Serangan perangkat pemeras WannaCry: Perbedaan antara revisi
Konten dihapus Konten ditambahkan
k Bot: Penggantian teks otomatis (- + ) |
Rescuing 1 sources and tagging 0 as dead.) #IABot (v2.0.9.2 |
||
| (18 revisi perantara oleh 12 pengguna tidak ditampilkan) | |||
Baris 58:
== Latar belakang ==
Vektor infeksi yang diklaim, [[EternalBlue]], dirilis oleh kelompok peretas [[The Shadow Brokers]] pada tanggal 14 April 2017<ref>{{cite news|url=http://www.reuters.com/article/2015/02/16/us-usa-cyberspying-idUSKBN0LK1QV20150216|title=Russian researchers expose breakthrough U.S. spying program|last=Menn|first=Joseph|date=17 February 2015
EternalBlue memanfaatkan kerentanan MS17-010<ref name="microsoft.com">{{cite web|url=https://technet.microsoft.com/en-us/library/security/ms17-010.aspx|title=Microsoft Security Bulletin MS17-010 – Critical|website=technet.microsoft.com|access-date=13 May 2017}}</ref> dalam implementasi protokol [[Server Message Block]] (SMB) [[Microsoft]]. Microsoft telah merilis sebuah "critical" advisory, bersamaan dengan pembaruan tambalan untuk mengatasi kerentanan sebulan sebelumnya, pada tanggal 14 Maret 2017.<ref name="microsoft.com" /> Tambalan ini memperbaiki beberapa versi workstation dari sistem operasi [[Microsoft Windows]], termasuk [[Windows Vista]] dan [[Windows 8.1]], serta versi server dan embedded seperti [[Windows Server 2008]] dan [[Windows Embedded POSReady 2009]], namun bukan [[Windows XP]] yang lebih tua, menurut Microsoft.<ref name="microsoft.com" />
Baris 65:
== Serangan siber ==
[[Berkas:Countries initially affected in WannaCry ransomware attack.
Pada tanggal 12 Mei 2017, WannaCry mulai mempengaruhi komputer di seluruh dunia.<ref>{{cite web|last1=Newman|first1=Lily Hay|title=The Ransomware Meltdown Experts Warned About Is Here|url=https://www.wired.com/2017/05/ransomware-meltdown-experts-warned/|website=Wired.com|access-date=13 May 2017}}</ref> Infeksi awal mungkin disebabkan oleh kerentanan pertahanan jaringan atau [[Pengelabuan|serangan pengelabuan tombak]] yang sangat bagus.<ref>{{Cite news|url=https://arstechnica.com/security/2017/05/an-nsa-derived-ransomware-worm-is-shutting-down-computers-worldwide/|title=An NSA-derived ransomware worm is shutting down computers worldwide|last=Goodin|first=Dan|work=ARS Technica|access-date=2017-05-14|language=en-US}}</ref> Saat dieksekusi, malware pertama kali memeriksa "kill switch" [[nama domain]]. Jika tidak ditemukan, maka ransomware mengenkripsi data komputer,<ref name=":1">{{Cite news|url=http://www.telegraph.co.uk/news/2017/05/12/russian-linked-cyber-gang-shadow-brokers-blamed-nhs-computer/|title=Russian-linked cyber gang blamed for NHS computer hack using bug stolen from US spy agency|work=The Telegraph|access-date=12 May 2017|language=en-GB}}</ref><ref name=syma /><ref>{{Cite news|url=https://www.nytimes.com/2017/05/12/world/europe/uk-national-health-service-cyberattack.html|title=Hackers Hit Dozens of Countries Exploiting Stolen N.S.A. Tool|last=Bilefsky|first=Dan|date=12 May 2017|work=The New York Times|access-date=12 May 2017|last2=Perlroth|first2=Nicole|issn=0362-4331}}</ref> kemudian mencoba untuk memanfaatkan kerentanan SMB untuk menyebar ke komputer acak di Internet,<ref name=mbytes>{{cite web|last1=Clark|first1=Zammis|title=The worm that spreads WanaCrypt0r|url=https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/|website=Malwarebytes Labs|publisher=malwarebytes.com|access-date=13 May 2017}}</ref> dan "lateral" ke komputer pada [[Jaringan
▲Pada tanggal 12 Mei 2017, WannaCry mulai mempengaruhi komputer di seluruh dunia.<ref>{{cite web|last1=Newman|first1=Lily Hay|title=The Ransomware Meltdown Experts Warned About Is Here|url=https://www.wired.com/2017/05/ransomware-meltdown-experts-warned/|website=Wired.com|access-date=13 May 2017}}</ref> Infeksi awal mungkin disebabkan oleh kerentanan pertahanan jaringan atau [[Pengelabuan|serangan pengelabuan tombak]] yang sangat bagus.<ref>{{Cite news|url=https://arstechnica.com/security/2017/05/an-nsa-derived-ransomware-worm-is-shutting-down-computers-worldwide/|title=An NSA-derived ransomware worm is shutting down computers worldwide|last=Goodin|first=Dan|work=ARS Technica|access-date=2017-05-14|language=en-US}}</ref> Saat dieksekusi, malware pertama kali memeriksa "kill switch" [[nama domain]]. Jika tidak ditemukan, maka ransomware mengenkripsi data komputer,<ref name=":1">{{Cite news|url=http://www.telegraph.co.uk/news/2017/05/12/russian-linked-cyber-gang-shadow-brokers-blamed-nhs-computer/|title=Russian-linked cyber gang blamed for NHS computer hack using bug stolen from US spy agency|work=The Telegraph|access-date=12 May 2017|language=en-GB}}</ref><ref name=syma /><ref>{{Cite news|url=https://www.nytimes.com/2017/05/12/world/europe/uk-national-health-service-cyberattack.html|title=Hackers Hit Dozens of Countries Exploiting Stolen N.S.A. Tool|last=Bilefsky|first=Dan|date=12 May 2017|work=The New York Times|access-date=12 May 2017|last2=Perlroth|first2=Nicole|issn=0362-4331}}</ref> kemudian mencoba untuk memanfaatkan kerentanan SMB untuk menyebar ke komputer acak di Internet,<ref name=mbytes>{{cite web|last1=Clark|first1=Zammis|title=The worm that spreads WanaCrypt0r|url=https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/|website=Malwarebytes Labs|publisher=malwarebytes.com|access-date=13 May 2017}}</ref> dan "lateral" ke komputer pada [[Jaringan wilayah lokal]] yang sama.<ref>{{cite web|last1=Samani|first1=Raj|title=An Analysis of the WANNACRY Ransomware outbreak|url=https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/|publisher=McAfee|access-date=13 May 2017}}</ref> Seperti pada perangkat pemeras modern lainnya, muatan menampilkan pesan yang menginformasikan pengguna bahwa file telah dienkripsi, dan menuntut pembayaran sekitar $300 dalam [[bitcoin]] dalam tiga hari atau $600 dalam waktu tujuh hari.<ref name=syma>{{cite web|title=What you need to know about the WannaCry Ransomware|url=https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware|publisher=Symantec Security Response|accessdate=14 May 2017}}</ref><ref>{{Cite news|url=https://www.wsj.com/articles/more-cyberattack-victims-emerge-as-agencies-search-for-clues-1494671938|title=More Cyberattack Victims Emerge as Agencies Search for Clues|last=Thomas|first=Andrea|date=2017-05-13|work=Wall Street Journal|access-date=2017-05-14|last2=Grove|first2=Thomas|issn=0099-9660|last3=Gross|first3=Jenny}}</ref>
Kerentanan Windows bukanlah cacat [[zero-day (komputasi)|zero-day]], tapi satu di antaranya Microsoft menyediakan [[Tambalan (komputasi)|tambalan keamanan]] pada tanggal 14 Maret 2017,<ref name="microsoft.com" /> Hampir dua bulan sebelum serangan. Tambalan ke protokol Server Message Block (SMB) yang digunakan oleh Windows.<ref name=exploit>{{cite news|url=http://www.eweek.com/security/wannacry-ransomware-attack-hits-victims-with-microsoft-smb-exploit|title=WannaCry Ransomware Attack Hits Victims With Microsoft SMB Exploit|work=[[eWeek]]|access-date=13 May 2017}}</ref><ref name="hei">{{cite web|title=WannaCry: BSI ruft Betroffene auf, Infektionen zu melden|url=https://www.heise.de/newsticker/meldung/WannaCry-BSI-ruft-Betroffene-auf-Infektionen-zu-melden-3713442.html|publisher=heise online|accessdate=14 May 2017|language=de-DE}}</ref> Organisasi yang kekurangan tambalan keamanan ini terpengaruh karena alasan ini, walaupun sejauh ini tidak ada bukti bahwa ada yang secara khusus ditargetkan oleh pengembang perangkat pemeras.<ref name=exploit /> Setiap organisasi masih menjalankan [[Windows XP]] lama<ref name=vicexp>{{cite web|url=https://motherboard.vice.com/en_us/article/nhs-hospitals-are-running-thousands-of-computers-on-unsupported-windows-xp|title=NHS Hospitals Are Running Thousands of Computers on Unsupported Windows XP|website=Motherboard|access-date=13 May 2017}}</ref> sangat berisiko tinggi karena sampai 13 Mei,<ref name="microsoftreleases" /> tidak ada tambalan keamanan yang telah dirilis sejak April 2014.<ref>{{cite web|url=https://www.microsoft.com/en-gb/windowsforbusiness/end-of-xp-support|title=Windows XP End of Support|website=www.microsoft.com|access-date=13 May 2017}}</ref> Setelah serangan tersebut, Microsoft merilis tambalan keamanan untuk Windows XP.<ref name="microsoftreleases" />
Baris 76 ⟶ 75:
== Varian ==
Pada tanggal 14 Mei, dua varian tambahan terdeteksi. Salah satu varian ini memiliki kill switch baru yang segera terdaftar, sementara yang lainnya tidak memiliki kill switch namun memiliki muatan rusak yang mencegah enkripsi berkas.<ref>{{Cite web|url=https://blog.comae.io/wannacry-new-variants-detected-b8908fefea7e|title=WannaCry — New Variants Detected!|website=blog.comae.io|access-date=2017-05-16|archive-date=2017-05-15|archive-url=https://web.archive.org/web/20170515115119/https://blog.comae.io/wannacry-new-variants-detected-b8908fefea7e|dead-url=yes}}</ref>
== Dampak ==
Baris 85 ⟶ 84:
Dampak serangan bisa jadi jauh lebih buruk jika tidak ada kill-switch yang dibangun oleh pencipta malware tersebut.<ref>{{cite web|title=Lucky break slows global cyberattack; what's coming could be worse|url=http://www.chicagotribune.com/news/nationworld/ct-nsa-cyberattacks-20170513-story.html|accessdate=14 May 2017}}</ref><ref name=guard1>{{cite web|last1=Helmore|first1=Edward|title=Ransomware attack reveals breakdown in US intelligence protocols, expert says|url=https://www.theguardian.com/technology/2017/may/13/ransomware-cyber-attack-us-intelligence|publisher=The Guardian|accessdate=14 May 2017|date=13 May 2017}}</ref>
Ahli keamanan Cybersecurity Ori Eisen mengatakan bahwa serangan tersebut tampaknya merupakan barang "tingkat rendah", dengan tuntutan uang tebusan sebesar $300 dan menyatakan bahwa hal yang sama dapat dilakukan pada [[Infrastruktur kritis|infrastruktur penting]], seperti [[Keselamatan dan keamanan nuklir|pembangkit tenaga nuklir]], bendungan atau sistem kereta api.<ref>{{cite web|title=The Latest: Researcher who helped halt cyberattack applauded|url=http://www.startribune.com/the-latest-turkey-among-countries-hit-in-cyberattack/422161813/|publisher=Star Tribune|accessdate=14 May 2017|archive-date=2017-05-16|archive-url=https://web.archive.org/web/20170516182233/http://www.startribune.com/the-latest-turkey-among-countries-hit-in-cyberattack/422161813/|dead-url=yes}}</ref>
Microsoft juga telah merilis tambalan untuk memperbaiki eksploitasi yang digunakan oleh perangkat pemeras pada sistem operasi Windows XP, tandingan 64-bit, Windows Server 2003, dan Windows 8, meskipun semuanya tidak didukung selama masa itu.
Baris 106 ⟶ 105:
* [[FedEx]]<ref>{{cite web|url=https://www.ft.com/content/af74e3f4-373d-11e7-99bd-13beb0903fa3|title=What is Wannacry and how can it be stopped?|date=12 May 2017|newspaper=[[Financial Times]]|language=en|access-date=13 May 2017}}</ref>
* Garena Blade and Soul<ref>{{cite web|url=https://www.blognone.com/node/92406|title=เซิร์ฟเวอร์เกม Blade & Soul ของ Garena ประเทศไทยถูก WannaCrypt โจมตี|date=13 May 2017|publisher=blognone.com|language=th|access-date=14 May 2017}}</ref>
* [[Hitachi]]<ref>{{cite news|url=http://www3.nhk.or.jp/news/html/20170515/k10010981821000.html?utm_int=detail_contents_news-related-auto_002|title=日立製作所 サイバー攻撃で社内システム一部に障害|language=ja|website=NHK News Web|date=15 May 2017|accessdate=15 May 2017|archive-date=2017-05-16|archive-url=https://web.archive.org/web/20170516055522/http://www3.nhk.or.jp/news/html/20170515/k10010981821000.html?utm_int=detail_contents_news-related-auto_002|dead-url=yes}}</ref>
* Instituto Nacional de Salud, [[Kolombia]]<ref>{{cite web |url=http://www.eltiempo.com/tecnosfera/novedades-tecnologia/alerta-por-cibertaque-que-golpeo-a-74-paises-87602|title=Instituto Nacional de Salud, entre víctimas de ciberataque mundial|date=13 May 2017|work=El Tiempo|language=Spanish}}</ref>
* [[Kementerian Dalam Negeri (Rusia)|Kementerian Dalam Negeri Federasi Rusia]]<ref>{{cite web|title=Researcher 'accidentally' stops spread of unprecedented global cyberattack|url=http://abcnews.go.com/International/researcher-accidentally-stops-spread-unprecedented-global-cyberattack/story?id=47390745|publisher=[[ABC News]]|access-date=13 May 2017}}</ref>
Baris 136 ⟶ 135:
* [[Telenor Hungary]]<ref>{{cite news|last1=Balogh|first1=Csaba|title=Ideért a baj: Magyarországra is elért az óriási kibertámadás|url=http://hvg.hu/tudomany/20170512_wannacry_zsarolovirus_aldozatok_magyar_ceg|accessdate=13 May 2017|work=[[Heti Világgazdaság|HVG]]|date=12 May 2017|language=Hungarian}}</ref>
* [[Timrå Municipality]], Swedia<ref>{{cite news|url=https://www.svt.se/nyheter/inrikes/timra-kommun-drabbat-av-utpressningsattack|date=13 May 2017|publisher=[[Sveriges Television]]|title=Timrå kommun drabbat av utpressningsattack|language=sv|access-date=15 May 2017}}</ref>
* [[Universitas Jember]], Indonesia<ref>{{
* [[University of Milano-Bicocca]], Italia<ref>{{cite web|url=http://milano.repubblica.it/cronaca/2017/05/12/news/milano_virus_ransomware_universita_bicocca-165302056/|title=Il virus Wannacry arrivato a Milano: colpiti computer dell'università Bicocca|date=12 May 2017|website=la Repubblica|language=it|access-date=13 May 2017}}</ref>
* [[University of Montréal]], Kanada<ref>{{cite news|title=Some University of Montreal computers hit with WannaCry virus|url=http://www.theglobeandmail.com/news/national/universite-de-montreal-computers-hit-with-wannacry-virus/article35004991/|accessdate=16 May 2017|work=The Globe and Mail|date=May 16, 2017}}</ref>
Baris 144 ⟶ 143:
{{Reflist|30em}}
[[Kategori:Serangan dunia maya]]
| |||