{"id":14794,"date":"2019-11-11T10:15:33","date_gmt":"2019-11-11T02:15:33","guid":{"rendered":"http:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/?p=14794"},"modified":"2019-11-18T10:56:04","modified_gmt":"2019-11-18T02:56:04","slug":"%e8%b3%87%e8%a8%8a%e5%ae%89%e5%85%a8","status":"publish","type":"post","link":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/archives\/14794","title":{"rendered":"\u78a7\u83ef\u570b\u5c0f\u8cc7\u5b89\u901a\u5831-\u5165\u4fb5\u4e8b\u4ef6\u8b66\u8a0a(1081111)"},"content":{"rendered":"

\u6559\u80b2\u6a5f\u69cb\u8cc7\u5b89\u901a\u5831\u5e73\u53f0<\/h3>\n

\u4e8b\u4ef6\u985e\u578b:\u5165\u4fb5\u4e8b\u4ef6\u8b66\u8a0a<\/h4>\n

\u4e8b\u4ef6\u55ae\u7de8\u865f:AISAC-175382<\/h4>\n\n\n\n\n\n\n\n\n\n
\u539f\u767c\u5e03\u7de8\u865f<\/td>\nNTUSOC-INT-201911-0781<\/td>\n\u539f\u767c\u5e03\u6642\u9593<\/td>\n2019-11-11 09:15:16<\/td>\n<\/tr>\n
\u4e8b\u4ef6\u985e\u578b<\/td>\n\u6bad\u5c4d\u96fb\u8166(Bot)<\/td>\n\u539f\u767c\u73fe\u6642\u9593<\/td>\n2019-11-11 07:57:28<\/td>\n<\/tr>\n
\u4e8b\u4ef6\u4e3b\u65e8<\/td>\n\u6559\u80b2\u90e8\u8cc7\u5b89\u4e8b\u4ef6\u901a\u544a-\u65b0\u5317\u5e02\u6559\u80b2\u7db2\u8def\u4e2d\u5fc3[163.20.242.17]\u4e3b\u6a5f\u9032\u884c\u60e1\u610f\u7a0b\u5f0f\u9023\u7dda(MALWARE-CNC Win.Trojan.Glupteba.M initial outbound connection)<\/td>\n<\/tr>\n
\u4e8b\u4ef6\u63cf\u8ff0<\/td>\n\u5165\u4fb5\u5075\u6e2c\u9632\u79a6\u7cfb\u7d71\u5075\u6e2c\u5230\u4f86\u6e90IP\uff08163.20.242.17)\uff0c\u5305\u542b\u7591\u4f3c\u60e1\u610f\u7a0b\u5f0f\u9023\u7dda\u884c\u70ba\u7279\u5fb5\u4e4b\u5c01\u5305\uff0c\u5c0d\u76ee\u6a19IP\uff085.9.157.50\uff09\u9032\u884c\u9023\u7dda\u3002\u6b64\u4e8b\u4ef6\u4f86\u6e90\u00a0PORT\u00a0\uff0849208\uff09\uff0c\u76ee\u6a19\u00a0PORT\u00a0\uff088000\uff09\u3002<\/td>\n<\/tr>\n
\u624b\u6cd5\u7814\u5224<\/td>\n\u4f86\u6e90IP\u4e3b\u6a5f\u53ef\u80fd\u5b58\u5728\u672a\u4fee\u88dc\u4e4b\u5f31\u9ede\u906d\u99ed\u5ba2\u653b\u64ca\uff0c\u611f\u67d3\u60e1\u610f\u7a0b\u5f0f\u6216\u906d\u690d\u5165\u6728\u99ac\u7a0b\u5f0f\u5c0e\u81f4\u89f8\u767c\u6b64\u4e8b\u4ef6\uff0c\u5c07\u53ef\u80fd\u5c0e\u81f4\u4e3b\u6a5f\u6a5f\u654f\u8cc7\u6599\u5916\u6d29\uff0c\u6216\u6210\u70ba\u6bad\u5c4d\u7db2\u8def\u4e00\u54e1\u800c\u5c0d\u5916\u767c\u52d5\u653b\u64ca\u3002<\/td>\n<\/tr>\n
\u5efa\u8b70\u63aa\u65bd<\/td>\n\u8acb\u6aa2\u8996\u4f86\u6e90IP\u8a72\u9023\u7dda\u884c\u70ba\u662f\u5426\u5df2\u5f97\u5230\u5408\u6cd5\u6388\u6b0a\u3002 \u82e5\u4f86\u6e90IP\u8a72\u9023\u7dda\u70ba\u7570\u5e38\u884c\u70ba\uff0c\u53ef\u5148\u5229\u7528\u6383\u6bd2\u8edf\u9ad4\u9032\u884c\u5168\u7cfb\u7d71\u6383\u63cf\uff0c\u4e26\u5229\u7528ACL\u66ab\u6642\u963b\u64cb\u8a72\u53ef\u7591IP\u3002\u540c\u6642\u5efa\u8b70\u7ba1\u7406\u8005\u9032\u884c\u4ee5\u4e0b\u6aa2\u67e5\uff1a\u00a0a.\u8acb\u67e5\u770b\u4f86\u6e90IP\u6709\u7121\u7570\u5e38\u52d5\u4f5c(\u5982\uff1a\u65b0\u589e\u5e33\u865f\u3001\u958b\u555f\u4e0d\u660ePort\u3001\u57f7\u884c\u4e0d\u660e\u7a0b\u5f0f)\u3002\u00a0b.\u78ba\u8a8d\u9632\u6bd2\u8edf\u9ad4\u7684\u75c5\u6bd2\u78bc\u5df2\u66f4\u65b0\u70ba\u6700\u65b0\u7248\u672c\uff0c\u4e26\u9032\u5165\u7cfb\u7d71\u5b89\u5168\u6a21\u5f0f\u4e0b\u884c\u9032\u884c\u5168\u7cfb\u7d71\u6383\u63cf\u4f5c\u696d\u3001\u7cfb\u7d71\u662f\u5426\u5df2\u5b89\u88dd\u76f8\u95dc\u4fee\u6b63\u6a94\uff0c\u6216\u95dc\u9589\u4e0d\u4f7f\u7528\u7684\u61c9\u7528\u8edf\u9ad4\u8207\u76f8\u95dc\u901a\u8a0a\u57e0\u3002 \u82e5\u4f86\u6e90IP\u70baDNS server\u3001NAT\u4e3b\u6a5f\u6216IP\u5206\u4eab\u5668\u7b49\u8a2d\u5099IP\u6642\uff0c \u8868\u793a\u6709\u5167\u90e8\u4e3b\u6a5f\u900f\u904e\u9019\u4e9b\u8a2d\u5099\u5411\u5916\u9023\u7dda\u6642\u800c\u89f8\u767c\u5075\u6e2c\u898f\u5247\uff0c \u5247\u9700\u5148\u8acb\u8a2d\u5099\u7ba1\u7406\u8005\u900f\u904e\u4e8b\u4ef6\u55ae\u6240\u9644\u4e4b\u8cc7\u8a0a(\u76ee\u7684\u5730IP\u3001\u6642\u9593\u3001\u4f86\u6e90port)\uff0c \u4f86\u5354\u52a9\u67e5\u627e\u5167\u90e8\u89f8\u767c\u5075\u6e2c\u898f\u5247\u4e4b\u4e3b\u6a5f\uff0c \u518d\u4f9d\u524d\u8ff0\u5efa\u8b70\u8655\u7406\u63aa\u65bd\u9032\u884c\u4f5c\u696d\u3002<\/td>\n<\/tr>\n
\u53c3\u8003\u8cc7\u6599<\/td>\nNULL<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n
(\u6b64\u901a\u5831\u50c5\u5728\u65bc\u544a\u77e5\u76f8\u95dc\u8cc7\u8a0a\uff0c\u4e26\u975e\u70ba\u8cc7\u5b89\u4e8b\u4ef6)\uff0c<\/wbr>\u5982\u679c\u60a8\u5c0d\u6b64\u901a\u5831\u7684\u5167\u5bb9\u6709\u7591\u554f\u6216\u6709\u95dc\u65bc\u6b64\u4e8b\u4ef6\u7684\u5efa\u8b70\uff0c<\/wbr>\u6b61\u8fce\u8207\u6211\u5011\u9023\u7d61\u3002<\/td>\n<\/tr>\n
\u6559\u80b2\u6a5f\u69cb\u8cc7\u5b89\u901a\u5831\u61c9\u8b8a\u5c0f\u7d44
\n\u7db2\u5740\uff1ahttps:\/\/info.cert.tanet.<\/wbr>edu.tw\/<\/a>
\n\u5c08\u7dda\u96fb\u8a71\uff1a07-5250211
\n\u7db2\u8def\u96fb\u8a71\uff1a98400000
\nE-Mail\uff1aservice@cert.tanet.edu.<\/wbr>tw<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u672c\u6821\u8655\u7406\u7a0b\u5e8f\uff1a<\/p>\n

    \n
  1. \u96fb\u806f\u6559\u7814\u4e2d\u5fc3\u5927\u540c\u7db2\u8def\u99d0\u9ede\u5de5\u7a0b\u5e2b\uff0c\u8acb\u6c42\u5354\u52a9\u67e5\u627e\u5167\u90e8\u89f8\u767c\u5075\u6e2c\u898f\u5247\u4e4b\u4e3b\u6a5f\uff0c \u518d\u4f9d\u524d\u8ff0\u5efa\u8b70\u8655\u7406\u63aa\u65bd\u9032\u884c\u4f5c\u696d\u3002<\/li>\n
  2. \u6559\u7814\u4e2d\u5fc3\u5927\u540c\u7db2\u8def\u99d0\u9ede\u5de5\u7a0b\u5e2b\u56de\u5831\uff0c\u672c\u6821\u611f\u67d3\u60e1\u610f\u7a0b\u5f0f\u6216\u906d\u690d\u5165\u6728\u99ac\u7a0b\u5f0f\u7684\u96fb\u8166 IP \u70ba 10.241.17.160\uff0c\u5148\u884c\u5c07\u5176\u7db2\u5361\u5c01\u9396\u3002<\/li>\n
  3. \u67e5\u51fa\u70ba\u672c\u6821\u6a02\u9f61\u6559\u5ba4\u4e2d\u67d0\u4e00\u90e8\u96fb\u8166\uff0c\u96fb\u8a71\u544a\u77e5\u76f8\u95dc\u4eba\u54e1\uff0c\u5118\u901f\u5c07\u8a72\u90e8\u96fb\u8166\u9001\u81f3\u8cc7\u8a0a\u4e2d\u5fc3\u91cd\u704c\u7cfb\u7d71\u3002<\/li>\n
  4. \u91cd\u704c\u8a72\u90e8\u611f\u67d3\u60e1\u610f\u7a0b\u5f0f\u7684\u96fb\u8166\uff0c\u767c\u9084\u3002<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    \u6559\u80b2\u6a5f\u69cb\u8cc7\u5b89\u901a\u5831\u5e73\u53f0 \u4e8b\u4ef6\u985e\u578b:\u5165\u4fb5\u4e8b\u4ef6\u8b66\u8a0a \u4e8b\u4ef6\u55ae\u7de8\u865f:AISAC-175382 \u539f\u767c\u5e03\u7de8\u865f NTUSOC-INT-201911-0781 \u539f\u767c\u5e03\u6642\u9593 2019-11-11 09:15:16 \u4e8b\u4ef6\u985e\u578b \u6bad\u5c4d\u96fb\u8166(Bot) \u539f\u767c\u73fe\u6642\u9593 2019-11-11 07:57:28 \u4e8b\u4ef6\u4e3b\u65e8 \u6559\u80b2\u90e8\u8cc7\u5b89\u4e8b\u4ef6\u901a\u544a-\u65b0\u5317\u5e02\u6559\u80b2\u7db2\u8def\u4e2d\u5fc3[163.20.242.17]\u4e3b\u6a5f\u9032\u884c\u60e1\u610f\u7a0b\u5f0f\u9023\u7dda(MALWARE-CNC Win.Trojan.Glupteba.M initial outbound connection) \u4e8b\u4ef6\u63cf\u8ff0 \u5165\u4fb5\u5075\u6e2c\u9632\u79a6\u7cfb\u7d71\u5075\u6e2c\u5230\u4f86\u6e90IP\uff08163.20.242.17)\uff0c\u5305\u542b\u7591\u4f3c\u60e1\u610f\u7a0b\u5f0f\u9023\u7dda\u884c\u70ba\u7279\u5fb5\u4e4b\u5c01\u5305\uff0c\u5c0d\u76ee\u6a19IP\uff085.9.157.50\uff09\u9032\u884c\u9023\u7dda\u3002\u6b64\u4e8b\u4ef6\u4f86\u6e90 PORT \uff0849208\uff09\uff0c\u76ee\u6a19 PORT \uff088000\uff09\u3002 \u624b\u6cd5\u7814\u5224 \u4f86\u6e90IP\u4e3b\u6a5f\u53ef\u80fd\u5b58\u5728\u672a\u4fee\u88dc\u4e4b\u5f31\u9ede\u906d\u99ed\u5ba2\u653b\u64ca\uff0c\u611f\u67d3\u60e1\u610f\u7a0b\u5f0f\u6216\u906d\u690d\u5165\u6728\u99ac\u7a0b\u5f0f\u5c0e\u81f4\u89f8\u767c\u6b64\u4e8b\u4ef6\uff0c\u5c07\u53ef\u80fd\u5c0e\u81f4\u4e3b\u6a5f\u6a5f\u654f\u8cc7\u6599\u5916\u6d29\uff0c\u6216\u6210\u70ba\u6bad\u5c4d\u7db2\u8def\u4e00\u54e1\u800c\u5c0d\u5916\u767c\u52d5\u653b\u64ca\u3002 \u5efa\u8b70\u63aa\u65bd \u8acb\u6aa2\u8996\u4f86\u6e90IP\u8a72\u9023\u7dda\u884c\u70ba\u662f\u5426\u5df2\u5f97\u5230\u5408\u6cd5\u6388\u6b0a\u3002 \u82e5\u4f86\u6e90IP\u8a72\u9023\u7dda\u70ba\u7570\u5e38\u884c\u70ba\uff0c\u53ef\u5148\u5229\u7528\u6383\u6bd2\u8edf\u9ad4\u9032\u884c\u5168\u7cfb\u7d71\u6383\u63cf\uff0c\u4e26\u5229\u7528ACL\u66ab\u6642\u963b\u64cb\u8a72\u53ef\u7591IP\u3002\u540c\u6642\u5efa\u8b70\u7ba1\u7406\u8005\u9032\u884c\u4ee5\u4e0b\u6aa2\u67e5\uff1a a.\u8acb\u67e5\u770b\u4f86\u6e90IP\u6709\u7121\u7570\u5e38\u52d5\u4f5c(\u5982\uff1a\u65b0\u589e\u5e33\u865f\u3001\u958b\u555f\u4e0d\u660ePort\u3001\u57f7\u884c\u4e0d\u660e\u7a0b\u5f0f)\u3002 b.\u78ba\u8a8d\u9632\u6bd2\u8edf\u9ad4\u7684\u75c5\u6bd2\u78bc\u5df2\u66f4\u65b0\u70ba\u6700\u65b0\u7248\u672c\uff0c\u4e26\u9032\u5165\u7cfb\u7d71\u5b89\u5168\u6a21\u5f0f\u4e0b\u884c\u9032\u884c\u5168\u7cfb\u7d71\u6383\u63cf\u4f5c\u696d\u3001\u7cfb\u7d71\u662f\u5426\u5df2\u5b89\u88dd\u76f8\u95dc\u4fee\u6b63\u6a94\uff0c\u6216\u95dc\u9589\u4e0d\u4f7f\u7528\u7684\u61c9\u7528\u8edf\u9ad4\u8207\u76f8\u95dc\u901a\u8a0a\u57e0\u3002 \u82e5\u4f86\u6e90IP\u70baDNS server\u3001NAT\u4e3b\u6a5f\u6216IP\u5206\u4eab\u5668\u7b49\u8a2d\u5099IP\u6642\uff0c \u8868\u793a\u6709\u5167\u90e8\u4e3b\u6a5f\u900f\u904e\u9019\u4e9b\u8a2d\u5099\u5411\u5916\u9023\u7dda\u6642\u800c\u89f8\u767c\u5075\u6e2c\u898f\u5247\uff0c \u5247\u9700\u5148\u8acb\u8a2d\u5099\u7ba1\u7406\u8005\u900f\u904e\u4e8b\u4ef6\u55ae\u6240\u9644\u4e4b\u8cc7\u8a0a(\u76ee\u7684\u5730IP\u3001\u6642\u9593\u3001\u4f86\u6e90port)\uff0c \u4f86\u5354\u52a9\u67e5\u627e\u5167\u90e8\u89f8\u767c\u5075\u6e2c\u898f\u5247\u4e4b\u4e3b\u6a5f\uff0c \u518d\u4f9d\u524d\u8ff0\u5efa\u8b70\u8655\u7406\u63aa\u65bd\u9032\u884c\u4f5c\u696d\u3002 \u53c3\u8003\u8cc7\u6599 NULL (\u6b64\u901a\u5831\u50c5\u5728\u65bc\u544a\u77e5\u76f8\u95dc\u8cc7\u8a0a\uff0c\u4e26\u975e\u70ba\u8cc7\u5b89\u4e8b\u4ef6)\uff0c\u5982\u679c\u60a8\u5c0d\u6b64\u901a\u5831\u7684\u5167\u5bb9\u6709\u7591\u554f\u6216\u6709\u95dc\u65bc\u6b64\u4e8b\u4ef6\u7684\u5efa\u8b70\uff0c\u6b61\u8fce\u8207\u6211\u5011\u9023\u7d61\u3002 \u6559\u80b2\u6a5f\u69cb\u8cc7\u5b89\u901a\u5831\u61c9\u8b8a\u5c0f\u7d44 \u7db2\u5740\uff1ahttps:\/\/info.cert.tanet.edu.tw\/ \u5c08\u7dda\u96fb\u8a71\uff1a07-5250211 \u7db2\u8def\u96fb\u8a71\uff1a98400000 E-Mail\uff1aservice@cert.tanet.edu.tw <\/p>\n

    \u672c\u6821\u8655\u7406\u7a0b\u5e8f\uff1a<\/p>\n

    \u96fb\u806f\u6559\u7814\u4e2d\u5fc3\u5927\u540c\u7db2\u8def\u99d0\u9ede\u5de5\u7a0b\u5e2b\uff0c\u8acb\u6c42\u5354\u52a9\u67e5\u627e\u5167\u90e8\u89f8\u767c\u5075\u6e2c\u898f\u5247\u4e4b\u4e3b\u6a5f\uff0c \u518d\u4f9d\u524d\u8ff0\u5efa\u8b70\u8655\u7406\u63aa\u65bd\u9032\u884c\u4f5c\u696d\u3002 \u6559\u7814\u4e2d\u5fc3\u5927\u540c\u7db2\u8def\u99d0\u9ede\u5de5\u7a0b\u5e2b\u56de\u5831\uff0c\u672c\u6821\u611f\u67d3\u60e1\u610f\u7a0b\u5f0f\u6216\u906d\u690d\u5165\u6728\u99ac\u7a0b\u5f0f\u7684\u96fb\u8166 IP \u70ba 10.241.17.160\uff0c\u5148\u884c\u5c07\u5176\u7db2\u5361\u5c01\u9396\u3002 \u67e5\u51fa\u70ba\u672c\u6821\u6a02\u9f61\u6559\u5ba4\u4e2d\u67d0\u4e00\u90e8\u96fb\u8166\uff0c\u96fb\u8a71\u544a\u77e5\u76f8\u95dc\u4eba\u54e1\uff0c\u5118\u901f\u5c07\u8a72\u90e8\u96fb\u8166\u9001\u81f3\u8cc7\u8a0a\u4e2d\u5fc3\u91cd\u704c\u7cfb\u7d71\u3002 \u91cd\u704c\u8a72\u90e8\u611f\u67d3\u60e1\u610f\u7a0b\u5f0f\u7684\u96fb\u8166\uff0c\u767c\u9084\u3002 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"_links":{"self":[{"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/posts\/14794"}],"collection":[{"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/comments?post=14794"}],"version-history":[{"count":0,"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/posts\/14794\/revisions"}],"wp:attachment":[{"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/media?parent=14794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/categories?post=14794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/tags?post=14794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}