Zombie tej yaam num - xau cov ntaub ntawv siv txawm tias tom qab lawv tuag

Kuv tab tom tham txog tus kheej cov ntaub ntawv xau dua, tab sis lub sijhawm no kuv yuav qhia koj me ntsis txog kev ua neej tom qab ntawm IT project siv tus piv txwv ntawm ob qhov kev tshawb pom tsis ntev los no.

Thaum lub sijhawm tshawb xyuas kev ruaj ntseg database, nws feem ntau tshwm sim uas koj pom cov servers (yuav nrhiav databases li cas, Kuv tau sau rau hauv blog) uas yog cov haujlwm uas tau ntev (lossis tsis ntev dhau los) tawm ntawm peb lub ntiaj teb. Xws li tej yaam num txawm tseem xyaum ua neej (ua hauj lwm), zoo li zombies (sau cov ntaub ntawv tus kheej ntawm cov neeg siv tom qab lawv tuag).

Дисклеймер: вся информация ниже публикуется исключительно в образовательных целях. Автор не получал доступа к персональным данным третьих лиц и компаний. Информация взята либо из открытых источников, либо была предоставлена автору анонимными доброжелателями.

Cia peb pib nrog qhov project nrog lub npe nrov "Putin's Team" (putinteam.ru).

Ib tus neeg rau zaub mov nrog qhib MongoDB tau tshawb pom thaum 19.04.2019/XNUMX/XNUMX.

Raws li koj tuaj yeem pom, ransomware yog thawj zaug mus txog lub hauv paus no:

Cov ntaub ntawv tsis muaj cov ntaub ntawv tseem ceeb ntawm tus kheej, tab sis muaj email chaw nyob (tsawg dua 1000), thawj lub npe / lub xeem npe, hashed passwords, GPS kev tswj hwm (pom meej thaum sau npe los ntawm smartphones), lub nroog nyob thiab cov duab ntawm cov neeg siv ntawm qhov chaw uas tau tsim. lawv tus kheej account rau nws.

{ 
    "_id" : ObjectId("5c99c5d08000ec500c21d7e1"), 
    "role" : "USER", 
    "avatar" : "https://fs.putinteam.ru/******sLnzZokZK75V45-1553581654386.jpeg", 
    "firstName" : "Вадим", 
    "lastName" : "", 
    "city" : "Санкт-Петербург", 
    "about" : "", 
    "mapMessage" : "", 
    "isMapMessageVerify" : "0", 
    "pushIds" : [

    ], 
    "username" : "5c99c5d08000ec500c21d7e1", 
    "__v" : NumberInt(0), 
    "coordinates" : {
        "lng" : 30.315868, 
        "lat" : 59.939095
    }
}

{ 
    "_id" : ObjectId("5cb64b361f82ec4fdc7b7e9f"), 
    "type" : "BASE", 
    "email" : "***@yandex.ru", 
    "password" : "c62e11464d1f5fbd54485f120ef1bd2206c2e426", 
    "user" : ObjectId("5cb64b361f82ec4fdc7b7e9e"), 
    "__v" : NumberInt(0)
}

Ntau heev khib nyiab cov ntaub ntawv thiab cov ntaub ntawv khoob. Piv txwv li, tsab ntawv xov xwm sau npe code tsis kuaj xyuas tias email chaw nyob nkag, yog li tsis yog qhov chaw nyob, koj tuaj yeem sau txhua yam koj xav tau.

Kev txiav txim los ntawm kev cai lij choj ntawm lub vev xaib, qhov project tau tso tseg hauv 2018. Txhua qhov kev sim hu rau cov neeg sawv cev ua haujlwm tau ua tsis tiav. Txawm li cas los xij, tsis tshua muaj kev sau npe ntawm lub xaib - muaj kev coj ua ntawm lub neej.

Qhov thib ob txoj haujlwm zombie hauv kuv qhov kev tshuaj ntsuam hnub no yog Latvian startup "Roamer" (roamerapp.com/ru).

Thaum Lub Plaub Hlis 21.04.2019, XNUMX, qhib MongoDB database ntawm daim ntawv thov mobile "Roamer" tau tshawb pom ntawm lub server hauv lub teb chaws Yelemees.

Cov ntaub ntawv, 207 MB loj, tau tshaj tawm rau pej xeem txij li lub Kaum Ib Hlis 24.11.2018, XNUMX (raws li Shodan)!

Los ntawm tag nrho cov cim sab nraud (tsis ua haujlwm kev txhawb nqa email chaw nyob, qhov txuas txuas mus rau Google Play khw, kev cai lij choj ntawm lub vev xaib los ntawm 2016, thiab lwm yam) daim ntawv thov raug tso tseg rau lub sijhawm ntev.

Nyob rau tib lub sijhawm, yuav luag txhua qhov kev tshaj xov xwm thematic tau sau txog qhov kev pib no:

• VC: "Latvian startup Roamer yog tus tua neeg tua neeg»
• lub zos: "Roamer: Ib daim ntawv thov uas txo tus nqi hu los ntawm txawv teb chaws»
• lifehacker: "Yuav txo cov nqi sib txuas lus li cas thaum roaming 10 zaug: Roamer»

Tus "killer" zoo li tau tua nws tus kheej, tab sis txawm tias thaum tuag nws tseem nthuav tawm cov ntaub ntawv tus kheej ntawm nws cov neeg siv ...

Kev txiav txim los ntawm kev txheeb xyuas cov ntaub ntawv hauv cov ntaub ntawv, ntau tus neeg siv txuas ntxiv siv daim ntawv thov mobile no. Hauv ob peb teev ntawm kev soj ntsuam, 94 qhov kev nkag tshiab tau tshwm sim. Thiab rau lub sijhawm txij Lub Peb Hlis 27.03.2019, 10.04.2019 txog Lub Plaub Hlis 66, XNUMX, XNUMX tus neeg siv tshiab tau sau npe hauv daim ntawv thov.

Cov ntaub ntawv (ntau tshaj 100 txhiab cov ntaub ntawv) ntawm daim ntawv thov nrog cov ntaub ntawv xws li:

• tus neeg siv xov tooj
• nkag mus tokens hu rau keeb kwm (muaj nyob ntawm cov kev sib txuas xws li: api3.roamerapp.com/call/history/1553XXXXXX)
• hu rau keeb kwm (ntaus, hu xovtooj, hu xovtooj, hu xovtooj, sijhawm, sijhawm hu)
• tus neeg siv lub xov tooj ntawm tes
• Tus neeg siv IP chaw nyob
• tus neeg siv lub xov tooj qauv thiab mobile OS version ntawm nws (piv txwv li, iPhone 7 12.1.4)
• tus neeg siv email chaw nyob
• tus neeg siv nyiaj tshuav nyiaj li cas thiab nyiaj
• neeg siv lub teb chaws
• qhov chaw tam sim no (lub teb chaws) ntawm tus neeg siv
• promo codes
• thiab ntau ntxiv.

{ 
    "_id" : ObjectId("5c9a49b2a1f7da01398b4569"), 
    "url" : "api3.roamerapp.com/call/history/*******5049", 
    "ip" : "67.80.1.6", 
    "method" : NumberLong(1), 
    "response" : {
        "calls" : [
            {
                "start_time" : NumberLong(1553615276), 
                "number" : "7495*******", 
                "accepted" : false, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(0), 
                "cost" : 0.0, 
                "call_id" : NumberLong(18869601)
            }, 
            {
                "start_time" : NumberLong(1553615172), 
                "number" : "7499*******", 
                "accepted" : true, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(63), 
                "cost" : 0.03, 
                "call_id" : NumberLong(18869600)
            }, 
            {
                "start_time" : NumberLong(1553615050), 
                "number" : "7985*******", 
                "accepted" : false, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(0), 
                "cost" : 0.0, 
                "call_id" : NumberLong(18869599)
            }
        ]
    }, 
    "response_code" : NumberLong(200), 
    "post" : [

    ], 
    "headers" : {
        "Host" : "api3.roamerapp.com", 
        "X-App-Id" : "a9ee0beb8a2f6e6ef3ab77501e54fb7e", 
        "Accept" : "application/json", 
        "X-Sim-Operator" : "311480", 
        "X-Wsse" : "UsernameToken Username="/******S19a2RzV9cqY7b/RXPA=", PasswordDigest="******NTA4MDhkYzQ5YTVlZWI5NWJkODc5NjQyMzU2MjRjZmIzOWNjYzY3MzViMTY1ODY4NDBjMWRkYjdiZTQxOGI4ZDcwNWJmOThlMTA1N2ExZjI=", Nonce="******c1MzE1NTM2MTUyODIuNDk2NDEz", Created="Tue, 26 Mar 2019 15:48:01 GMT"", 
        "Accept-Encoding" : "gzip, deflate", 
        "Accept-Language" : "en-us", 
        "Content-Type" : "application/json", 
        "X-Request-Id" : "FB103646-1B56-4030-BF3A-82A40E0828CC", 
        "User-Agent" : "Roamer;iOS;511;en;iPhone 7;12.1.4", 
        "Connection" : "keep-alive", 
        "X-App-Build" : "511", 
        "X-Lang" : "EN", 
        "X-Connection" : "WiFi"
    }, 
    "created_at" : ISODate("2019-03-26T15:48:02.583+0000"), 
    "user_id" : "888689"
}

Tau kawg, nws tsis tuaj yeem tiv tauj cov tswv ntawm lub hauv paus. Kev sib cuag ntawm lub xaib tsis ua haujlwm, cov lus hauv social media. tsis muaj leej twg hnov ​​​​txog hauv network.

Lub app tseem muaj nyob hauv Apple App Store (itunes.apple.com/app/roamer-roaming-killer/id646368973).

Xov xwm hais txog cov ntaub ntawv xau thiab cov neeg sab hauv tuaj yeem nrhiav pom ntawm kuv tus Telegram channel "Cov ntaub ntawv xau»: https://t.me/dataleak.

Tau qhov twg los: www.hab.com