{"id":14391,"date":"2019-09-26T09:18:31","date_gmt":"2019-09-26T01:18:31","guid":{"rendered":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/?p=14391"},"modified":"2019-09-26T13:18:08","modified_gmt":"2019-09-26T05:18:08","slug":"%e8%b3%87%e5%ae%89%e9%a0%90%e8%ad%a6%e6%83%85%e5%a0%b1%e7%99%bc%e5%b8%83%e7%b7%a8%e8%99%9fntusoc-ewa-201909-2197","status":"publish","type":"post","link":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/archives\/14391","title":{"rendered":"\u8cc7\u5b89\u9810\u8b66\u60c5\u5831(\u767c\u5e03\u7de8\u865f:NTUSOC-EWA-201909-2197)"},"content":{"rendered":"
\n
\n
\n
\n
\u8cc7\u5b89\u806f\u7d61\u4eba\u60a8\u597d\uff1a
\n\u6b64\u70ba\u8cc7\u5b89\u9810\u8b66\u60c5\u5831\uff0c\u8acb\u60a8\u5354\u52a9\u78ba\u8a8d\u8cc7\u5b89\u9810\u8b66\u4e8b\u4ef6(EWA)<\/wbr>\u662f\u5426\u78ba\u5be6\u767c\u751f\u3002
\n\u4e26\u767b\u5165\u8cc7\u5b89\u901a\u5831\u5e73\u53f0\u5f8c\uff0c\u65bc\u8cc7\u5b89\u9810\u8b66\u4e8b\u4ef6\u4e2d\u5b8c\u6210\u901a\u5831\u4f5c\u696d\uff0c<\/wbr>\u4f5c\u696d\u8aaa\u660e\u5982\u4e0b\uff1a
\n(\u5982\u9700\u76f8\u95dc\u4f50\u8b49\u8cc7\u6599\uff0c<\/wbr>\u767b\u5165\u901a\u5831\u5e73\u53f0\u5f8c\u65bc\u4e8b\u4ef6\u9644\u6a94\u4e0b\u8f09\u4e2d\u4f9d\u767c\u4f48\u7de8\u865f\u5373\u53ef\u53d6\u5f97\u3002)<\/div>\n
(1) \u8aa4\u5224\uff1a
\n\u7d93\u78ba\u8a8d\u5f8c\u8a2d\u5099\u76f8\u95dc\u8a18\u9304\u7121\u7b26\u5408\u9805\u76ee\uff0c\u9078\u64c7\u300c\u8aa4\u5224\u300d\u9078\u9805\u5f8c\uff0c\u65bc\u300c<\/wbr>\u539f\u56e0\u300d\u8655\u586b\u5beb\u8aaa\u660e\u3002
\n(2) \u78ba\u5be6\u4e8b\u4ef6\uff1a
\n\u7d93\u78ba\u8a8d\u5f8c\u78ba\u5be6\u767c\u751f\u8cc7\u5b89\u4e8b\u4ef6\uff0c<\/wbr>\u8acb\u5148\u65bc\u81ea\u884c\u901a\u5831\u4e2d\u5b8c\u6210\u4e8b\u4ef6\u901a\u5831\u61c9\u8b8a\u5f8c\uff0c\u53d6\u5f97\u4e8b\u4ef6\u55ae\u7de8\u865f\u5f8c\u3002\u9078\u64c7\u300c<\/wbr>\u78ba\u5be6\u4e8b\u4ef6\u300d\u9078\u9805\u5f8c\uff0c\u65bc\u53f3\u5074\u586b\u5165\u81ea\u884c\u901a\u5831\u4e8b\u4ef6\u55ae\u7de8\u865f\u3002
\n(3) \u7121\u6cd5\u5224\u65b7\uff1a
\n\u7d93\u78ba\u8a8d\u5f8c\uff0c\u90e8\u4efd\u8cc7\u6599\u7b26\u5408\u6216\u8a2d\u5099\u76f8\u95dc\u8a18\u9304\u5df2\u4e0d\u5b58\u5728\uff0c\u9078\u64c7\u300c<\/wbr>\u7121\u6cd5\u5224\u65b7\u300d\u9078\u9805\u5f8c\uff0c\u65bc\u300c\u539f\u56e0\u300d\u8655\u586b\u5beb\u8aaa\u660e\u3002\u5982\u679c\u60a8\u5c0d\u6b64\u4e8b\u4ef6\u55ae\u5167\u5bb9\u6709\u7591\u554f\u6216\u6709\u95dc\u65bc\u6b64\u4e8b\u4ef6\u4e4b\u5efa\u8b70\uff0c<\/wbr>\u6b61\u8fce\u8207\u672c\u55ae\u4f4d\u9023\u7d61\u3002<\/p>\n\n\n\n\n\n\n\n\n\n\n
\u539f\u767c\u5e03\u7de8\u865f<\/td>\nNTUSOC-EWA-201909-2197<\/td>\n\u539f\u767c\u5e03\u6642\u9593<\/td>\n2019-09-26 08:10:09<\/td>\n<\/tr>\n
\u4e8b\u4ef6\u985e\u578b<\/td>\n\u53ef\u7591\u9023\u7dda<\/td>\n\u539f\u767c\u73fe\u6642\u9593<\/td>\n2019-09-26 05:49:21<\/td>\n<\/tr>\n
\u4e8b\u4ef6\u4e3b\u65e8<\/td>\n\u6559\u80b2\u90e8\u8cc7\u5b89\u4e8b\u4ef6\u901a\u544a-\u65b0\u5317\u5e02\u4e09\u91cd\u5340\u78a7\u83ef\u570b\u6c11\u5c0f\u5b78[163.20.<\/wbr>169.33]\u4e3b\u6a5f\u7591\u4f3c\u9032\u884c\u60e1\u610f\u7a0b\u5f0f\u9023\u7dda(MALWARE-<\/wbr>CNC DNS suspicious .bit dns query)<\/td>\n<\/tr>\n
\u4e8b\u4ef6\u63cf\u8ff0<\/td>\n\u5165\u4fb5\u5075\u6e2c\u9632\u79a6\u7cfb\u7d71\u5075\u6e2c\u5230\u4f86\u6e90IP\uff08163.20.169.33)<\/wbr>\uff0c\u5305\u542b\u7591\u4f3c\u60e1\u610f\u7a0b\u5f0f\u9023\u7dda\u884c\u70ba\u7279\u5fb5\u4e4b\u5c01\u5305\uff0c\u5c0d\u76ee\u6a19IP\uff08192.<\/wbr>203.230.10\uff09\u9032\u884c\u9023\u7dda\u3002\u6b64\u4e8b\u4ef6\u4f86\u6e90 PORT \uff0858857\uff09\uff0c\u76ee\u6a19 PORT \uff0853\uff09\u3002<\/td>\n<\/tr>\n
\u624b\u6cd5\u7814\u5224<\/td>\n\u8acb\u6aa2\u8996\u4f86\u6e90IP\u8a72\u9023\u7dda\u884c\u70ba\u662f\u5426\u5df2\u5f97\u5230\u5408\u6cd5\u6388\u6b0a\u3002 \u82e5\u4f86\u6e90IP\u8a72\u9023\u7dda\u70ba\u7570\u5e38\u884c\u70ba\uff0c\u53ef\u5148\u5229\u7528\u6383\u6bd2\u8edf\u9ad4\u9032\u884c\u5168\u7cfb\u7d71\u6383\u63cf\uff0c<\/wbr>\u4e26\u5229\u7528ACL\u66ab\u6642\u963b\u64cb\u8a72\u53ef\u7591IP\u3002\u540c\u6642\u5efa\u8b70\u7ba1\u7406\u8005\u9032\u884c\u4ee5\u4e0b\u6aa2\u67e5\uff1a a.\u8acb\u67e5\u770b\u4f86\u6e90IP\u6709\u7121\u7570\u5e38\u52d5\u4f5c(\u5982\uff1a\u65b0\u589e\u5e33\u865f\u3001<\/wbr>\u958b\u555f\u4e0d\u660ePort\u3001\u57f7\u884c\u4e0d\u660e\u7a0b\u5f0f)\u3002 b.\u78ba\u8a8d\u9632\u6bd2\u8edf\u9ad4\u7684\u75c5\u6bd2\u78bc\u5df2\u66f4\u65b0\u70ba\u6700\u65b0\u7248\u672c\uff0c<\/wbr>\u4e26\u9032\u5165\u7cfb\u7d71\u5b89\u5168\u6a21\u5f0f\u4e0b\u884c\u9032\u884c\u5168\u7cfb\u7d71\u6383\u63cf\u4f5c\u696d\u3001<\/wbr>\u7cfb\u7d71\u662f\u5426\u5df2\u5b89\u88dd\u76f8\u95dc\u4fee\u6b63\u6a94\uff0c<\/wbr>\u6216\u95dc\u9589\u4e0d\u4f7f\u7528\u7684\u61c9\u7528\u8edf\u9ad4\u8207\u76f8\u95dc\u901a\u8a0a\u57e0\u3002 \u82e5\u4f86\u6e90IP\u70baDNS server\u3001NAT\u4e3b\u6a5f\u6216IP\u5206\u4eab\u5668\u7b49\u8a2d\u5099IP\u6642\uff0c \u8868\u793a\u6709\u5167\u90e8\u4e3b\u6a5f\u900f\u904e\u9019\u4e9b\u8a2d\u5099\u5411\u5916\u9023\u7dda\u6642\u800c\u89f8\u767c\u5075\u6e2c\u898f\u5247\uff0c \u5247\u9700\u5148\u8acb\u8a2d\u5099\u7ba1\u7406\u8005\u900f\u904e\u4e8b\u4ef6\u55ae\u6240\u9644\u4e4b\u8cc7\u8a0a(\u76ee\u7684\u5730IP\u3001\u6642\u9593\u3001<\/wbr>\u4f86\u6e90port)\uff0c \u4f86\u5354\u52a9\u67e5\u627e\u5167\u90e8\u89f8\u767c\u5075\u6e2c\u898f\u5247\u4e4b\u4e3b\u6a5f\uff0c \u518d\u4f9d\u524d\u8ff0\u5efa\u8b70\u8655\u7406\u63aa\u65bd\u9032\u884c\u4f5c\u696d\u3002<\/td>\n<\/tr>\n
\u5efa\u8b70\u63aa\u65bd<\/td>\nNULL<\/td>\n<\/tr>\n
\u5982\u679c\u6b64\u4e8b\u4ef6\u9700\u8981\u9032\u884c\u901a\u5831\uff0c\u8acb \u8cb4\u55ae\u4f4d\u8cc7\u5b89\u806f\u7d61\u4eba\u767b\u5165\u8cc7\u5b89\u901a\u5831\u61c9\u8b8a\u5e73\u53f0<\/a>\u9032\u884c\u901a\u5831\u61c9\u8b8a\u4f5c\u696d<\/span><\/td>\n<\/tr>\n
\u5982\u679c\u60a8\u5c0d\u6b64\u901a\u544a\u7684\u5167\u5bb9\u6709\u7591\u554f\u6216\u6709\u95dc\u65bc\u6b64\u4e8b\u4ef6\u7684\u5efa\u8b70\uff0c<\/wbr>\u6b61\u8fce\u8207\u6211\u5011\u9023\u7d61\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
<\/div>\n

\u672c\u6821\u8655\u7406\u60c5\u5f62\uff1a<\/h3>\n
    \n
  • \u7814\u5224\uff1a\u8aa4\u5224<\/li>\n
  • \u539f\u56e0\uff1a163.20.169.33\u70ba\u672c\u6821\u6821\u5167DNS\u4f3a\u670d\u5668\uff0c\u6b64\u70ba\u6b63\u5e38\u9023\u7dda\u884c\u70ba\u3002<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    \u8cc7\u5b89\u806f\u7d61\u4eba\u60a8\u597d\uff1a \u6b64\u70ba\u8cc7\u5b89\u9810\u8b66\u60c5\u5831\uff0c\u8acb\u60a8\u5354\u52a9\u78ba\u8a8d\u8cc7\u5b89\u9810\u8b66\u4e8b\u4ef6(EWA)\u662f\u5426\u78ba\u5be6\u767c\u751f\u3002 \u4e26\u767b\u5165\u8cc7\u5b89\u901a\u5831\u5e73\u53f0\u5f8c\uff0c\u65bc\u8cc7\u5b89\u9810\u8b66\u4e8b\u4ef6\u4e2d\u5b8c\u6210\u901a\u5831\u4f5c\u696d\uff0c\u4f5c\u696d\u8aaa\u660e\u5982\u4e0b\uff1a (\u5982\u9700\u76f8\u95dc\u4f50\u8b49\u8cc7\u6599\uff0c\u767b\u5165\u901a\u5831\u5e73\u53f0\u5f8c\u65bc\u4e8b\u4ef6\u9644\u6a94\u4e0b\u8f09\u4e2d\u4f9d\u767c\u4f48\u7de8\u865f\u5373\u53ef\u53d6\u5f97\u3002) (1) \u8aa4\u5224\uff1a \u7d93\u78ba\u8a8d\u5f8c\u8a2d\u5099\u76f8\u95dc\u8a18\u9304\u7121\u7b26\u5408\u9805\u76ee\uff0c\u9078\u64c7\u300c\u8aa4\u5224\u300d\u9078\u9805\u5f8c\uff0c\u65bc\u300c\u539f\u56e0\u300d\u8655\u586b\u5beb\u8aaa\u660e\u3002 (2) \u78ba\u5be6\u4e8b\u4ef6\uff1a \u7d93\u78ba\u8a8d\u5f8c\u78ba\u5be6\u767c\u751f\u8cc7\u5b89\u4e8b\u4ef6\uff0c\u8acb\u5148\u65bc\u81ea\u884c\u901a\u5831\u4e2d\u5b8c\u6210\u4e8b\u4ef6\u901a\u5831\u61c9\u8b8a\u5f8c\uff0c\u53d6\u5f97\u4e8b\u4ef6\u55ae\u7de8\u865f\u5f8c\u3002\u9078\u64c7\u300c\u78ba\u5be6\u4e8b\u4ef6\u300d\u9078\u9805\u5f8c\uff0c\u65bc\u53f3\u5074\u586b\u5165\u81ea\u884c\u901a\u5831\u4e8b\u4ef6\u55ae\u7de8\u865f\u3002 (3) \u7121\u6cd5\u5224\u65b7\uff1a \u7d93\u78ba\u8a8d\u5f8c\uff0c\u90e8\u4efd\u8cc7\u6599\u7b26\u5408\u6216\u8a2d\u5099\u76f8\u95dc\u8a18\u9304\u5df2\u4e0d\u5b58\u5728\uff0c\u9078\u64c7\u300c\u7121\u6cd5\u5224\u65b7\u300d\u9078\u9805\u5f8c\uff0c\u65bc\u300c\u539f\u56e0\u300d\u8655\u586b\u5beb\u8aaa\u660e\u3002\u5982\u679c\u60a8\u5c0d\u6b64\u4e8b\u4ef6\u55ae\u5167\u5bb9\u6709\u7591\u554f\u6216\u6709\u95dc\u65bc\u6b64\u4e8b\u4ef6\u4e4b\u5efa\u8b70\uff0c\u6b61\u8fce\u8207\u672c\u55ae\u4f4d\u9023\u7d61\u3002<\/p>\n

    \u539f\u767c\u5e03\u7de8\u865f NTUSOC-EWA-201909-2197 \u539f\u767c\u5e03\u6642\u9593 2019-09-26 08:10:09 \u4e8b\u4ef6\u985e\u578b \u53ef\u7591\u9023\u7dda \u539f\u767c\u73fe\u6642\u9593 2019-09-26 05:49:21 \u4e8b\u4ef6\u4e3b\u65e8 \u6559\u80b2\u90e8\u8cc7\u5b89\u4e8b\u4ef6\u901a\u544a-\u65b0\u5317\u5e02\u4e09\u91cd\u5340\u78a7\u83ef\u570b\u6c11\u5c0f\u5b78[163.20.169.33]\u4e3b\u6a5f\u7591\u4f3c\u9032\u884c\u60e1\u610f\u7a0b\u5f0f\u9023\u7dda(MALWARE-CNC DNS suspicious .bit dns query) \u4e8b\u4ef6\u63cf\u8ff0 \u5165\u4fb5\u5075\u6e2c\u9632\u79a6\u7cfb\u7d71\u5075\u6e2c\u5230\u4f86\u6e90IP\uff08163.20.169.33)\uff0c\u5305\u542b\u7591\u4f3c\u60e1\u610f\u7a0b\u5f0f\u9023\u7dda\u884c\u70ba\u7279\u5fb5\u4e4b\u5c01\u5305\uff0c\u5c0d\u76ee\u6a19IP\uff08192.203.230.10\uff09\u9032\u884c\u9023\u7dda\u3002\u6b64\u4e8b\u4ef6\u4f86\u6e90 PORT \uff0858857\uff09\uff0c\u76ee\u6a19 PORT \uff0853\uff09\u3002 \u624b\u6cd5\u7814\u5224 \u8acb\u6aa2\u8996\u4f86\u6e90IP\u8a72\u9023\u7dda\u884c\u70ba\u662f\u5426\u5df2\u5f97\u5230\u5408\u6cd5\u6388\u6b0a\u3002 \u82e5\u4f86\u6e90IP\u8a72\u9023\u7dda\u70ba\u7570\u5e38\u884c\u70ba\uff0c\u53ef\u5148\u5229\u7528\u6383\u6bd2\u8edf\u9ad4\u9032\u884c\u5168\u7cfb\u7d71\u6383\u63cf\uff0c\u4e26\u5229\u7528ACL\u66ab\u6642\u963b\u64cb\u8a72\u53ef\u7591IP\u3002\u540c\u6642\u5efa\u8b70\u7ba1\u7406\u8005\u9032\u884c\u4ee5\u4e0b\u6aa2\u67e5\uff1a a.\u8acb\u67e5\u770b\u4f86\u6e90IP\u6709\u7121\u7570\u5e38\u52d5\u4f5c(\u5982\uff1a\u65b0\u589e\u5e33\u865f\u3001\u958b\u555f\u4e0d\u660ePort\u3001\u57f7\u884c\u4e0d\u660e\u7a0b\u5f0f)\u3002 b.\u78ba\u8a8d\u9632\u6bd2\u8edf\u9ad4\u7684\u75c5\u6bd2\u78bc\u5df2\u66f4\u65b0\u70ba\u6700\u65b0\u7248\u672c\uff0c\u4e26\u9032\u5165\u7cfb\u7d71\u5b89\u5168\u6a21\u5f0f\u4e0b\u884c\u9032\u884c\u5168\u7cfb\u7d71\u6383\u63cf\u4f5c\u696d\u3001\u7cfb\u7d71\u662f\u5426\u5df2\u5b89\u88dd\u76f8\u95dc\u4fee\u6b63\u6a94\uff0c\u6216\u95dc\u9589\u4e0d\u4f7f\u7528\u7684\u61c9\u7528\u8edf\u9ad4\u8207\u76f8\u95dc\u901a\u8a0a\u57e0\u3002 \u82e5\u4f86\u6e90IP\u70baDNS server\u3001NAT\u4e3b\u6a5f\u6216IP\u5206\u4eab\u5668\u7b49\u8a2d\u5099IP\u6642\uff0c \u8868\u793a\u6709\u5167\u90e8\u4e3b\u6a5f\u900f\u904e\u9019\u4e9b\u8a2d\u5099\u5411\u5916\u9023\u7dda\u6642\u800c\u89f8\u767c\u5075\u6e2c\u898f\u5247\uff0c \u5247\u9700\u5148\u8acb\u8a2d\u5099\u7ba1\u7406\u8005\u900f\u904e\u4e8b\u4ef6\u55ae\u6240\u9644\u4e4b\u8cc7\u8a0a(\u76ee\u7684\u5730IP\u3001\u6642\u9593\u3001\u4f86\u6e90port)\uff0c \u4f86\u5354\u52a9\u67e5\u627e\u5167\u90e8\u89f8\u767c\u5075\u6e2c\u898f\u5247\u4e4b\u4e3b\u6a5f\uff0c \u518d\u4f9d\u524d\u8ff0\u5efa\u8b70\u8655\u7406\u63aa\u65bd\u9032\u884c\u4f5c\u696d\u3002 \u5efa\u8b70\u63aa\u65bd NULL \u5982\u679c\u6b64\u4e8b\u4ef6\u9700\u8981\u9032\u884c\u901a\u5831\uff0c\u8acb \u8cb4\u55ae\u4f4d\u8cc7\u5b89\u806f\u7d61\u4eba\u767b\u5165\u8cc7\u5b89\u901a\u5831\u61c9\u8b8a\u5e73\u53f0\u9032\u884c\u901a\u5831\u61c9\u8b8a\u4f5c\u696d \u5982\u679c\u60a8\u5c0d\u6b64\u901a\u544a\u7684\u5167\u5bb9\u6709\u7591\u554f\u6216\u6709\u95dc\u65bc\u6b64\u4e8b\u4ef6\u7684\u5efa\u8b70\uff0c\u6b61\u8fce\u8207\u6211\u5011\u9023\u7d61\u3002 \u672c\u6821\u8655\u7406\u60c5\u5f62\uff1a \u7814\u5224\uff1a\u8aa4\u5224 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"_links":{"self":[{"href":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/posts\/14391"}],"collection":[{"href":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/comments?post=14391"}],"version-history":[{"count":0,"href":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/posts\/14391\/revisions"}],"wp:attachment":[{"href":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/media?parent=14391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/categories?post=14391"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/tags?post=14391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}