{"id":4152,"date":"2022-12-21T21:10:40","date_gmt":"2022-12-21T20:10:40","guid":{"rendered":"https:\/\/sajberinfo.com\/?p=4152"},"modified":"2022-12-21T21:10:40","modified_gmt":"2022-12-21T20:10:40","slug":"play-ransomware-napada-microsoft-exchange-servere","status":"publish","type":"post","link":"https:\/\/sajberinfo.com\/en\/2022\/12\/21\/play-ransomware-napada-microsoft-exchange-servere\/","title":{"rendered":"Play ransomware napada Microsoft Exchange servere"},"content":{"rendered":"<p><span style=\"font-size: 14pt;\">Sigurnosni istra\u017eiva\u010di kompanije <em>CrowdStrike<\/em> su otkrili da <em>Play ransomware<\/em> koristi novu metodu za iskori\u0161tavanje poznatih ranjivosti <em>CVE-2022-41080<\/em> i <em>CVE-2022-41082<\/em>, odnosno <em>NotProxyShell <\/em>ranjivosti.<\/span><\/p>\n<div id=\"attachment_4153\" style=\"width: 1034px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-4153\" class=\"size-full wp-image-4153\" src=\"https:\/\/sajberinfo.com\/wp-content\/uploads\/2022\/12\/microsoft-exchange-cve.jpg\" alt=\"ms-exchange-cve\" width=\"1024\" height=\"683\" srcset=\"https:\/\/sajberinfo.com\/wp-content\/uploads\/2022\/12\/microsoft-exchange-cve.jpg 1024w, https:\/\/sajberinfo.com\/wp-content\/uploads\/2022\/12\/microsoft-exchange-cve-300x200.jpg 300w, https:\/\/sajberinfo.com\/wp-content\/uploads\/2022\/12\/microsoft-exchange-cve-768x512.jpg 768w, https:\/\/sajberinfo.com\/wp-content\/uploads\/2022\/12\/microsoft-exchange-cve-18x12.jpg 18w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><p id=\"caption-attachment-4153\" class=\"wp-caption-text\">Microsoft Exchange OWASSRF ranjivost; Desing by Sa\u0161a \u0110uri\u0107<\/p><\/div>\n<p><span style=\"font-size: 14pt;\">Ova ranjivost zaobilazi <em>ProxyNotShell<\/em> ispravak za ponovno pisanje <em>URL<\/em>-a, kako bi se postiglo daljinsko izvr\u0161enje k\u00f4da na ranjivim serverima preko <em>Outlook Web<\/em> pristupa. Ranjivost je nazvana <em>OWASSRF<\/em> i mo\u017ee se zaustaviti samo primjenom sigurnosnog a\u017euriranja za <em>Microsoft Exchange<\/em> iz novembra 2022. godine.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-size: 14pt;\">Nakon dobijanja pristupa serveru, zlonamjerni akteri koriste legalne aplikacije <em>Plink<\/em>, <em>AnyDesk<\/em> i <em>ConnectWise<\/em>\u00a0 kako bi zadr\u017eali pristup i onemogu\u0107ili forenzi\u010dke tehnike poku\u0161avaju\u0107i da \u0161to du\u017ee sakriju svoje aktivnosti. Organizacije koje koriste lokalni <em>Microsoft Exchange<\/em> server bi trebalo da onemogu\u0107e <em>Outlook Web Application<\/em> (<em>OWA<\/em>) sve dok ne primjene sigurnosno a\u017euriranje za ranjivost <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2022-41080\" target=\"_blank\" rel=\"noopener\"><em>CVE-2022-41080<\/em><\/a> ili da primjene posljednja dostupna a\u017euriranja za <em>Exchange <\/em>server sa tim da je a\u017euriranje iz novembra 2022. godine minimum.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-size: 14pt;\">Sigurnosni istra\u017eiva\u010di iz kompanije <em>CrowdStrike <\/em>su objavili detaljne informacije <a href=\"https:\/\/www.crowdstrike.com\/blog\/owassrf-exploit-analysis-and-recommendations\/\" target=\"_blank\" rel=\"noopener\">ovdje<\/a>.<\/span><\/p>","protected":false},"excerpt":{"rendered":"<p>Sigurnosni istra\u017eiva\u010di kompanije CrowdStrike su otkrili da Play ransomware koristi novu metodu za iskori\u0161tavanje poznatih ranjivosti CVE-2022-41080 i CVE-2022-41082, odnosno NotProxyShell ranjivosti. Ova ranjivost zaobilazi ProxyNotShell ispravak za ponovno pisanje URL-a, kako bi se&#46;&#46;&#46;<\/p>","protected":false},"author":1,"featured_media":4153,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[255,257,256,133],"class_list":["post-4152","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hronike","tag-microsoft-exchange","tag-notproxyshell","tag-owa","tag-ransomware"],"_links":{"self":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts\/4152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/comments?post=4152"}],"version-history":[{"count":0,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts\/4152\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/media\/4153"}],"wp:attachment":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/media?parent=4152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/categories?post=4152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/tags?post=4152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}