{"id":34790,"date":"2019-10-31T22:00:24","date_gmt":"2019-10-31T19:00:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe\/"},"modified":"2019-10-31T22:00:24","modified_gmt":"2019-10-31T19:00:24","slug":"opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","title":{"rendered":"Once again, hundreds of thousands of payments from citizens to the traffic police and bailiffs were publicly accessible","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Remember I <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/448440\/\">wrote on Habr<\/a><\/noindex> and on my <noindex><a rel=\"nofollow\" href=\"http:\/\/tele.click\/dataleak\/961\">Telegram channel<\/a><\/noindex>, how details of payments to the traffic police and the Federal Bailiffs Service by users of websites ended up publicly accessible <em>\u043e\u043f\u043b\u0430\u0442\u0430\u0433\u0438\u0431\u0434\u0434.\u0440\u0444<\/em>, <em>paygibdd.ru<\/em>, <em>gos-oplata.ru<\/em>, <em>\u0448\u0442\u0440\u0430\u0444\u043e\u0432.net<\/em> and <em>oplata-fssp.ru<\/em>?<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Once again, hundreds of thousands of payments from citizens to the traffic police and bailiffs were publicly accessible\" src=\"\/wp-content\/uploads\/2019\/05\/3f0928a00144c08cb608032ad7550ae5.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Just don't laugh, it's no joke \u2014 the same server with data from the same system was again open to the whole world.<\/p>\n<p><\/p>\n<p>So, let's get investigating\u2026<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<pre><code class=\"plaintext\">Disclaimer: All information below is published solely for educational purposes. The author has not accessed any personal data of third parties or companies. The information is taken either from open sources or was provided to the author by anonymous well-wishers.<\/code><\/pre>\n<p><\/p>\n<p>First, let me remind you of the timeline of events:<\/p>\n<p><\/p>\n<ul>\n<li>On April 12, 2019 (night), an Elasticsearch server was discovered that did not require authentication for connection.<\/li>\n<li>On April 13, 2019 (morning), a notification was sent to the server owners.<\/li>\n<li>On April 13, 2019 (afternoon), the server was 'quietly' removed from public access.<\/li>\n<\/ul>\n<p><\/p>\n<p>At the time of the first server closure, the Elasticsearch indices looked like this:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Once again, hundreds of thousands of payments from citizens to the traffic police and bailiffs were publicly accessible\" src=\"\/wp-content\/uploads\/2019\/05\/7f2ee67a67a4caf7c7e0eebb0f50b33d.png\" style=\"display:block;margin: 0 auto;\" \/> <\/p>\n<p><\/p>\n<p>And on May 21, 2019 at around 16:00 (MSK), the same Elasticsearch server, with the same (plus new) indices appeared back in public access:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Once again, hundreds of thousands of payments from citizens to the traffic police and bailiffs were publicly accessible\" src=\"\/wp-content\/uploads\/2019\/05\/f915e575967ca597f19e913944dbc3dc.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>I couldn't believe my eyes when I saw (immediately after my presentation at <em>PHDays<\/em> on the topic of discovering open databases) a notification from our <noindex><a rel=\"nofollow\" href=\"https:\/\/www.devicelock.com\/ru\/data-breach-intelligence\/\">DeviceLock Data Breach Intelligence<\/a><\/noindex>. To be honest, my first thought was that it was some kind of system glitch.<\/p>\n<p><\/p>\n<p>However, no, it wasn't a glitch, and after manually rechecking everything, at 01:25 on May 22, 2019, I sent a notification again to the same addresses as the first time.<\/p>\n<p><\/p>\n<p>Since the first closure, this server was scanned by Shodan 11 times, and until May 21, Elasticsearch on it was secured.<\/p>\n<p><\/p>\n<p>Only on the morning of May 24, 2019 did this Elasticsearch disappear from public access for the second time. During this time, the indices had grown significantly:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Once again, hundreds of thousands of payments from citizens to the traffic police and bailiffs were publicly accessible\" src=\"\/wp-content\/uploads\/2019\/05\/889a939c98424e316308b41f0392e7ae.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>And if we look at the data (only significant information containing personal data of citizens) in the indices from May 1 to May 22, the picture is as follows:<\/p>\n<p><\/p>\n<ul>\n<li>127,525 records in the index <em>paygibdd<\/em> <\/li>\n<li>49,627 records in the index <em>shtrafov-net<\/em><\/li>\n<li>162,282 records in the index <em>payment-fssp<\/em><\/li>\n<li>220,201 records in the index <em>gosoplata<\/em><\/li>\n<\/ul>\n<p><\/p>\n<p>Sample data from the index <em>gosoplata<\/em>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Once again, hundreds of thousands of payments from citizens to the traffic police and bailiffs were publicly accessible\" src=\"\/wp-content\/uploads\/2019\/05\/8f596de149b6c6a4bf7d06abfcc90e2c.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Sample data from the index <em>paygibdd<\/em>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Once again, hundreds of thousands of payments from citizens to the traffic police and bailiffs were publicly accessible\" src=\"\/wp-content\/uploads\/2019\/05\/20c88b7f644f551775bd73d02f6c4dc6.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>And the cherry on top was a letter from one of the addresses to which I sent notifications:<\/p>\n<p><\/p>\n<blockquote><p>We received your letter about the open ElasticSearch \u2014 thank you for the information, the database has been closed. The system administrator who reopened access has been dismissed. The legal service is preparing to submit an application to the Ministry of Internal Affairs of the Republic of Tatarstan regarding signs of the administrator's actions corresponding to articles 272 and 273 of the Criminal Code of the Russian Federation.<\/p><\/blockquote>\n<p>News about data leaks and insiders can always be found on my Telegram channel \"<noindex><a rel=\"nofollow\" href=\"http:\/\/tele.click\/dataleak\">Data Leaks<\/a><\/noindex>\u00bb: <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/dataleak\">https:\/\/t.me\/dataleak<\/a><\/noindex>.<\/p>\n<p>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/454048\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0432 \u043f\u043e\u043b\u044c\u0437\u0443 \u0413\u0418\u0411\u0414\u0414 \u0438 \u0424\u0421\u0421\u041f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0430\u0439\u0442\u043e\u0432 \u043e\u043f\u043b\u0430\u0442\u0430\u0433\u0438\u0431\u0434\u0434.\u0440\u0444, paygibdd.ru, gos-oplata.ru, \u0448\u0442\u0440\u0430\u0444\u043e\u0432.net \u0438 oplata-fssp.ru? \u0422\u043e\u043b\u044c\u043a\u043e \u043d\u0435 \u043d\u0430\u0434\u043e \u0441\u043c\u0435\u044f\u0442\u044c\u0441\u044f, \u044d\u0442\u043e \u0432\u043e\u0432\u0441\u0435 \u043d\u0435 \u0448\u0443\u0442\u043a\u0430 \u2014 \u0442\u043e\u0442 \u0436\u0435 \u0441\u0430\u043c\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0442\u043e\u0439 \u0436\u0435 \u0441\u0430\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0434\u043b\u044f \u0432\u0441\u0435\u0433\u043e \u043c\u0438\u0440\u0430. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26212,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34790","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u044f\u0442\u044c \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0433\u0440\u0430\u0436\u0434\u0430\u043d \u0432 \u0413\u0418\u0411\u0414\u0414 \u0438 \u0424\u0421\u0421\u041f \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:24+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:24+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Again, hundreds of thousands of citizen payments to the traffic police and the Federal Bailiffs Service were publicly accessible | ProHoster","description":"Remember I wrote on Habr and on my Telegram channel, how.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u044f\u0442\u044c \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0433\u0440\u0430\u0436\u0434\u0430\u043d \u0432 \u0413\u0418\u0411\u0414\u0414 \u0438 \u0424\u0421\u0421\u041f \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 | ProHoster","og:description":"\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:24+00:00","article:modified_time":"2019-10-31T19:00:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34790","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:15:37","updated":"2026-01-21 20:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/34790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=34790"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/34790\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/26212"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=34790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=34790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=34790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}