Niaj hnub no peb yuav saib ob qhov xwm txheej ib zaug - cov ntaub ntawv ntawm cov neeg siv khoom thiab cov neeg koom tes ntawm ob lub tuam txhab sib txawv tau muaj kev ywj pheej "ua tsaug" qhib Elasticsearch servers nrog cov ntaub ntawv teev cov ntaub ntawv (IS) ntawm cov tuam txhab no.
Hauv thawj kis, cov no yog kaum txhiab (thiab tej zaum ntau pua txhiab) ntawm daim pib rau ntau yam kev coj noj coj ua (theatres, clubs, dej mus ncig, thiab lwm yam) muag los ntawm Radario system (www.radario.ru).
Nyob rau hauv rooj plaub thib ob, qhov no yog cov ntaub ntawv ntawm cov neeg mus ncig ua si ntawm ntau txhiab (tej zaum ntau kaum tawm txhiab) ntawm cov neeg ncig tebchaws uas yuav ncig xyuas los ntawm cov koom haum mus ncig ua si txuas nrog Sletat.ru system (www.sletat.ru).
Kuv xav kom nco ntsoov tam sim ntawd tsis yog tsuas yog cov npe ntawm cov tuam txhab uas tso cai rau cov ntaub ntawv los ua pej xeem sib txawv, tab sis kuj yog txoj hauv kev ntawm cov tuam txhab no kom paub txog qhov xwm txheej thiab cov tshuaj tiv thaiv tom ntej rau nws. Tab sis thawj yam ua ntejβ¦
ΠΠΈΡΠΊΠ»Π΅ΠΉΠΌΠ΅Ρ: Π²ΡΡ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ Π½ΠΈΠΆΠ΅ ΠΏΡΠ±Π»ΠΈΠΊΡΠ΅ΡΡΡ ΠΈΡΠΊΠ»ΡΡΠΈΡΠ΅Π»ΡΠ½ΠΎ Π² ΠΎΠ±ΡΠ°Π·ΠΎΠ²Π°ΡΠ΅Π»ΡΠ½ΡΡ
ΡΠ΅Π»ΡΡ
. ΠΠ²ΡΠΎΡ Π½Π΅ ΠΏΠΎΠ»ΡΡΠ°Π» Π΄ΠΎΡΡΡΠΏΠ° ΠΊ ΠΏΠ΅ΡΡΠΎΠ½Π°Π»ΡΠ½ΡΠΌ Π΄Π°Π½Π½ΡΠΌ ΡΡΠ΅ΡΡΠΈΡ
Π»ΠΈΡ ΠΈ ΠΊΠΎΠΌΠΏΠ°Π½ΠΈΠΉ. ΠΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ Π²Π·ΡΡΠ° Π»ΠΈΠ±ΠΎ ΠΈΠ· ΠΎΡΠΊΡΡΡΡΡ
ΠΈΡΡΠΎΡΠ½ΠΈΠΊΠΎΠ², Π»ΠΈΠ±ΠΎ Π±ΡΠ»Π° ΠΏΡΠ΅Π΄ΠΎΡΡΠ°Π²Π»Π΅Π½Π° Π°Π²ΡΠΎΡΡ Π°Π½ΠΎΠ½ΠΈΠΌΠ½ΡΠΌΠΈ Π΄ΠΎΠ±ΡΠΎΠΆΠ΅Π»Π°ΡΠ΅Π»ΡΠΌΠΈ.
Case ib. "Radario"
Nyob rau yav tsaus ntuj ntawm 06.05.2019/XNUMX/XNUMX peb qhov system , yog tus tswv los ntawm qhov kev pab cuam muag daim pib hluav taws xob Radario.
Raws li cov kev lig kev cai uas twb tau tsim tu siab lawm, tus neeg rau zaub mov muaj cov ncauj lus kom ntxaws ntawm cov kev pabcuam cov ntaub ntawv, los ntawm qhov uas nws tuaj yeem tau txais cov ntaub ntawv tus kheej, tus neeg siv nkag thiab tus password, nrog rau daim pib hluav taws xob lawv tus kheej rau ntau yam xwm txheej thoob plaws hauv lub tebchaws.
Tag nrho cov ntaub ntawv ntim tau tshaj 1 TB.
Raws li Shodan tshawb fawb cav, lub server tau tshaj tawm rau pej xeem txij li lub Peb Hlis 11.03.2019, 06.05.2019. Kuv ceeb toom rau cov neeg ua haujlwm Radario thaum 22/50/07.05.2019 ntawm 09:30 (MSK) thiab ntawm XNUMX/XNUMX/XNUMX thaum txog XNUMX:XNUMX tus neeg rau zaub mov tsis muaj.
Cov cav muaj ib qho kev tso cai thoob ntiaj teb (ib leeg) token, muab kev nkag mus rau txhua daim pib yuav khoom ntawm kev sib txuas tshwj xeeb, xws li:
http://radario.ru/internal/tickets/XXXXXXXX/print?access_token=******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTk
http://radario.ru/internal/orders/YYYYYYY/print?access_token=******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTkQhov teeb meem kuj tseem yog tias suav rau daim pib, kev siv tus lej txuas ntxiv ntawm kev txiav txim tau siv thiab sau cov lej yooj yim ntawm daim pib (XXXXXXXXXXXXX) los yog order (YYYYYYYYY), nws tuaj yeem tau txais tag nrho daim pib los ntawm qhov system.
Txhawm rau txheeb xyuas qhov tseeb ntawm cov ntaub ntawv, Kuv txawm ua siab ncaj yuav kuv tus kheej daim pib pheej yig tshaj:
thiab tom qab ntawd pom nws ntawm cov neeg rau zaub mov pej xeem hauv IS cov cav:
http://radario.ru/internal/tickets/11819272/print?access_token==******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTkCais, kuv xav hais ntxiv tias daim pib muaj ob qho tib si rau cov xwm txheej uas twb muaj lawm thiab rau cov uas tseem tab tom npaj. Ntawd yog, tus neeg muaj peev xwm tawm tsam tuaj yeem siv lwm tus daim pib nkag mus rau qhov kev tshwm sim tau npaj tseg.
Qhov nruab nrab, txhua qhov Elasticsearch index uas muaj cov cav rau ib hnub tshwj xeeb (pib txij 24.01.2019/07.05.2019/25 txog 35/XNUMX/XNUMX) muaj XNUMX txog XNUMX txhiab daim pib.
Ntxiv rau daim pib lawv tus kheej, qhov Performance index muaj tus ID nkag mus (email chaw nyob) thiab cov ntawv lo lus zais rau kev nkag mus rau tus kheej tus account ntawm Radario cov koom tes uas muag daim pib rau lawv cov xwm txheej los ntawm qhov kev pabcuam no:
Content: "ReturnUrl=&UserEmail=***@yandex.ru&UserPassword=***"Nyob rau hauv tag nrho, ntau tshaj 500 tus ID nkag mus / lo lus zais khub tau kuaj pom. Daim pib muag cov txheeb cais pom nyob rau hauv cov neeg koom tes tus kheej tus account:
Kuj tseem muaj nyob rau pej xeem yog cov npe, xov tooj thiab email chaw nyob ntawm cov neeg yuav khoom uas txiav txim siab xa rov qab daim pib yuav khoom yav dhau los:
"Content": "{"name":"***","surname":"*** ","middleName":"ΠΠ²Π³Π΅Π½ΡΠ΅Π²Π½Π° ","passportType":1,"passportNumber":"","passportIssueDate":"11-11-2011 11:11:11","passportIssuedBy":"","email":"***@mail.ru","phone":"+799*******","ticketNumbers":["****24848","****948732"],"refundReason":4,"comment":""}"Hauv ib hnub uas raug xaiv, ntau tshaj 500 cov ntaub ntawv no tau pom.
Kuv tau txais cov lus teb rau kev ceeb toom los ntawm tus thawj coj ntawm Radario:
Kuv yog tus thawj coj ntawm Radario thiab xav ua tsaug rau koj los txheeb xyuas qhov teeb meem. Raws li koj paub, peb tau kaw kev nkag mus rau elastic thiab tab tom daws qhov teeb meem ntawm kev rov muab daim pib rau cov neeg siv khoom.
Ib me ntsis tom qab lub tuam txhab tau tshaj tawm hais tias:
Ib qho yooj yim tau pom nyob rau hauv Radario hluav taws xob muag daim pib thiab kho tam sim ntawd, uas tuaj yeem ua rau cov ntaub ntawv xa tawm los ntawm cov neeg siv khoom, lub tuam txhab tus thawj coj lag luam, Kirill Malyshev, hais rau Moscow City News Agency.
"Peb tau pom qhov tsis txaus ntseeg hauv kev ua haujlwm ntawm lub cev cuam tshuam nrog kev hloov kho tsis tu ncua, uas tau kho tam sim tom qab tshawb pom. Raws li qhov tshwm sim ntawm qhov tsis zoo, nyob rau hauv qee qhov xwm txheej, kev ua tsis zoo ntawm cov neeg sab nrauv tuaj yeem ua rau cov ntaub ntawv xau, tab sis tsis muaj qhov xwm txheej raug kaw. Tam sim no, txhua qhov kev ua txhaum tau raug tshem tawm, "K. Malyshev hais.
Ib tus neeg sawv cev ntawm lub tuam txhab tau hais tias nws tau txiav txim siab rov muab tag nrho daim pib muag thaum lub sij hawm daws qhov teeb meem kom tshem tawm tag nrho cov muaj peev xwm ntawm kev dag ntxias cov neeg siv khoom.
Ob peb hnub tom qab, kuv tau tshuaj xyuas qhov muaj cov ntaub ntawv siv cov xaim txuas - nkag mus rau daim pib "pom" tau them tiag tiag. Hauv kuv lub tswv yim, qhov no yog qhov muaj peev xwm, kev tshaj lij los daws qhov teeb meem ntawm cov ntaub ntawv xau.
Case ob. "Fly.ru"
Thaum sawv ntxov 15.05.2019/XNUMX/XNUMX DeviceLock Data Breach Intelligence tau txheeb xyuas cov pej xeem Elasticsearch server nrog cov cav ntawm ib qho IS.
Tom qab ntawd nws tau tsim tias cov neeg rau zaub mov tau koom nrog kev xaiv ncig saib "Sletat.ru".
Los ntawm index cbto__0 Nws muaj peev xwm tau txais ntau txhiab (11,7 txhiab suav nrog cov duplicates) ntawm email chaw nyob, nrog rau qee cov ntaub ntawv them nqi (cov nqi ncig xyuas) thiab cov ntaub ntawv ncig xyuas (thaum twg, qhov twg, daim pib dav hlau cov ntsiab lus ntawm txhua tus cov neeg taug kev suav nrog kev ncig xyuas, thiab lwm yam) nyob rau hauv tus nqi ntawm 1,8 txhiab cov ntaub ntawv:
"full_message": "ΠΠΎΠ»ΡΡΠ΅Π½ Π·Π°ΠΏΡΠΎΡ Π·Π° ΡΠΎΠ·Π΄Π°Π½ΠΈΠ΅ ΠΏΠ»Π°ΡΠ΅ΠΆΠ½ΠΎΠ³ΠΎ ΡΡΠ΅Π΄ΡΡΠ²Π°: {"SuccessReturnUrl":"https://sletat.ru/tour/7-1939548394-65996246/buy/?ClaimId=b5e3bf98-2855-400d-a93a-17c54a970155","ErrorReturnUrl":"https://sletat.ru/","PaymentAgentId":15,"DocumentNumber":96629429,"DocumentDisplayNumber":"4451-17993","Amount":36307.0,"PaymentToolType":3,"ExpiryDateUtc":"2020-04-03T00:33:55.217358+03:00","LifecycleType":2,"CustomerEmail":"[email protected]","Description":"","SettingsId":"8759d0dd-da54-45dd-9661-4e852b0a1d89","AdditionalInfo":"{"TourOfficeAdditionalInfo":{"IsAdditionalPayment":false},"BarrelAdditionalInfo":{"Tickets":[{"Passenger":{"FIO":"XXX VIKTORIIA"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX ANDREI"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX Andrei"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false}],"Segments":[{"Flight":"5659","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"LED","DepartureAirport":"LED","DepartureAirportIataCode":"LED","DepartureDate":"2019-04-11T02:45:00","DepartureTime":null,"ArrivalCity":"SHJ","ArrivalAirport":"SHJ","ArrivalAirportIataCode":"SHJ","ArrivalDate":"2019-04-11T09:40:00","ArrivalTime":null,"FareCode":null},{"Flight":"5660","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"SHJ","DepartureAirport":"SHJ","DepartureAirportIataCode":"SHJ","DepartureDate":"2019-04-14T10:45:00","DepartureTime":null,"ArrivalCity":"LED","ArrivalAirport":"LED","ArrivalAirportIataCode":"LED","ArrivalDate":"2019-04-14T15:50:00","ArrivalTime":null,"FareCode":null}]},"Tickets":[{"Passenger":{"FIO":"XXX VIKTORIIA"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX ANDREI"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX Andrei"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false}],"Segments":[{"Flight":"5659","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"LED","DepartureAirport":"LED","DepartureAirportIataCode":"LED","DepartureDate":"2019-04-11T02:45:00","DepartureTime":null,"ArrivalCity":"SHJ","ArrivalAirport":"SHJ","ArrivalAirportIataCode":"SHJ","ArrivalDate":"2019-04-11T09:40:00","ArrivalTime":null,"FareCode":null},{"Flight":"5660","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"SHJ","DepartureAirport":"SHJ","DepartureAirportIataCode":"SHJ","DepartureDate":"2019-04-14T10:45:00","DepartureTime":null,"ArrivalCity":"LED","ArrivalAirport":"LED","ArrivalAirportIataCode":"LED","ArrivalDate":"2019-04-14T15:50:00","ArrivalTime":null,"FareCode":null}]}","FinancialSystemId":9,"Key":"18fe21d1-8c9c-43f3-b11d-6bf884ba6ee0"}"Los ntawm txoj kev, cov kev sib txuas mus rau kev them nyiaj tours yog ua haujlwm heev:
Hauv indexes nrog lub npe greylog_ Nyob rau hauv cov ntawv ntshiab yog tus ID nkag mus thiab lo lus zais ntawm cov koom haum mus ncig ua si txuas nrog Sletat.ru system thiab muag ncig xyuas rau lawv cov neeg siv khoom:
"full_message": "Tours by request 155213901 added to local cache with key 'user_cache_155213901' at 5/6/2019 4:49:07 PM, rows found 0, sortedPriceLength 215. QueryString: countryId=90&cityFromId=1265&s_nightsMin=6&s_nightsMax=14&stars=403%2c404&minHotelRating=1¤cyAlias=RUB&pageSize=300&pageNumber=1&s_showcase=true&includeOilTaxesAndVisa=0&login=zakaz%40XXX.ru&password=XXX, Referer: , UserAgent: , IP: 94.154.XX.XX."Raws li kuv qhov kev kwv yees, ntau pua tus ID nkag mus / lo lus zais tau tshwm sim.
Los ntawm lub koom haum ncig tebchaws tus kheej tus account ntawm lub portal tus neeg sawv cev.sletat.ru Nws tuaj yeem tau txais cov ntaub ntawv tus neeg siv khoom, suav nrog tus lej hla tebchaws, daim ntawv hla tebchaws thoob ntiaj teb, hnub yug, npe puv, xov tooj thiab email chaw nyob.
Kuv tau ceeb toom rau Sletat.ru qhov kev pabcuam ntawm 15.05.2019/10/46 ntawm 16:00 (MSK) thiab ob peb teev tom qab (txog XNUMX:XNUMX) nws ploj ntawm lawv qhov kev nkag mus dawb. Tom qab ntawd, hauv kev teb rau kev tshaj tawm hauv Kommersant, kev pabcuam kev tswj hwm tau hais lus txawv txawv heev los ntawm kev tshaj tawm:
Tus thawj coj ntawm lub tuam txhab, Andrei Vershinin, tau piav qhia tias Sletat.ru muab ntau tus neeg koom tes ncig xyuas cov neeg ua haujlwm nrog kev nkag mus rau keeb kwm ntawm cov lus nug hauv lub tshuab tshawb nrhiav. Thiab nws xav tias DeviceLock tau txais nws: "Txawm li cas los xij, cov ntaub ntawv teev tseg tsis muaj cov ntaub ntawv hla tebchaws cov neeg ncig tebchaws, chaw nkag mus ncig thiab passwords, cov ntaub ntawv them nyiaj, thiab lwm yam." Andrei Vershinin tau sau tseg tias Sletat.ru tseem tsis tau txais ib qho pov thawj ntawm qhov kev iab liam loj no. βTam sim no peb tab tom sim hu rau DeviceLock. Peb ntseeg tias qhov no yog kev txiav txim. Qee tus neeg tsis nyiam peb txoj kev loj hlob sai, "nws hais ntxiv. "
Raws li tau pom saum toj no, kev nkag mus, passwords, thiab cov ntaub ntawv hla tebchaws ntawm cov neeg ncig tebchaws tau nyob hauv pej xeem lub sijhawm ntev heev (tsawg kawg txij li Lub Peb Hlis 29.03.2019, XNUMX, thaum lub tuam txhab server tau sau thawj zaug hauv pej xeem sau los ntawm Shodan tshawb fawb cav). Tau kawg, tsis muaj leej twg tiv tauj peb. Kuv vam tias tsawg kawg lawv tau ceeb toom rau cov koom haum ncig tebchaws txog qhov xau thiab yuam kom lawv hloov lawv tus password.
Xov xwm hais txog cov ntaub ntawv xau thiab cov neeg sab hauv tuaj yeem nrhiav pom ntawm kuv tus Telegram channel "".
Tau qhov twg los: www.hab.com