I kēia lā, e nānā mākou i ʻelua mau hihia i ka manawa hoʻokahi - ʻo ka ʻikepili o nā mea kūʻai aku a me nā hoa o nā ʻoihana ʻokoʻa ʻelua i loaʻa manuahi "mahalo" wehe i nā kikowaena Elasticsearch me nā logs of information system (IS) o kēia mau hui.
I ka hihia mua, he ʻumi kaukani kēia (a he mau haneli paha mau haneli) o nā tiketi no nā hanana moʻomeheu like ʻole (nā hale kiʻiʻoniʻoni, nā hui, nā huakaʻi kahawai, a me nā mea ʻē aʻe) i kūʻai ʻia ma o ka ʻōnaehana Radario (www.radario.ru).
I ka lua o ka hihia, ʻo kēia ka ʻikepili no nā huakaʻi huakaʻi o nā kaukani (hiki paha i nā ʻumi tausani) o ka poʻe huakaʻi i kūʻai i nā huakaʻi ma o nā hui huakaʻi e pili ana i ka ʻōnaehana Sletat.ru (www.sletat.ru).
Makemake au e hoʻomaopopo koke ʻaʻole ʻokoʻa nā inoa o nā hui i ʻae i ka ʻikepili e loaʻa i ka lehulehu, akā ʻo ka hoʻokokoke ʻana o kēia mau hui e ʻike i ka hanana a me ka hopena o ia mea. Akā ʻo ka mea mua…
Дисклеймер: вся информация ниже публикуется исключительно в образовательных целях. Автор не получал доступа к персональным данным третьих лиц и компаний. Информация взята либо из открытых источников, либо была предоставлена автору анонимными доброжелателями.
Ka hihia hoʻokahi. "Radario"
I ke ahiahi o 06.05.2019/XNUMX/XNUMX kā mākou ʻōnaehana , nona ka lawelawe kūʻai tikiki uila ʻo Radario.
Wahi a ka moʻomeheu kaumaha i hoʻokumu mua ʻia, aia ka server i nā kikoʻī kikoʻī o ka ʻōnaehana ʻike o ka lawelawe, kahi i hiki ai ke kiʻi i ka ʻikepili pilikino, nā mea hoʻohana a me nā ʻōlelo huna, a me nā tiketi uila no nā hanana like ʻole ma ka ʻāina.
ʻOi aku ka nui o nā lāʻau i ka 1 TB.
Wahi a ka Shodan search engine, ua ʻike ʻia ka kikowaena mai ka lā Malaki 11.03.2019, 06.05.2019. Ua haʻi aku au i nā limahana ʻo Radario ma 22/50/07.05.2019 ma 09:30 (MSK) a ma XNUMX/XNUMX/XNUMX ma kahi o XNUMX:XNUMX i loaʻa ʻole ke kikowaena.
Aia i loko o nā lāʻau kahi hōʻailona mana āpau (hoʻokahi), e hāʻawi ana i ke komo i nā tiketi āpau i kūʻai ʻia ma o nā loulou kūikawā, e like me:
http://radario.ru/internal/tickets/XXXXXXXX/print?access_token=******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTk
http://radario.ru/internal/orders/YYYYYYY/print?access_token=******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTkʻO ka pilikia hoʻi ʻo ka helu ʻana i nā tiketi, ua hoʻohana ʻia ka helu mau o nā kauoha a me ka helu maʻalahi o ka helu tiketi (XXXXXXXX) a i ʻole kauoha (YYYYYYY), ua hiki ke kiʻi i nā tiketi āpau mai ka ʻōnaehana.
No ka nānā ʻana i ka pili o ka waihona, ua kūʻai maoli wau iaʻu iho i ka tiketi haʻahaʻa loa:
a ma hope ua loaʻa ia ma kahi kikowaena lehulehu ma nā moʻolelo IS:
http://radario.ru/internal/tickets/11819272/print?access_token==******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTkMa kahi kaʻawale, makemake wau e hoʻoikaika i loaʻa nā tiketi no nā hanana i hana ʻia a no nā mea e hoʻolālā ʻia nei. ʻO ia hoʻi, hiki i ka mea hoʻouka kaua ke hoʻohana i ka tiketi a kekahi e komo i ka hanana i hoʻolālā ʻia.
Ma ka awelika, ʻo kēlā me kēia helu Elasticsearch i loaʻa nā lāʻau no hoʻokahi lā kikoʻī (e hoʻomaka ana mai 24.01.2019/07.05.2019/25 a 35/XNUMX/XNUMX) i loaʻa mai XNUMX a XNUMX tausani mau tiketi.
Ma waho aʻe o nā tiketi ponoʻī, aia i loko o ka papa kuhikuhi nā inoa inoa (nā leka uila) a me nā ʻōlelo huna no ke komo ʻana i nā moʻolelo pilikino o nā hoa hana ʻo Radario nāna e kūʻai aku i nā tiketi i kā lākou hanana ma o kēia lawelawe:
Content: "ReturnUrl=&UserEmail=***@yandex.ru&UserPassword=***"Ma ka huina, ua ʻike ʻia ma mua o 500 mau paʻa komo/huaʻōlelo. ʻIke ʻia nā helu kūʻai tiketi ma nā moʻolelo pilikino o nā hoa:
Ua loaʻa pū i ka lehulehu nā inoa, nā helu kelepona a me nā helu leka uila o nā mea kūʻai i hoʻoholo e hoʻihoʻi i nā tiketi i kūʻai mua ʻia:
"Content": "{"name":"***","surname":"*** ","middleName":"Евгеньевна ","passportType":1,"passportNumber":"","passportIssueDate":"11-11-2011 11:11:11","passportIssuedBy":"","email":"***@mail.ru","phone":"+799*******","ticketNumbers":["****24848","****948732"],"refundReason":4,"comment":""}"I hoʻokahi lā i koho ʻia, ʻoi aku ma mua o 500 mau moʻolelo i ʻike ʻia.
Ua loaʻa iaʻu kahi pane i ka makaʻala mai ka luna ʻenehana o Radario:
ʻO wau ke alakaʻi ʻenehana o Radario a makemake wau e hoʻomaikaʻi iā ʻoe no ka ʻike ʻana i ka pilikia. E like me kāu e ʻike ai, ua pani mākou i ke komo ʻana i ka elastic a ke hoʻoholo nei i ka pilikia o ka hoʻopuka hou ʻana i nā tiketi no nā mea kūʻai aku.
Ma hope iki aku ua hana ka hui i kahi ʻōlelo kūhelu:
Ua ʻike ʻia kahi nāwaliwali ma ka ʻōnaehana kūʻai tiketi uila ʻo Radario a hoʻoponopono koke ʻia, hiki ke alakaʻi i ka leak o ka ʻikepili mai nā mea kūʻai aku o ka lawelawe, ua haʻi aku ka luna kūʻai o ka hui, ʻo Kirill Malyshev, i ka Moscow City News Agency.
"Ua ʻike maoli mākou i kahi nāwaliwali i ka hana ʻōnaehana e pili ana i nā hoʻonui maʻamau, i hoʻopaʻa ʻia ma hope koke o ka loaʻa ʻana. Ma muli o ka nāwaliwali, ma lalo o kekahi mau kūlana, hiki i nā hana aloha ʻole a nā ʻaoʻao ʻekolu ke alakaʻi i ka leakage data, akā ʻaʻohe mea i hoʻopaʻa ʻia. I kēia manawa, ua hoʻopau ʻia nā hewa a pau, "wahi a K. Malyshev.
Ua hoʻokūpaʻa ʻia kahi ʻelele hui ua hoʻoholo ʻia e hoʻopuka hou i nā tiketi āpau i kūʻai ʻia i ka wā o ka hoʻonā ʻana i ka pilikia i mea e hoʻopau loa ai i ka hiki ke hoʻopunipuni i nā mea kūʻai aku lawelawe.
I kekahi mau lā ma hope mai, ua nānā au i ka loaʻa ʻana o ka ʻikepili me ka hoʻohana ʻana i nā loulou leaked - ua uhi ʻia ke komo ʻana i nā tiketi "hōʻike ʻia". I koʻu manaʻo, ʻo kēia kahi ala kūpono, ʻoihana e hoʻonā i ka pilikia o ka leakage data.
hihia ʻelua. "Fly.ru"
I ke kakahiaka nui 15.05.2019/XNUMX/XNUMX Naʻauao ʻAha ʻIkepili DeviceLock ʻike ʻia kahi kikowaena Elasticsearch lehulehu me nā lāʻau o kekahi IS.
Ma hope mai ua hoʻokumu ʻia ʻo ia ka server i ka lawelawe koho huakaʻi "Sletat.ru".
Mai ka papa kuhikuhi cbto__0 hiki ke loaʻa i nā tausani (11,7 tausani me nā kope kope) o nā leka uila, a me kekahi ʻike uku (nā koina huakaʻi) a me ka ʻikepili huakaʻi (i ka manawa, kahi, nā kikoʻī tiketi ea. o nā mea a pau ʻO nā huakaʻi hele i ka huakaʻi, a me nā mea ʻē aʻe) ma kahi o 1,8 tausani mau moʻolelo:
"full_message": "Получен запрос за создание платежного средства: {"SuccessReturnUrl":"https://sletat.ru/tour/7-1939548394-65996246/buy/?ClaimId=b5e3bf98-2855-400d-a93a-17c54a970155","ErrorReturnUrl":"https://sletat.ru/","PaymentAgentId":15,"DocumentNumber":96629429,"DocumentDisplayNumber":"4451-17993","Amount":36307.0,"PaymentToolType":3,"ExpiryDateUtc":"2020-04-03T00:33:55.217358+03:00","LifecycleType":2,"CustomerEmail":"[email protected]","Description":"","SettingsId":"8759d0dd-da54-45dd-9661-4e852b0a1d89","AdditionalInfo":"{"TourOfficeAdditionalInfo":{"IsAdditionalPayment":false},"BarrelAdditionalInfo":{"Tickets":[{"Passenger":{"FIO":"XXX VIKTORIIA"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX ANDREI"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX Andrei"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false}],"Segments":[{"Flight":"5659","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"LED","DepartureAirport":"LED","DepartureAirportIataCode":"LED","DepartureDate":"2019-04-11T02:45:00","DepartureTime":null,"ArrivalCity":"SHJ","ArrivalAirport":"SHJ","ArrivalAirportIataCode":"SHJ","ArrivalDate":"2019-04-11T09:40:00","ArrivalTime":null,"FareCode":null},{"Flight":"5660","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"SHJ","DepartureAirport":"SHJ","DepartureAirportIataCode":"SHJ","DepartureDate":"2019-04-14T10:45:00","DepartureTime":null,"ArrivalCity":"LED","ArrivalAirport":"LED","ArrivalAirportIataCode":"LED","ArrivalDate":"2019-04-14T15:50:00","ArrivalTime":null,"FareCode":null}]},"Tickets":[{"Passenger":{"FIO":"XXX VIKTORIIA"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX ANDREI"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX Andrei"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false}],"Segments":[{"Flight":"5659","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"LED","DepartureAirport":"LED","DepartureAirportIataCode":"LED","DepartureDate":"2019-04-11T02:45:00","DepartureTime":null,"ArrivalCity":"SHJ","ArrivalAirport":"SHJ","ArrivalAirportIataCode":"SHJ","ArrivalDate":"2019-04-11T09:40:00","ArrivalTime":null,"FareCode":null},{"Flight":"5660","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"SHJ","DepartureAirport":"SHJ","DepartureAirportIataCode":"SHJ","DepartureDate":"2019-04-14T10:45:00","DepartureTime":null,"ArrivalCity":"LED","ArrivalAirport":"LED","ArrivalAirportIataCode":"LED","ArrivalDate":"2019-04-14T15:50:00","ArrivalTime":null,"FareCode":null}]}","FinancialSystemId":9,"Key":"18fe21d1-8c9c-43f3-b11d-6bf884ba6ee0"}"Ma ke ala, hana maikaʻi nā loulou i nā huakaʻi uku:
Ma nā papa kuhikuhi me ka inoa graylog_ i loko o ka kikokikona maʻemaʻe nā loina a me nā ʻōlelo huna o nā hui huakaʻi i pili i ka ʻōnaehana Sletat.ru a kūʻai aku i nā huakaʻi i kā lākou mea kūʻai:
"full_message": "Tours by request 155213901 added to local cache with key 'user_cache_155213901' at 5/6/2019 4:49:07 PM, rows found 0, sortedPriceLength 215. QueryString: countryId=90&cityFromId=1265&s_nightsMin=6&s_nightsMax=14&stars=403%2c404&minHotelRating=1¤cyAlias=RUB&pageSize=300&pageNumber=1&s_showcase=true&includeOilTaxesAndVisa=0&login=zakaz%40XXX.ru&password=XXX, Referer: , UserAgent: , IP: 94.154.XX.XX."E like me kaʻu mau manaʻo, ua hōʻike ʻia he mau haneli komo / ʻōlelo huna.
Mai ka moʻokāki pilikino o ka hui huakaʻi ma ka puka agent.sletat.ru ua hiki ke kiʻi i ka ʻikepili o ka mea kūʻai aku, me nā helu passport, nā palapala passport honua, nā lā hānau, nā inoa piha, nā helu kelepona a me nā helu leka uila.
Ua haʻi aku au i ka lawelawe Sletat.ru ma 15.05.2019/10/46 ma 16:00 (MSK) a i kekahi mau hola ma hope (a hiki i XNUMX:XNUMX) ua nalowale ia mai ko lākou komo manuahi. Ma hope mai, i ka pane ʻana i ka paʻi ʻana ma Kommersant, ua hana ka hoʻokele o ka lawelawe i kahi ʻōlelo ʻē loa ma o ka media:
Ua wehewehe ke poʻo o ka hui, ʻo Andrei Vershinin, ua hāʻawi ʻo Sletat.ru i kahi nui o nā mea hoʻokele kaʻahele hoa nui me ke komo ʻana i ka mōʻaukala o nā nīnau i ka ʻimi ʻimi. A ua manaʻo ʻo ia ua loaʻa iā DeviceLock: "Akā naʻe, ʻaʻole i loaʻa i ka ʻikepili i hōʻike ʻia ka ʻikepili passport o ka poʻe mākaʻikaʻi, nā inoa inoa huakaʻi a me nā ʻōlelo huna, ka ʻike uku, etc. Ua ʻike ʻo Andrei Vershinin ʻaʻole i loaʻa iā Sletat.ru kahi hōʻike o ia mau hoʻopiʻi koʻikoʻi. "Ke hoʻāʻo nei mākou e hoʻopili iā DeviceLock. Manaʻo mākou he kauoha kēia. ʻAʻole makemake kekahi poʻe i kā mākou ulu wikiwiki, "hoʻohui ʻo ia. "
E like me ka mea i hōʻike ʻia ma luna, ʻo nā logins, nā ʻōlelo huna, a me nā ʻikepili passport o ka poʻe mākaʻikaʻi i loko o ka lehulehu no ka manawa lōʻihi (ma ka liʻiliʻi loa mai Malaki 29.03.2019, XNUMX, i ka wā i hoʻopaʻa mua ʻia ai ke kikowaena o ka ʻoihana ma ka ʻaoʻao ākea e ka Shodan search engine). ʻOiaʻiʻo, ʻaʻohe mea i hoʻopili mai iā mākou. Manaʻo wau ua haʻi aku lākou i nā hui huakaʻi e pili ana i ka leak a koi iā lākou e hoʻololi i kā lākou ʻōlelo huna.
Hiki ke loaʻa mau nā nūhou e pili ana i ka leaks ʻike a me nā mea komo ma kaʻu kahawai Telegram "".
Source: www.habr.com