無(wú)論黑客使用計(jì)算機(jī)漏洞還是惡意軟件，他們的動(dòng)機(jī)都是一樣的。了解黑客入侵的原因和方式是防御的關(guān)鍵。

（Whether a hacker uses a computer exploit or malware, their motivations are the same. Understanding why and how hackers hack is key to your defense.）

了解黑客及其攻擊方式

Understanding hackers and how they attack

無(wú)論威脅如何，它都會(huì)以?xún)煞N方式之一到達(dá)您的計(jì)算機(jī)：人類(lèi)攻擊或惡意軟件。人類(lèi)攻擊者可以使用成千上萬(wàn)的已知計(jì)算機(jī)漏洞和攻擊方法中的任何一種來(lái)破壞計(jì)算機(jī)或設(shè)備。用戶(hù)應(yīng)該及時(shí)運(yùn)行補(bǔ)丁程序，確保設(shè)備和軟件程序的更新。因?yàn)榧词寡a(bǔ)丁程序可用，許多計(jì)算機(jī)和設(shè)備也會(huì)長(zhǎng)時(shí)間處于易受攻擊狀態(tài)，這是黑客們喜歡的事實(shí)。

（Whatever the threat, it is arriving to your computer in one of two ways: human adversary or malware. Human attackers can use any of the hundreds of thousands of known computer exploits and attack methodologies to compromise a computer or device. People are supposed to run patching routines, and many devices and software programs try their best to automatically update themselves, yet many computers and devices are left vulnerable for long periods of time even after the patches are available, a fact that hackers love.）

惡意軟件程序數(shù)以?xún)|計(jì)，每天創(chuàng)建和發(fā)布數(shù)以萬(wàn)計(jì)的新病毒。三種主要的惡意軟件類(lèi)別是病毒（自我復(fù)制），蠕蟲(chóng)（自行旅行）和特洛伊木馬程序（需要執(zhí)行最終用戶(hù)操作）。當(dāng)今的惡意軟件大多通過(guò)網(wǎng)頁(yè)或電子郵件到達(dá)，往往是多個(gè)惡意軟件類(lèi)的組合。通常情況下，利用系統(tǒng)的第一個(gè)惡意軟件程序只是一個(gè)“存根下載器”程序，該程序獲得初始訪問(wèn)權(quán)限，然后“撥號(hào)”以獲取更多指令并下載并安裝更復(fù)雜的惡意軟件。

（Unique malware programs number into the hundreds of millions, with tens of thousands of new ones created and released each day. The three main malware categories are viruses (self-replicating), worms (self-traveling), and Trojan horse programs (which require an end-user action to execute). Today’s malware, usually arriving via web page or email, is often a combination of multiple malware classes. Often the first malware program to exploit a system is just a “stub downloader” program, which gains initial access and then “phones home” to get more instructions and to download and install more sophisticated malware.）

通常，存根程序會(huì)下載十幾種不同的新惡意軟件變體，每種變體都旨在避免反惡意軟件檢測(cè)和刪除。惡意軟件編寫(xiě)者維護(hù)自己的惡意軟件多重檢測(cè)服務(wù)。類(lèi)似于Google的合法Virus Total，通過(guò)連接到一個(gè)自動(dòng)更新的服務(wù)，該服務(wù)會(huì)修改惡意軟件，使其無(wú)法被當(dāng)前的反惡意軟件引擎檢測(cè)到。這幾乎是瞬間更新，能夠?qū)е聞?chuàng)建和分發(fā)許多“獨(dú)特”的惡意軟件程序。

（Often the stub program will download over a dozen different new malware variations, each designed to avoid antimalware detection and removal. Malware writers maintain their own malware multi-detection services, similar to Google’s legitimate VirusTotal, which is then linked to an automated updating service which modifies their malware to be undetectable by current antimalware engines. It’s this nearly instantaneous updating that causes so many “unique” malware programs to be created and distributed.）

惡意軟件編寫(xiě)者或分發(fā)者也可能被雇傭來(lái)使用完全不同類(lèi)型的惡意軟件感染人們的設(shè)備。 這是一個(gè)租戶(hù)的市場(chǎng)，如果惡意軟件控制者通過(guò)出租受損設(shè)備能比制作它們賺取更多的錢(qián)，那么他們會(huì)愿意做這件事。另外，最終控制器的風(fēng)險(xiǎn)要小得多。

（The malware writer or distributor may also be paid to infect people’s devices with completely different types of malware. It’s a renter’s market out there, and if the malware controller can make more money renting the compromised devices than they can make alone, they will do it. Plus, it’s much less risk for the controller in the end.）

許多黑客（和黑客組織）使用惡意軟件訪問(wèn)整個(gè)公司或更廣泛的目標(biāo)受害者，然后單獨(dú)選擇一些缺乏保護(hù)的目標(biāo)來(lái)花費(fèi)更多的精力。其他時(shí)候，就像大多數(shù)勒索軟件一樣，惡意軟件程序是整個(gè)蠟球，能夠在沒(méi)有任何惡意領(lǐng)導(dǎo)者的交互的情況下妥協(xié)和勒索金錢(qián)。一旦釋放，黑客所要做的就是收集不義之財(cái)。惡意軟件通常會(huì)被創(chuàng)建，然后被出售或租借給分發(fā)和使用它們的人員。

（Many hackers (and hacking groups) use malware to gain access across a company or much broader array of target victims, and then individually select some of the already compromised targets to spend more effort on. Other times, like with most ransomware, the malware program is the whole ball of wax, able to compromise and extort money without any interaction from its malicious leader. Once released, all the hacker has to do is collect the ill-gotten gains. Malware is often created and then sold or rented to the people who distribute and use them.）

為什么黑客入侵？

Why do hackers hack?

黑客犯罪的原因可以分為以下幾類(lèi)：財(cái)務(wù)動(dòng)機(jī)；民族國(guó)家贊助/網(wǎng)絡(luò)戰(zhàn)；企業(yè)間諜活動(dòng)；純黑客行為；資源盜竊；玩家問(wèn)題。

（The reasons why hackers commit crimes fall into these general categories:

·         Financial motivations

·         Nation-state sponsored/cyberwarfare

·         Corporate espionage

·         Hackivists

·         Resource theft

·         Gamer issues）

金融盜竊和民族國(guó)家攻擊很容易成為網(wǎng)絡(luò)犯罪的“重災(zāi)區(qū)”。幾十年前，以垃圾食品為動(dòng)力的孤獨(dú)青年黑客就是普通黑客的充分代表。 他們有興趣向自己和其他人展示他們可以竊取內(nèi)容或創(chuàng)建有趣的惡意軟件。他們很少能造成真正的傷害。

（Financial theft and nation-state attacks are easily the largest portion of cybercrime. Decades ago, the lone, solitary youth hacker powered by junk food was an adequate representation of the average hacker. They were interested in showing themselves and others that they could hack something or create interesting malware. Rarely did they do real harm.）

今天，大多數(shù)黑客屬于專(zhuān)業(yè)團(tuán)體，這些專(zhuān)業(yè)團(tuán)隊(duì)的動(dòng)機(jī)是竊取有價(jià)值的東西，并且經(jīng)常造成重大傷害。他們使用的惡意軟件會(huì)盡可能被設(shè)計(jì)得具有隱蔽性，來(lái)在被發(fā)現(xiàn)之前盡可能多地竊取價(jià)值。

（Today, most hackers belong to professional groups, which are motivated by taking something of value, and often causing significant harm. The malware they use is designed to be covert as possible and to take as much of something of value as is possible before discovery.）

黑客如何入侵？

How do hackers hack?

無(wú)論他們的動(dòng)機(jī)如何，黑客或其惡意軟件通常都會(huì)以相同的方式侵入并利用計(jì)算機(jī)系統(tǒng)，他們使用的漏洞利用和方法也大都相同，其中包括：社會(huì)工程學(xué)；未修補(bǔ)的軟件和硬件漏洞；零日攻擊；瀏覽器攻擊；密碼攻擊；竊聽(tīng)；拒絕服務(wù)；物理攻擊。

（Regardless of their motivations, hackers or their malware usually break in and exploit a computer system the same way and use most of the same types of exploits and methodologies, including:

· Social engineering

·         Unpatched software and hardware vulnerabilities

·         Zero-day attacks

·         Browser attacks

·         Password attacks

·         Eavesdropping

· Denial of service

·         Physical attacks）

此列表不包括內(nèi)部威脅，意外數(shù)據(jù)泄露，配置錯(cuò)誤，用戶(hù)錯(cuò)誤以及與故意黑客行為不直接相關(guān)的各種其他威脅。設(shè)備受損的最常見(jiàn)方式是未修補(bǔ)的軟件和社會(huì)工程。這些威脅在大多數(shù)環(huán)境中危害絕大多數(shù)風(fēng)險(xiǎn)（超過(guò)95％）。解決這些問(wèn)題，意味著你將擺脫一大堆風(fēng)險(xiǎn)。

（This list does not include insider threats, unintended data leaks, misconfiguration, user errors, and myriad other threats not connected directly to intentional hacking.  The most common ways devices are compromised are unpatched software and social engineering. These threats compromise the vast majority of the risk (over 95 percent) in most environments. Fix those issues and you get rid of a ton of risk.）

零日攻擊是黑客或惡意軟件程序利用未知的漏洞造成的。它們發(fā)生時(shí)總是具有很高的新聞價(jià)值，因?yàn)槟壳肮?yīng)商還沒(méi)有對(duì)應(yīng)的補(bǔ)丁。每年只有少部分被發(fā)現(xiàn)。在被發(fā)現(xiàn)，分析和修補(bǔ)之前，他們通常只在一家或幾家公司。對(duì)零日攻擊的利用遠(yuǎn)比我們所知道的更多，特別在民族國(guó)家，但因?yàn)樵擃?lèi)型的黑客使用它們時(shí)非常的謹(jǐn)慎，我們很少發(fā)現(xiàn)它們，因此它們可以在需要的時(shí)候一次又一次地被使用。

（Zero-day attacks, where a hacker or malware program exploits a vulnerability not known by the public, are always newsworthy when they occur because the vendor doesn’t yet have a patch for them. Only a handful of them are discovered each year. Usually, they exploit only one company, or a few companies, before they are found, analyzed, and patched. Far more zero days are probably being used, especially by nation-states, than we realize, but because they are used very sparingly by those types of hackers, we rarely discover them, and they can be used again and again when needed.）

絕大多數(shù)惡意漏洞都是通過(guò)互聯(lián)網(wǎng)進(jìn)行的，并要求用戶(hù)做一些事情 - 點(diǎn)擊鏈接，下載并執(zhí)行文件，或者提供登錄名和密碼 - 惡意行為開(kāi)始。瀏覽器安全方面的提升使得“無(wú)感知”攻擊更為少見(jiàn)，即當(dāng)用戶(hù)訪問(wèn)網(wǎng)頁(yè)或打開(kāi)電子郵件時(shí)，無(wú)需任何用戶(hù)操作即可執(zhí)行威脅的情況更少。

（The vast majority of malicious exploits come through the internet and require that a user do something — click on a link, download and execute a file, or supply a log-on name and password — for the maliciousness to begin. Browser security improvements have made less common “silent drive-by” attacks, where a threat executes without any user action when a user visits a web page or opens an email.）

防止黑客入侵

Protection from hackers

無(wú)論他們的動(dòng)機(jī)如何，擊敗黑客和惡意軟件的關(guān)鍵在于關(guān)閉那些讓它們成功的漏洞的根源?？纯瓷厦媪谐龅膶?dǎo)致漏洞的根源，確定哪些攻擊對(duì)你的組織最致命，然后創(chuàng)建或改進(jìn)現(xiàn)有的防御措施以最小化它們。如果你能做到這一點(diǎn)，你將構(gòu)建一道絕對(duì)堅(jiān)實(shí)的安全防御。

（A key to defeating hackers and malware, regardless of their motivation, is to close the root cause exploit holes that allow them and their malware to be successful. Take a look at the root cause exploits listed above, determine which ones are used the most against your organization, and then create or improve existing defenses to minimize them. If you can do that, you’ll build a solid security defense second to none.）

了解更多行業(yè)資訊，請(qǐng)關(guān)注聯(lián)軟科技官方微信