

最新评论

相关分类

返回顶部