{"id":34790,"date":"2019-10-31T22:00:24","date_gmt":"2019-10-31T19:00:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe\/"},"modified":"2019-10-31T22:00:24","modified_gmt":"2019-10-31T19:00:24","slug":"opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","title":{"rendered":"Encore des centaines de milliers de paiements des citoyens au GIBDD et au FSSP \u00e9taient accessibles au public","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Rappelez-vous, j'ai <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/448440\/\">\u00e9crit sur Habr<\/a><\/noindex> et sur mon <noindex><a rel=\"nofollow\" href=\"http:\/\/tele.click\/dataleak\/961\">canal Telegram<\/a><\/noindex>, comment des d\u00e9tails sur les paiements en faveur de la GIBDD et de la FSSP des utilisateurs de sites sont devenus accessibles au public. <em>oplatagibd\u0434.\u0440\u0444<\/em>, <em>paygibdd.ru<\/em>, <em>gos-oplata.ru<\/em>, <em>amendes.net<\/em> et <em>oplata-fssp.ru<\/em>?<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Encore des centaines de milliers de paiements des citoyens au GIBDD et au FSSP \u00e9taient accessibles au public\" src=\"\/wp-content\/uploads\/2019\/05\/3f0928a00144c08cb608032ad7550ae5.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Mais ne riez pas, ce n'est pas une blague \u2014 le m\u00eame serveur avec les donn\u00e9es du m\u00eame syst\u00e8me s'est \u00e0 nouveau retrouv\u00e9 ouvert au monde entier.<\/p>\n<p><\/p>\n<p>Alors, c'est parti pour en discuter\u2026<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<pre><code class=\"plaintext\">Avertissement : toutes les informations ci-dessous sont publi\u00e9es uniquement \u00e0 des fins \u00e9ducatives. L'auteur n'a pas eu acc\u00e8s aux donn\u00e9es personnelles de tiers et d'entreprises. Les informations sont tir\u00e9es de sources ouvertes ou ont \u00e9t\u00e9 fournies \u00e0 l'auteur par des donateurs anonymes.<\/code><\/pre>\n<p><\/p>\n<p>Pour commencer, rappelons un peu la chronologie des \u00e9v\u00e9nements :<\/p>\n<p><\/p>\n<ul>\n<li>12.04.2019 (la nuit) un serveur Elasticsearch a \u00e9t\u00e9 d\u00e9couvert, n'exigeant pas d'authentification pour se connecter.<\/li>\n<li>13.04.2019 (le matin) un avis a \u00e9t\u00e9 envoy\u00e9 aux propri\u00e9taires du serveur.<\/li>\n<li>13.04.2019 (l'apr\u00e8s-midi) le serveur a \u00e9t\u00e9 \"silencieusement\" retir\u00e9 de l'acc\u00e8s public.<\/li>\n<\/ul>\n<p><\/p>\n<p>Au moment de la premi\u00e8re fermeture du serveur, les index Elasticsearch ressemblaient \u00e0 ceci :<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Encore des centaines de milliers de paiements des citoyens au GIBDD et au FSSP \u00e9taient accessibles au public\" src=\"\/wp-content\/uploads\/2019\/05\/7f2ee67a67a4caf7c7e0eebb0f50b33d.png\" style=\"display:block;margin: 0 auto;\" \/> <\/p>\n<p><\/p>\n<p>Et voici qu'\u00e0 nouveau, le 21.05.2019 vers 16h00 (MSK), le m\u00eame serveur Elasticsearch, avec les m\u00eames (plus de nouveaux) index, se retrouve \u00e0 nouveau accessible au public :<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Encore des centaines de milliers de paiements des citoyens au GIBDD et au FSSP \u00e9taient accessibles au public\" src=\"\/wp-content\/uploads\/2019\/05\/f915e575967ca597f19e913944dbc3dc.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Je n\u2019en croyais pas mes yeux lorsque j\u2019ai vu (juste apr\u00e8s une pr\u00e9sentation sur <em>PHDays<\/em> sur la d\u00e9tection des bases de donn\u00e9es ouvertes) dans ma bo\u00eete mail une notification de notre <noindex><a rel=\"nofollow\" href=\"https:\/\/www.devicelock.com\/ru\/data-breach-intelligence\/\">DeviceLock Data Breach Intelligence<\/a><\/noindex>. Pour \u00eatre honn\u00eate, la premi\u00e8re pens\u00e9e \u00e9tait que c'\u00e9tait un bug du syst\u00e8me.<\/p>\n<p><\/p>\n<p>Cependant, non, ce n'\u00e9tait pas un bug et apr\u00e8s avoir tout v\u00e9rifi\u00e9 manuellement, \u00e0 01h25 le 22.05.2019, j'ai de nouveau envoy\u00e9 une notification aux m\u00eames adresses que la premi\u00e8re fois.<\/p>\n<p><\/p>\n<p>Depuis la premi\u00e8re fermeture, ce serveur a \u00e9t\u00e9 scann\u00e9 par Shodan 11 fois et jusqu'au 21 mai, Elasticsearch a \u00e9t\u00e9 masqu\u00e9.<\/p>\n<p><\/p>\n<p>Ce n'est que le 24.05.2019 au matin que cet Elasticsearch a disparu de l'acc\u00e8s public une deuxi\u00e8me fois. Pendant ce temps, les index avaient consid\u00e9rablement augment\u00e9 :<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Encore des centaines de milliers de paiements des citoyens au GIBDD et au FSSP \u00e9taient accessibles au public\" src=\"\/wp-content\/uploads\/2019\/05\/889a939c98424e316308b41f0392e7ae.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Et si l'on consid\u00e8re les donn\u00e9es (seules les informations significatives contenant des donn\u00e9es personnelles des citoyens) dans les index pour la p\u00e9riode du 1er au 22 mai, voici ce que l'on obtient :<\/p>\n<p><\/p>\n<ul>\n<li>127,525 enregistrements dans l'index <em>paygibdd<\/em> <\/li>\n<li>49,627 enregistrements dans l'index <em>shtrafov-net<\/em><\/li>\n<li>162,282 enregistrements dans l'index <em>oplata-fssp<\/em><\/li>\n<li>220,201 enregistrements dans l'index <em>gosoplata<\/em><\/li>\n<\/ul>\n<p><\/p>\n<p>Exemple de donn\u00e9es de l'index <em>gosoplata<\/em>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Encore des centaines de milliers de paiements des citoyens au GIBDD et au FSSP \u00e9taient accessibles au public\" src=\"\/wp-content\/uploads\/2019\/05\/8f596de149b6c6a4bf7d06abfcc90e2c.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Exemple de donn\u00e9es de l'index <em>paygibdd<\/em>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Encore des centaines de milliers de paiements des citoyens au GIBDD et au FSSP \u00e9taient accessibles au public\" src=\"\/wp-content\/uploads\/2019\/05\/20c88b7f644f551775bd73d02f6c4dc6.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Eh bien, la cerise sur le g\u00e2teau a \u00e9t\u00e9 un e-mail d'une des adresses \u00e0 lesquelles j'avais envoy\u00e9 des notifications :<\/p>\n<p><\/p>\n<blockquote><p>Nous avons re\u00e7u votre message concernant l'ElasticSearch ouvert \u2014 merci pour l'information, la base de donn\u00e9es a \u00e9t\u00e9 ferm\u00e9e. L'administrateur syst\u00e8me ayant rouvert l'acc\u00e8s a \u00e9t\u00e9 licenci\u00e9. Le service juridique pr\u00e9pare une d\u00e9claration \u00e0 adresser au minist\u00e8re de l'Int\u00e9rieur de la R\u00e9publique du Tatarstan concernant les actions de l'administrateur syst\u00e8me, en vertu des articles 272 et 273 du Code p\u00e9nal de la F\u00e9d\u00e9ration de Russie.<\/p><\/blockquote>\n<p>Vous pouvez toujours trouver des nouvelles sur les fuites d'informations et les insiders sur ma cha\u00eene Telegram \u00ab<noindex><a rel=\"nofollow\" href=\"http:\/\/tele.click\/dataleak\">Fuites d'informations<\/a><\/noindex>\u00bb: <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/dataleak\">https:\/\/t.me\/dataleak<\/a><\/noindex>.<\/p>\n<p>Source : <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/454048\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0432 \u043f\u043e\u043b\u044c\u0437\u0443 \u0413\u0418\u0411\u0414\u0414 \u0438 \u0424\u0421\u0421\u041f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0430\u0439\u0442\u043e\u0432 \u043e\u043f\u043b\u0430\u0442\u0430\u0433\u0438\u0431\u0434\u0434.\u0440\u0444, paygibdd.ru, gos-oplata.ru, \u0448\u0442\u0440\u0430\u0444\u043e\u0432.net \u0438 oplata-fssp.ru? \u0422\u043e\u043b\u044c\u043a\u043e \u043d\u0435 \u043d\u0430\u0434\u043e \u0441\u043c\u0435\u044f\u0442\u044c\u0441\u044f, \u044d\u0442\u043e \u0432\u043e\u0432\u0441\u0435 \u043d\u0435 \u0448\u0443\u0442\u043a\u0430 \u2014 \u0442\u043e\u0442 \u0436\u0435 \u0441\u0430\u043c\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0442\u043e\u0439 \u0436\u0435 \u0441\u0430\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0434\u043b\u044f \u0432\u0441\u0435\u0433\u043e \u043c\u0438\u0440\u0430. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26212,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34790","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u044f\u0442\u044c \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0433\u0440\u0430\u0436\u0434\u0430\u043d \u0432 \u0413\u0418\u0411\u0414\u0414 \u0438 \u0424\u0421\u0421\u041f \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:24+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:24+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Encore des centaines de milliers de paiements des citoyens \u00e0 la GIBDD et \u00e0 la FSSP \u00e9taient en acc\u00e8s ouvert | ProHoster","description":"Rappelez-vous, j'ai \u00e9crit sur Habr et sur mon canal Telegram, comment.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u044f\u0442\u044c \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0433\u0440\u0430\u0436\u0434\u0430\u043d \u0432 \u0413\u0418\u0411\u0414\u0414 \u0438 \u0424\u0421\u0421\u041f \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 | ProHoster","og:description":"\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a.","og:url":"https:\/\/prohoster.info\/fr\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:24+00:00","article:modified_time":"2019-10-31T19:00:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34790","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:15:37","updated":"2026-01-21 20:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/34790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=34790"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/34790\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/26212"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=34790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=34790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=34790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}