🥇Sadu tuhandeid kodanikelt saadud makseid GIBDD-le ja FSSP-le olid avatud juurdepääsuga

Meditsiinilised andmed – olid, krediidiandmed – olid, seekord on jutuks andmed liiklusmaksudest ja haldusõiguse täitmise tasumistest.

Hea uudis on see, et need maksed ei ole seotud ametliku riigiportaaliga. Halb uudis on see, et andmeid on palju ja need on rohkem kui «isikupärased».

Distsipliin: kogu allpool olev teave avaldatakse ainult hariduslikel eesmärkidel. Autor ei ole saanud juurdepääsu kolmandate isikute ja ettevõtete isikuandmetele. Teave on saadud kas avatud allikatest või on autori käes anonüümsete headest soovidest.

12. aprillil (öisel ajal) avastati Elasticsearchi server, mis ei nõudnud autentimist ühenduse loomiseks. Kuidas avatud Elasticsearchi baase avastatakse kirjutasin ma blogis postituse.

Elasticsearchi indeksites sisalduvad logid teatud info süsteemist (IS). Tehti oletus, et see server on seotud veebilehtedega, mis võtavad vastu makseid erinevate riigiteenuste kasuks: oplatagibdd.rf, paygibdd.ru, gos-oplata.ru, shtrafov.net ja oplata-fssp.ru.

Hommikul 13.04.2019 saatsin teate järgmistele e-posti aadressidele: support@gos-oplata.ru, support@oplata-fssp.ru, support@paygibdd.ru, kuid vastust (nagu sageli juhtub) ei saanud. Server suleti vaikselt ja kadus avatud juurdepääsust 13.04.2019 umbes 15:20-15:45 (MSK).

Enne serveri sulgemist nägid Elasticsearchi indeksid välja järgmiselt:

Nüüd pöördume kõige huvitavama juurde – isikuandmeteni. Nagu ma varem mainisin, sisaldasid indeksid teatud logide andmeid. Ja nagu sageli juhtub, olid logid uskumatult detailsed, isegi liiga detailsed.

Logid olid saadaval alates 28.02.2019, mitte kogu ISi tööajast. Mõnedes indeksites olid andmed alates 17.03.2019.

Näiteks, indeksi logide põhjal gosoplata võis saada sellise teabe (kokku 248365, välja arvatud vigade logimine):

{
        "_index": "gosoplata",
        "_type": "log",
        "@timestamp": "2019-03-02T20:55:02+03:00",
          "message": "Makse leiti GISEs",
          "extra": "[n    'gis_info' => unserialize('O:34:"app\models\payment\api\PenaltyInfo":10:{s:10:"billNumber";s:20:"ХХХХХ021170025955001";s:8:"billDate";s:10:"2017-04-03";s:10:"validUntil";s:10:"2017-06-03";s:6:"amount";s:9:"146030.26";s:7:"addInfo";s:1424:"Makse võlgnevus IP № ХХХХХ/17/ ХХХХХ -IP 03.04.2017 MIKHXXX H. H., Laenu maksetega seotud võlgnevus (välja arvatud hüpoteek)////UIN32253021170025955001_IP0;Allüksus: UFK NOVGORODI ALALIIDUS (OSNOV NOVGOROD, BATECKI JA KRESTETSI RINGKONDAD UFFSP RUSSIA NOVGORODI ALALIIDUSES L/S 05501845860);Saaja: UFK NOVGORODI ALALIIDUS (OSNOV NOVGOROD, BATECKI JA KRESTETSI RINGKONDAD UFFSP RUSSIA NOVGORODI ALALIIDUSES L/S 05501845860);Saaja pank: NOVGORODI ALALIIDUS;Saaja konto number: 40302810400001000005;INN: 5321100670;KPP: 532132002;Saaja panga BIC: 044959001;OKATO: 49625000;KBK: 0;idDebtsum:146540.26;ipPaymentAmount:0.00;ipOperationAmount:0.00;dataUnloadDate:2018-12-04T11:26:19.000;dataIdDate:2017-01-27;dataIdNumber:2-53/2017;dataIpRiseDate:2017-04-03;dataIpNumber: ХХХХХ/17/ХХХХХ-IP;dataIdDbtrFio:MIKHX ХХХ ХХХ;dataIdDbtrBorn:ХХХ-09-03;dataIdDebtText:Laenu maksetega seotud võlgnevus;";s:7:"docName";s:3:"inn";s:9:"docNumber";s:12:" ХХХХХ0819584";s:9:"payStatus";s:1:"0";s:9:"quittance";s:1:"3";s:11:"amountToPay";s:9:"146030.26";}'),n]",
          "context": "[n    '_GET' => [],n    '_POST' => [],n]"
        }
      }

Olen kõik tundlikud andmed asendanud tähemärgiga „X”. Tegelikkuses hoiti kõike avatud kujul.

Indeksist oplata-fssp (kokku 283958, välja arvatud vead):

 {
        "_index": "oplata-fssp",
        "_type": "log",
          "@timestamp": "2019-02-28T22:17:24+03:00",
          "extra": "[n    'request_data' => [n        'MNT_ID' => 'ХХХХХ3280',n        'MNT_TRANSACTION_ID' => ''ХХХХХ0795c78337a5a308',n        'MNT_OPERATION_ID' => ''ХХХХХ 3232',n        'MNT_AMOUNT' => '544.00',n        'MNT_CURRENCY_CODE' => 'RUB',n        'MNT_TEST_MODE' => '0',n        'MNT_SIGNATURE' => '6435224ccХХХХХХХ10bbc970f6479787',n        'paymentSystem_unitId' => '1686945',n        'MNT_CORRACCOUNT' => '303',n        'MNT_PAY_SYSTEM' => 'payanyway',n        'MNT_IS_REGULAR' => '',n        'MNT_FORM_METHOD' => 'POST',n        'cardnumber' => '639002********7417',n    ],n    'model_attributes' => [n        'id' => 482137,n        'parent_id' => null,n        'name' => 'ПОХХХ ГАЛИНА ГХХХ',n        'ur' => 0,n        'birthdate' => 'ХХХХ-06-06',n        'doc_type' => null,n        'doc_value' => null,n        'hash' => ''ХХХХХ795c78337a5a308',n        'created_at' => '2019-02-28 22:16:10',n        'form_url' => 'https://service.moneta.ru/assistant.widget? 'ХХХХХ&MNT_CURRENCY_CODE=RUB&MNT_AMOUNT=544.00&MNT_DESCRIPTION=Оплата задолженности ФССП. Заказ N482137 УИН: 32223088190136500007 Делопроизводство: ХХХХХХ/19/ХХХХХ-ИП&MNT_TEST_MODE=0&'ХХХХХ &MNT_SUCCESS_URL=https://oplata-fssp.ru/payment/success&MNT_FAIL_URL=https://oplata-fssp.ru/payment/fail&MNT_PAY_SYSTEM=payanyway&MNT_IS_REGULAR=&MNT_FORM_METHOD=POST&followup=true',n        'email' => ''ХХХХХ@bk.ru',n        'payment_system_id' => 'moneta',n        'transaction_id' => '338533232',n        'updated_at' => '2019-02-28 22:16:16',n        'a3_order_hash' => null,n        'receipt_send' => null,n        'receipt_status_id' => null,n        'payment_status_id' => 'callback_received',n        'lead_source' => 'fssp',n    ],n]",
          "context": "[n    '_GET' => [],n    '_POST' => [n        'MNT_ID' => ''ХХХХХ280',n        'MNT_TRANSACTION_ID' => ''ХХХХХ795c78337a5a308',n        'MNT_OPERATION_ID' => ''ХХХХХ3232',n        'MNT_AMOUNT' => '544.00',n        'MNT_CURRENCY_CODE' => 'RUB',n        'MNT_TEST_MODE' => '0',n        'MNT_SIGNATURE' => '6435224cc'ХХХХХ10bbc970f6479787',n        'paymentSystem_unitId' => ''ХХХХХ45',n        'MNT_CORRACCOUNT' => '303',n        'MNT_PAY_SYSTEM' => 'payanyway',n        'MNT_IS_REGULAR' => '',n        'MNT_FORM_METHOD' => 'POST',n        'cardnumber' => '639002********7417',n    ],n]"
        }
      }

Siit on näha (väärtus cardnumber), et täielike krediitkaardi numbrite lekkimise eest on nende omanike kaitsnud ainult see, et makseportaal (antud juhul moneta.ru) ei andnud antud IS numbreid avatud kujul (ainult kaardi esimese 6 ja viimase 4 numbri).

Samuti oli logidest näha, et FSSP ametlik veebisait pakub kodanikele maksete tegemiseks selle IS-i kaudu: is.fssprus.ru/pay/?service=gosoplata&pay=ХХХХХХ/18/ХХХХХХ-IP. Mis kaudselt kinnitab tekst allosas lehe oplata-fssp.ru:

Nüüd vaatame, mis toimub liiklusõigusrikkumise trahvidega. Ilmselt vastutavad selle eest indeksid shatrafov-net (4528 kirjet, välja arvatud vead) ja paygibdd (140666 kirjet, välja arvatud vead):

{
        "_index": "shtrafov-net",
        "_type": "log",
          "@timestamp": "2019-03-17T17:16:51+03:00",
          "message": "INSERT INTO customer (doc_type, doc_value, licence_plate, vehicle_model) VALUES ('ctc', '99026ХХХХХ', 'УХХХРМХХ', 'LAND ROVER RANGE ROVER')",
          "context": "[n    '_GET' => [],n    '_POST' => [n        'postdate' => '10/03/2019',n        'postnum' => '18810018180002ХХХХХХ',n        'postsum' => '1000',n        'divid' => '1194040',n        'uin' => '18810018180002ХХХХХХ',n        'regnum' => 'УХХХРМ',n        'regreg' => '1Х',n        'reg' => 'ХХХХХ34084',n        'discount' => '1',n        'discountdate' => '01/04/2019 23:59:59',n        'allfines' => '[{"Discount":"1","enableDiscount":false,"DateDecis":"2019-03-10 09:05:00","KoAPcode":"12.6","DateDiscount":"01/04/2019 23:59:59","VehicleModel":"LAND ROVER RANGE ROVER","KoAPtext":"DRIVING A VEHICLE WITHOUT A SEATBELT, TRANSPORTING PASSENGERS WITHOUT SEATBELTS WHEN THE VEHICLE IS EQUIPPED WITH SEATBELTS; AS WELL AS RIDING A MOTORCYCLE OR TRANSPORTING PASSENGERS ON A MOTORCYCLE WITHOUT HELMETS OR WITH UNBUTTONED HELMETS","NumPost":"18810018180002ХХХХХХ","kbk":"18811630020016000140","Summa":1000,"Division":1194040,"enablePics":false,"id":"18#FF474785255","SupplierBillID":"18810018180002ХХХХХХ","DatePost":"10/03/2019"},{"Discount":"1","enableDiscount":false,"DateDecis":"2019-03-08 14:55:00","KoAPcode":"12.9ч.2","DateDiscount":"01/04/2019 23:59:59","VehicleModel":"LAND ROVER RANGE ROVER","KoAPtext":"EXCEEDING THE ESTABLISHED SPEED LIMIT BY MORE THAN 20 BUT NOT MORE THAN 40 KM/H","NumPost":"18810118190312ХХХХХХ","kbk":"18811630020016000140","Summa":500,"Division":1194010,"enablePics":true,"id":"18#18810118190312ХХХХХХ","SupplierBillID":"18810118190312ХХХХХХ","DatePost":"12/03/2019"}]',n    ],n]"
        }

{
        "_index": "paygibdd",
        "_type": "log",
        "@timestamp": "2019-02-28T17:30:57+03:00",
        "message": "Incoming payment request",
          "extra": "[n    'request_data' => [n        'postdate' => '02.10.2017',n        'postnum' => '188101161710029ХХХХХ',n        'postsum' => '500',n        'divid' => '1192201',n        'uin' => '188101161710029ХХХХХ',n        'regnum' => 'XХХХCB',n        'regreg' => '1ХХ',n        'reg' => '16462ХХХХХ',n        'discount' => '1',n        'discountdate' => '2017-10-23 23:59:59',n        'allfines' => '[{"Discount":"0","DateDecis":"2016-12-17 02:30:00","KoAPcode":"12.26ч.1","KoAPtext":"FAILURE TO COMPLY WITH A LAWFUL REQUIREMENT OF A POLICE OFFICER TO UNDERGO A MEDICAL EXAMINATION FOR ALCOHOL INTOXICATION","NumPost":"188104121603000ХХХХХ","kbk":"18811630020016000140","Summa":"30000","Division":1188030,"enablePics":false,"id":"12#FF176064188","SupplierBillID":"188104121603000ХХХХХ","DatePost":"2017-03-06","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2017-09-18 14:32:00","KoAPcode":"12.9ч.2","DateDiscount":"2017-10-23 23:59:59","KoAPtext":"EXCEEDING THE ESTABLISHED SPEED LIMIT BY MORE THAN 20 BUT NOT MORE THAN 40 KM/H","NumPost":"188101161710029ХХХХХ","kbk":"18811630020016000140","Summa":"500","Division":1192201,"enablePics":true,"id":"16#43522519023478911ХХХХХ","SupplierBillID":"188101161710029ХХХХХ","DatePost":"2017-10-02","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2017-11-01 04:23:00","KoAPcode":"12.9ч.2","DateDiscount":"2017-11-24 23:59:59","KoAPtext":"EXCEEDING THE ESTABLISHED SPEED LIMIT BY MORE THAN 20 BUT NOT MORE THAN 40 KM/H","NumPost":"18810116171104ХХХХХ","kbk":"18811630020016000140","Summa":"500","Division":1192201,"enablePics":true,"id":"16#44211639030358281ХХХХХ","SupplierBillID":"1881011617110ХХХХХ","DatePost":"2017-11-04","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2017-10-31 12:08:00","KoAPcode":"12.9ч.2","DateDiscount":"2017-11-27 23:59:59","KoAPtext":"EXCEEDING THE ESTABLISHED SPEED LIMIT BY MORE THAN 20 BUT NOT MORE THAN 40 KM/H","NumPost":"188101161711056ХХХХХ","kbk":"18811630020016000140","Summa":"500","Division":1192201,"enablePics":true,"id":"16#44236760030609331ХХХХХ","SupplierBillID":"188101161711056ХХХХХ","DatePost":"2017-11-05","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2018-01-27 23:46:00","KoAPcode":"12.37ч.2","DateDiscount":"2018-02-16 23:59:59","KoAPtext":"FAILURE OF THE OWNER OF THE VEHICLE TO COMPLY WITH THE OBLIGATION TO CARRY OSAGO ESTABLISHED BY FEDERAL LAW; AS WELL AS DRIVING A VEHICLE IF SUCH OSAGO IS APPARENTLY ABSENT","NumPost":"188102161820027ХХХХХ","kbk":"18811630020016000140","Summa":"800","Division":1192200,"enablePics":false,"id":"16#4516501003986993ХХХХХ","SupplierBillID":"188102161820027ХХХХХ","DatePost":"2018-01-27","DateSSP":null}]',n    ],n]",

Kokkuvõttes olid kõik maksete üksikasjad vabalt kätte saadavad: trahvi määruse number, auto riigipartii number, täitemenetluse number, millega makset tehti kohtutäiturite teenistusi kasuks, pangakaartide esimesed ja viimased numbrid, millise makse värava kaudu makse tehti, maksja nimi ja e-posti aadress ning palju muud.

Ühel valitud päeval (12.04) oli indeksites (registreeritud) :

shtrafov-net    251
paygibdd        3821
gosoplata       20676
oplata-fssp     15277

Otsingumootor Shodan avastas selle serveri esmakordselt avatud juurdepääsuga 24.02.2019.

Infot andmelekkete ja siseinfo kohta saab alati leida minu Telegrami kanalist „Andmelekked».

Allikas: habr.com

Sajad tuhanded kodanike maksed GIBDD-le ja FSSP-le olid avalikus ligipääsetavuses