Taa, anyị ga-eleba anya n'okwu abụọ n'otu oge - data nke ndị ahịa na ndị mmekọ nke ụlọ ọrụ abụọ dị iche iche dị n'efu "n'ihi" imeghe sava Elasticsearch nwere ndekọ nke sistemụ ozi (IS) nke ụlọ ọrụ ndị a.
N'okwu mbụ, ndị a bụ iri puku kwuru iri puku (na ma eleghị anya ọtụtụ narị puku) tiketi maka ihe omume omenala dị iche iche (ihe nkiri, klọb, njem osimiri, wdg) rere site na usoro Radario (www.radario.ru).
N'okwu nke abụọ, nke a bụ data na njem nlegharị anya nke puku kwuru puku (ikekwe ọtụtụ iri puku kwuru iri puku) nke ndị njem zụtara njem nlegharị anya site na ụlọ ọrụ njem jikọtara na usoro Sletat.ru (www.sletat.ru).
Ọ ga-amasị m ịmara ozugbo na ọ bụghị naanị aha ụlọ ọrụ ndị na-ekwe ka data ahụ dị n'ihu ọha dị iche, kamakwa ụzọ ụlọ ọrụ ndị a si aghọta ihe merenụ na mmeghachi omume na-esote ya. Mana ihe mbụ…
Дисклеймер: вся информация ниже публикуется исключительно в образовательных целях. Автор не получал доступа к персональным данным третьих лиц и компаний. Информация взята либо из открытых источников, либо была предоставлена автору анонимными доброжелателями.
Ikpe otu. "Radario"
Na mgbede nke 06.05.2019/XNUMX/XNUMX usoro anyị , nke ụlọ ọrụ ịre ahịa tiketi eletrọnịkị Radario nwe ya.
Dị ka omenala mwute e guzobeworị, ihe nkesa ahụ nwere nkọwa zuru ezu ndekọ nke usoro ozi nke ọrụ, site na nke ọ ga-ekwe omume ịnweta data nkeonwe, logins na okwuntughe, yana tiketi eletrọnịkị n'onwe ha maka ihe omume dị iche iche na mba ahụ.
Ngụkọta mpịakọta ndekọ karịrị 1 TB.
Dabere na igwe nchọta Shodan, a na-enweta sava ahụ n'ihu ọha kemgbe Maachị 11.03.2019, 06.05.2019. Agwara m ndị ọrụ Radario na 22/50/07.05.2019 na 09:30 (MSK) yana na XNUMX/XNUMX/XNUMX n'ihe dị ka elekere XNUMX:XNUMX nke sava adịghị.
Ndekọ ndekọ ahụ nwere akara ikike zuru ụwa ọnụ (otu) na-enye ohere ịnweta tiketi azụtara site na njikọ pụrụ iche, dị ka:
http://radario.ru/internal/tickets/XXXXXXXX/print?access_token=******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTk
http://radario.ru/internal/orders/YYYYYYY/print?access_token=******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTkNsogbu ahụ bụkwa na iji kwụọ ụgwọ maka tiketi, a na-eji ọnụ ọgụgụ na-aga n'ihu na-aga n'ihu na ngụkọ ọnụ ọgụgụ dị mfe nke nọmba tiketi (MMXXXXX) ma ọ bụ ịtụ (YAYYYY), ọ ga-ekwe omume ịnweta tiketi niile na sistemụ.
Iji lelee mkpa nchekwa data ahụ, ọbụnadị m n'eziokwu zụtara onwe m tiketi dị ọnụ ala:
wee hụ ya na sava ọha na ndekọ IS:
http://radario.ru/internal/tickets/11819272/print?access_token==******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTkIche iche, ọ ga-amasị m imesi ike na tiketi dị ma maka ihe omume ndị emelarị yana maka ndị a ka na-eme atụmatụ. Ya bụ, onye nwere ike ịwakpo nwere ike iji tiketi onye ọzọ banye mmemme ahụ akwadoro.
Na nkezi, ndepụta Elasticsearch ọ bụla nwere ndekọ maka otu ụbọchị (malite na 24.01.2019/07.05.2019/25 ruo 35/XNUMX/XNUMX) nwere site na puku tiketi XNUMX ruo XNUMX.
Na mgbakwunye na tiketi n'onwe ha, ndeksi ahụ nwere logins (adreesị email) na okwuntughe ederede maka ịnweta akaụntụ nke ndị mmekọ Radario na-ere tiketi maka mmemme ha site na ọrụ a:
Content: "ReturnUrl=&UserEmail=***@yandex.ru&UserPassword=***"Na mkpokọta, ahụrụ ihe karịrị ụzọ abụọ nbanye/okwu mbanye 500. A na-ahụ ọnụ ọgụgụ ahịa tiketi na akaụntụ nke ndị mmekọ:
Ndị ọzọ dị n'ihu ọha bụ aha, nọmba ekwentị na adreesị ozi-e nke ndị na-azụ ahịa bụ ndị kpebiri ịlaghachi tiketi azụrụ na mbụ:
"Content": "{"name":"***","surname":"*** ","middleName":"Евгеньевна ","passportType":1,"passportNumber":"","passportIssueDate":"11-11-2011 11:11:11","passportIssuedBy":"","email":"***@mail.ru","phone":"+799*******","ticketNumbers":["****24848","****948732"],"refundReason":4,"comment":""}"N'otu ụbọchị a na-ahọrọghị usoro, a chọtara ihe karịrị narị akwụkwọ ndekọ dị otú ahụ.
Enwetara m nzaghachi na njikere site n'aka onye nduzi teknụzụ nke Radario:
Abụ m onye nduzi teknụzụ nke Radario ma ọ ga-amasị m ikele gị maka ịchọpụta nsogbu ahụ. Dị ka ị maara, anyị emechiela ohere na-agbanwe ma na-edozi okwu nke ịnyeghachi tiketi maka ndị ahịa.
Obere oge ka ụlọ ọrụ ahụ kwuru nkwupụta gọọmentị:
Achọpụtara ihe adịghị ike na usoro ịzụ ahịa tiketi eletrọnịkị nke Radario ma mezie ya ozugbo, nke nwere ike iduga mwepu nke data sitere n'aka ndị ahịa nke ọrụ ahụ, onye isi ahịa ụlọ ọrụ ahụ, Kirill Malyshev, gwara ndị Moscow City News Agency.
"Anyị chọpụtara n'ezie adịghị ike na sistemụ arụmọrụ metụtara mmelite oge niile, nke edobere ozugbo achọpụtara ya. N'ihi adịghị ike ahụ, n'okpuru ọnọdụ ụfọdụ, omume enweghị enyi nke ndị ọzọ nwere ike ibute mwepu data, mana ọ nweghị ihe ọ bụla edere. N'oge a, ewepụla mmejọ niile, "K. Malyshev kwuru.
Onye nnọchi anya ụlọ ọrụ kwusiri ike na e kpebiri iweghachi tiketi niile e rere n'oge a na-edozi nsogbu ahụ iji kpochapụ kpamkpam ohere nke aghụghọ ọ bụla megide ndị ahịa ọrụ.
Ụbọchị ole na ole ka nke ahụ gasịrị, enyochara m data dị site na iji njikọ ndị a gbapụrụ agbapụ - ekpuchirila ịnweta tiketi "ekpughere". N'uche nke m, nke a bụ usoro tozuru oke, ọkachamara iji dozie nsogbu nke ntapu data.
Ikpe abụọ. "Fly.ru"
N'isi ụtụtụ 15.05.2019/XNUMX/XNUMX Ọgụgụ isi nke imebi data DeviceLock choputara sava Elasticsearch ọha nwere ndekọ nke otu IS.
Mgbe e mesịrị, e guzobere na ihe nkesa bụ nke ọrụ nhọrọ njegharị "Sletat.ru".
Site na ndeksi cbto__0 ọ ga-ekwe omume ịnweta puku kwuru puku (11,7 puku gụnyere oyiri) nke adreesị ozi-e, yana ụfọdụ ozi ịkwụ ụgwọ (ego nlegharị anya) na data njegharị (mgbe, ebe, nkọwa tiketi ụgbọ elu). всех ndị njem gụnyere na njem, wdg) na ego nke ihe ndekọ 1,8 puku:
"full_message": "Получен запрос за создание платежного средства: {"SuccessReturnUrl":"https://sletat.ru/tour/7-1939548394-65996246/buy/?ClaimId=b5e3bf98-2855-400d-a93a-17c54a970155","ErrorReturnUrl":"https://sletat.ru/","PaymentAgentId":15,"DocumentNumber":96629429,"DocumentDisplayNumber":"4451-17993","Amount":36307.0,"PaymentToolType":3,"ExpiryDateUtc":"2020-04-03T00:33:55.217358+03:00","LifecycleType":2,"CustomerEmail":"[email protected]","Description":"","SettingsId":"8759d0dd-da54-45dd-9661-4e852b0a1d89","AdditionalInfo":"{"TourOfficeAdditionalInfo":{"IsAdditionalPayment":false},"BarrelAdditionalInfo":{"Tickets":[{"Passenger":{"FIO":"XXX VIKTORIIA"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX ANDREI"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX Andrei"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false}],"Segments":[{"Flight":"5659","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"LED","DepartureAirport":"LED","DepartureAirportIataCode":"LED","DepartureDate":"2019-04-11T02:45:00","DepartureTime":null,"ArrivalCity":"SHJ","ArrivalAirport":"SHJ","ArrivalAirportIataCode":"SHJ","ArrivalDate":"2019-04-11T09:40:00","ArrivalTime":null,"FareCode":null},{"Flight":"5660","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"SHJ","DepartureAirport":"SHJ","DepartureAirportIataCode":"SHJ","DepartureDate":"2019-04-14T10:45:00","DepartureTime":null,"ArrivalCity":"LED","ArrivalAirport":"LED","ArrivalAirportIataCode":"LED","ArrivalDate":"2019-04-14T15:50:00","ArrivalTime":null,"FareCode":null}]},"Tickets":[{"Passenger":{"FIO":"XXX VIKTORIIA"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX ANDREI"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX Andrei"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false}],"Segments":[{"Flight":"5659","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"LED","DepartureAirport":"LED","DepartureAirportIataCode":"LED","DepartureDate":"2019-04-11T02:45:00","DepartureTime":null,"ArrivalCity":"SHJ","ArrivalAirport":"SHJ","ArrivalAirportIataCode":"SHJ","ArrivalDate":"2019-04-11T09:40:00","ArrivalTime":null,"FareCode":null},{"Flight":"5660","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"SHJ","DepartureAirport":"SHJ","DepartureAirportIataCode":"SHJ","DepartureDate":"2019-04-14T10:45:00","DepartureTime":null,"ArrivalCity":"LED","ArrivalAirport":"LED","ArrivalAirportIataCode":"LED","ArrivalDate":"2019-04-14T15:50:00","ArrivalTime":null,"FareCode":null}]}","FinancialSystemId":9,"Key":"18fe21d1-8c9c-43f3-b11d-6bf884ba6ee0"}"Site n'ụzọ, njikọ nke njem nlegharị anya akwụ ụgwọ na-arụ ọrụ nke ọma:
Na indexes na aha graylog_ N'edemede doro anya bụ nbanye na okwuntughe nke ụlọ ọrụ njem jikọtara na sistemụ Sletat.ru na ire njegharị ndị ahịa ha:
"full_message": "Tours by request 155213901 added to local cache with key 'user_cache_155213901' at 5/6/2019 4:49:07 PM, rows found 0, sortedPriceLength 215. QueryString: countryId=90&cityFromId=1265&s_nightsMin=6&s_nightsMax=14&stars=403%2c404&minHotelRating=1¤cyAlias=RUB&pageSize=300&pageNumber=1&s_showcase=true&includeOilTaxesAndVisa=0&login=zakaz%40XXX.ru&password=XXX, Referer: , UserAgent: , IP: 94.154.XX.XX."Dịka atụmatụ m siri dị, egosipụtara ọtụtụ narị ụzọ nbanye / okwuntughe.
Site na akaụntụ nke ụlọ ọrụ njem na portal onye ọrụ.sletat.ru ọ ga-ekwe omume ịnweta data ndị ahịa, gụnyere nọmba paspọtụ, paspọtụ mba ụwa, ụbọchị ọmụmụ, aha zuru ezu, nọmba ekwentị na adreesị ozi-e.
Agwara m ọrụ Sletat.ru na 15.05.2019/10/46 na 16:00 (MSK) na awa ole na ole ka e mesịrị (ruo XNUMX:XNUMX) ọ kwụsịrị na ohere ha nwere n'efu. Mgbe e mesịrị, na nzaghachi na mbipụta ahụ na Kommersant, njikwa ọrụ ahụ kwuru okwu dị ịtụnanya site na mgbasa ozi:
Onye isi nke ụlọ ọrụ ahụ, Andrei Vershinin, kọwara na Sletat.ru na-enye ọtụtụ ndị na-eme njem nlegharị anya ndị isi na-enweta akụkọ ihe mere eme nke ajụjụ na search engine. Ma o chere na DeviceLock natara ya: "Agbanyeghị, nchekwa data akọwapụtara enweghị data paspọtụ ndị njem nlegharị anya, nbanye ụlọ ọrụ njem na okwuntughe, ozi ịkwụ ụgwọ, wdg." Andrei Vershinin kwuru na Sletat.ru enwetabeghị ihe akaebe nke ebubo ndị dị otú ahụ siri ike. "Anyị na-agbalị ugbu a ịkpọtụrụ DeviceLock. Anyị kwenyere na nke a bụ iwu. Ụfọdụ ndị mmadụ enweghị mmasị na uto anyị ngwa ngwa, "ọ gbakwụnyere. "
Dị ka egosiri n'elu, nbanye, okwuntughe, na data paspọtụ nke ndị njem nlegharị anya nọ na ngalaba ọha ogologo oge (opekata mpe kemgbe Machị 29.03.2019, XNUMX, mgbe igwe nchọta Shodan dekọbara ihe nkesa ụlọ ọrụ ahụ na ngalaba ọha). N'ezie, ọ dịghị onye kpọtụụrụ anyị. Enwere m olileanya na opekata mpe, ha gwara ndị ụlọ ọrụ njem banyere mmiri ahụ ma manye ha ịgbanwe okwuntughe ha.
Enwere ike ịhụ ozi gbasara ntapu ozi na ndị na-eme ihe na ọwa Telegram m "".
isi: www.habr.com