Medical data - , loan data - , this time it's the turn of data on payments for traffic fines and debts from the bailiff service.
The good news is that these payments are not associated with the official State Services website. The bad news is that there is a lot of data, and they are more than just 'personal'.
Disclaimer: All information below is published solely for educational purposes. The author has not accessed any personal data of third parties or companies. The information is taken either from open sources or was provided to the author by anonymous well-wishers.On April 12th (at night), an Elasticsearch server was discovered that did not require authentication for connection. About how I wrote a note in my blog.
The Elasticsearch indexes contained logs of some information system (IS). It was hypothesized that this server was connected to websites accepting payments for various government services: оплатагибдд.рф, paygibdd.ru, gos-oplata.ru, штрафов.net and oplata-fssp.ru.
On the morning of April 13, 2019, I sent notifications to the following email addresses: support@gos-oplata.ru, support@oplata-fssp.ru, support@paygibdd.ru, but did not receive a reply (as is often the case). The server was quietly 'shut down' and disappeared from public access on April 13, 2019, around 15:20-15:45 (MSK).
At the time of the server's shutdown, the Elasticsearch indexes looked like this:
Now let’s get to the most interesting part - directly to personal data. As I mentioned earlier, the indexes contained some logs of some IS. And as is often the case, the logs turned out to be very detailed, even too much.
The logs were kept starting from February 28, 2019, not for the entire duration of the IS's operation. In some indexes, data went back to March 17, 2019.
For example, from the logs of the index gosoplata , one could obtain the following (a total of 248365 excluding error logging):
{
"_index": "gosoplata",
"_type": "log",
"@timestamp": "2019-03-02T20:55:02+03:00",
"message": "Payment found in GIS",
"extra": "[n 'gis_info' => unserialize('O:34:"app\models\payment\api\PenaltyInfo":10:{s:10:"billNumber";s:20:"XXXX021170025955001";s:8:"billDate";s:10:"2017-04-03";s:10:"validUntil";s:10:"2017-06-03";s:6:"amount";s:9:"146030.26";s:7:"addInfo";s:1424:"Payment of debt for IP No. XXXX/17/ XXXX -IP from 03.04.2017 regarding MXXXXX X. X., Debt on loan payments (excluding mortgage)/////UIN32253021170025955001_IP0;Department: UFK FOR NOVGOROD REGION (OSP NOVGORODSKY, BATETSKY AND KRESTETSKY DISTRICTS OF UFSSP RUSSIA FOR NOVGOROD REGION LLC 05501845860);Recipient: UFK FOR NOVGOROD REGION (OSP NOVGORODSKY, BATETSKY AND KRESTETSKY DISTRICTS OF UFSSP RUSSIA FOR NOVGOROD REGION LLC 05501845860);Recipient's Bank: NOVGOROD DEPARTMENT;Recipient's account number: 40302810400001000005;TIN: 5321100670;KPP: 532132002;Recipient Bank's BIC: 044959001;OKATO: 49625000;KBK: 0;idDebtsum:146540.26;ipPaymentAmount:0.00;ipOperationAmount:0.00;dataUnloadDate:2018-12-04T11:26:19.000;dataIdDate:2017-01-27;dataIdNumber:2-53/2017;dataIpRiseDate:2017-04-03;dataIpNumber: XXXX/17/XXXX-IP;dataIdDbtrFio:MIXXXXX X. X.;dataIdDbtrBorn:XXX-09-03;dataIdDebtText:Debt on loan payments (excluding mortgage);";s:7:"docName";s:3:"inn";s:9:"docNumber";s:12:" XXXX0819584";s:9:"payStatus";s:1:"0";s:9:"quittance";s:1:"3";s:11:"amountToPay";s:9:"146030.26";}'),n]",
"context": "[n '_GET' => [],n '_POST' => [],n]"
}
}I replaced all sensitive information with 'X'. In reality, everything was stored in plain text.
From the index payment-fssp (total 283958 excluding errors):
{
"_index": "payment-fssp",
"_type": "log",
"@timestamp": "2019-02-28T22:17:24+03:00",
"extra": "[n 'request_data' => [n 'MNT_ID' => 'XXXXXX3280',n 'MNT_TRANSACTION_ID' => 'XXXXXX0795c78337a5a308',n 'MNT_OPERATION_ID' => 'XXXXXX 3232',n 'MNT_AMOUNT' => '544.00',n 'MNT_CURRENCY_CODE' => 'RUB',n 'MNT_TEST_MODE' => '0',n 'MNT_SIGNATURE' => '6435224ccXXXXXX10bbc970f6479787',n 'paymentSystem_unitId' => '1686945',n 'MNT_CORRACCOUNT' => '303',n 'MNT_PAY_SYSTEM' => 'payanyway',n 'MNT_IS_REGULAR' => '',n 'MNT_FORM_METHOD' => 'POST',n 'cardnumber' => '639002********7417',n ],n 'model_attributes' => [n 'id' => 482137,n 'parent_id' => null,n 'name' => 'XXXX GALIANA XXXXX',n 'ur' => 0,n 'birthdate' => 'XXXX-06-06',n 'doc_type' => null,n 'doc_value' => null,n 'hash' => 'XXXXXX795c78337a5a308',n 'created_at' => '2019-02-28 22:16:10',n 'form_url' => 'https://service.moneta.ru/assistant.widget?XXXXXX&MNT_CURRENCY_CODE=RUB&MNT_AMOUNT=544.00&MNT_DESCRIPTION=Payment of FSSP debt. Order N482137 UIN: 32223088190136500007 Proceedings: XXXXXX/19/XXXXXX-IP&MNT_TEST_MODE=0&XXXXXX&MNT_SUCCESS_URL=https://payment-fssp.ru/payment/success&MNT_FAIL_URL=https://payment-fssp.ru/payment/fail&MNT_PAY_SYSTEM=payanyway&MNT_IS_REGULAR=&MNT_FORM_METHOD=POST&followup=true',n 'email' => 'XXXXXX@bk.ru',n 'payment_system_id' => 'moneta',n 'transaction_id' => '338533232',n 'updated_at' => '2019-02-28 22:16:16',n 'a3_order_hash' => null,n 'receipt_send' => null,n 'receipt_status_id' => null,n 'payment_status_id' => 'callback_received',n 'lead_source' => 'fssp',n ],n]",
"context": "[n '_GET' => [],n '_POST' => [n 'MNT_ID' => 'XXXXXX280',n 'MNT_TRANSACTION_ID' => 'XXXXXX795c78337a5a308',n 'MNT_OPERATION_ID' => 'XXXXXX3232',n 'MNT_AMOUNT' => '544.00',n 'MNT_CURRENCY_CODE' => 'RUB',n 'MNT_TEST_MODE' => '0',n 'MNT_SIGNATURE' => '6435224ccXXXXXX10bbc970f6479787',n 'paymentSystem_unitId' => 'XXXXXX45',n 'MNT_CORRACCOUNT' => '303',n 'MNT_PAY_SYSTEM' => 'payanyway',n 'MNT_IS_REGULAR' => '',n 'MNT_FORM_METHOD' => 'POST',n 'cardnumber' => '639002********7417',n ],n]"
}
}Here it can be seen (value cardnumber), that the full credit card numbers were protected from leakage only because the payment gateway (in this case moneta.ru) did not return the full numbers in open format (only the first 6 and last 4 digits of the card number).
It was also visible from the logs that the official FSSP website offers citizens the option to make payments through this IS: is.fssprus.ru/pay/?service=gosoplata&pay=XXXXXX/18/XXXXXX-IP. This is indirectly confirmed by the text at the very bottom of the website. oplata-fssp.ru:
Now let's see what's going on with the traffic fines. Clearly, the indices are responsible for this shatrafov-net (4528 records excluding errors) and paygibdd (140666 records excluding errors):
{
"_index": "shtrafov-net",
"_type": "log",
"@timestamp": "2019-03-17T17:16:51+03:00",
"message": "INSERT INTO customer (doc_type, doc_value, licence_plate, vehicle_model) VALUES ('ctc', '99026XXXXX', 'UXXXXRMX', 'LAND ROVER RANGE ROVER')",
"context": "[n '_GET' => [],n '_POST' => [n 'postdate' => '10/03/2019',n 'postnum' => '18810018180002XXXXX',n 'postsum' => '1000',n 'divid' => '1194040',n 'uin' => '18810018180002XXXXX',n 'regnum' => 'UXXXXRM',n 'regreg' => '1X',n 'reg' => 'XXXXX34084',n 'discount' => '1',n 'discountdate' => '01/04/2019 23:59:59',n 'allfines' => '[{"Discount":"1","enableDiscount":false,"DateDecis":"2019-03-10 09:05:00","KoAPcode":"12.6","DateDiscount":"01/04/2019 23:59:59","VehicleModel":"LAND ROVER RANGE ROVER","KoAPtext":"DRIVING A VEHICLE WITHOUT A SEAT BELT ATTACHED, TRANSPORTING PASSENGERS NOT WEARING SEAT BELTS IF THE VEHICLE IS EQUIPPED WITH SEAT BELTS, AS WELL AS RIDING A MOTORCYCLE OR TRANSPORTING PASSENGERS ON A MOTORCYCLE WITHOUT HELMETS OR WITH UNFASTENED HELMETS","NumPost":"18810018180002XXXXX","kbk":"18811630020016000140","Summa":1000,"Division":1194040,"enablePics":false,"id":"18#FF474785255","SupplierBillID":"18810018180002XXXXX","DatePost":"10/03/2019"},{"Discount":"1","enableDiscount":false,"DateDecis":"2019-03-08 14:55:00","KoAPcode":"12.9ч.2","DateDiscount":"01/04/2019 23:59:59","VehicleModel":"LAND ROVER RANGE ROVER","KoAPtext":"EXCEEDING THE ESTABLISHED SPEED LIMIT BY MORE THAN 20, BUT NOT MORE THAN 40 KM/H","NumPost":"18810118190312XXXXX","kbk":"18811630020016000140","Summa":500,"Division":1194010,"enablePics":true,"id":"18#18810118190312XXXXX","SupplierBillID":"18810118190312XXXXX","DatePost":"12/03/2019"}]',n ],n]"
}
{
"_index": "paygibdd",
"_type": "log",
"@timestamp": "2019-02-28T17:30:57+03:00",
"message": "Incoming payment request",
"extra": "[n 'request_data' => [n 'postdate' => '02.10.2017',n 'postnum' => '188101161710029XXXXX',n 'postsum' => '500',n 'divid' => '1192201',n 'uin' => '188101161710029XXXXX',n 'regnum' => 'XXXXXCB',n 'regreg' => '1XX',n 'reg' => '16462XXXXX',n 'discount' => '1',n 'discountdate' => '2017-10-23 23:59:59',n 'allfines' => '[{"Discount":"0","DateDecis":"2016-12-17 02:30:00","KoAPcode":"12.26ч.1","KoAPtext":"FAILURE TO COMPLY WITH THE LEGAL REQUIREMENT OF A POLICE OFFICER TO UNDERGO MEDICAL EXAMINATION FOR INTOXICATION","NumPost":"188104121603000XXXXX","kbk":"18811630020016000140","Summa":"30000","Division":1188030,"enablePics":false,"id":"12#FF176064188","SupplierBillID":"188104121603000XXXXX","DatePost":"2017-03-06","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2017-09-18 14:32:00","KoAPcode":"12.9ч.2","DateDiscount":"2017-10-23 23:59:59","KoAPtext":"EXCEEDING THE ESTABLISHED SPEED LIMIT BY MORE THAN 20, BUT NOT MORE THAN 40 KM/H","NumPost":"188101161710029XXXXX","kbk":"18811630020016000140","Summa":"500","Division":1192201,"enablePics":true,"id":"16#43522519023478911XXXXX","SupplierBillID":"188101161710029XXXXX","DatePost":"2017-10-02","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2017-11-01 04:23:00","KoAPcode":"12.9ч.2","DateDiscount":"2017-11-24 23:59:59","KoAPtext":"EXCEEDING THE ESTABLISHED SPEED LIMIT BY MORE THAN 20, BUT NOT MORE THAN 40 KM/H","NumPost":"18810116171104XXXXX","kbk":"18811630020016000140","Summa":"500","Division":1192201,"enablePics":true,"id":"16#44211639030358281XXXXX","SupplierBillID":"1881011617110XXXXX","DatePost":"2017-11-04","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2017-10-31 12:08:00","KoAPcode":"12.9ч.2","DateDiscount":"2017-11-27 23:59:59","KoAPtext":"EXCEEDING THE ESTABLISHED SPEED LIMIT BY MORE THAN 20, BUT NOT MORE THAN 40 KM/H","NumPost":"188101161711056XXXXX","kbk":"18811630020016000140","Summa":"500","Division":1192201,"enablePics":true,"id":"16#44236760030609331XXXXX","SupplierBillID":"188101161711056XXXXX","DatePost":"2017-11-05","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2018-01-27 23:46:00","KoAPcode":"12.37ч.2","DateDiscount":"2018-02-16 23:59:59","KoAPtext":"FAILURE OF THE VEHICLE OWNER TO COMPLY WITH THE FEDERAL LAW REQUIREMENT FOR OSAGO, AS WELL AS DRIVING A VEHICLE IF SUCH OSAGO IS CLEARLY ABSENT","NumPost":"188102161820027XXXXX","kbk":"18811630020016000140","Summa":"800","Division":1192200,"enablePics":false,"id":"16#4516501003986993XXXXX","SupplierBillID":"188102161820027XXXXX","DatePost":"2018-01-27","DateSSP":null}]',n ],n]
In summary, all payment details were publicly accessible: the fine notice number, the vehicle's state registration number, the enforcement proceedings number for payments made to the bailiff service, the first and last digits of bank cards, the payment gateway used, the payer's full name, and email address, among many other details.
For a selected day (04/12), there were (records) in the indexes:
shtrafov-net 251
paygibdd 3821
gosoplata 20676
oplata-fssp 15277The Shodan search engine first discovered this server publicly on 02/24/2019.
News about data leaks and insiders can always be found on my Telegram channel "».
Source: habr.com
