Lero tiwona milandu iwiri nthawi imodzi - zambiri zamakasitomala ndi mabwenzi amakampani awiri osiyana kwambiri zidapezeka mwaulele "zikomo" kutsegula ma seva a Elasticsearch okhala ndi zipika zamakina azidziwitso (IS) amakampaniwa.
Pachiyambi choyamba, awa ndi zikwi makumi (ndipo mwina mazana zikwi) a matikiti a zochitika zosiyanasiyana za chikhalidwe (mabwalo, zibonga, maulendo a mitsinje, ndi zina zotero) zogulitsidwa kudzera mu dongosolo la Radario (www.radario.ru).
Munkhani yachiwiri, iyi ndi data paulendo wapaulendo wa masauzande (mwina makumi angapo masauzande) apaulendo omwe adagula maulendo kudzera m'mabungwe oyendera olumikizidwa ndi dongosolo la Sletat.ru (www.sletat.ru).
Ndikufuna kuzindikira nthawi yomweyo kuti osati mayina amakampani omwe adalola kuti deta ipezeke poyera amasiyana, komanso njira yamakampani awa kuzindikira zomwe zidachitika komanso zomwe zidachitikapo. Koma zinthu zoyambaβ¦
ΠΠΈΡΠΊΠ»Π΅ΠΉΠΌΠ΅Ρ: Π²ΡΡ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ Π½ΠΈΠΆΠ΅ ΠΏΡΠ±Π»ΠΈΠΊΡΠ΅ΡΡΡ ΠΈΡΠΊΠ»ΡΡΠΈΡΠ΅Π»ΡΠ½ΠΎ Π² ΠΎΠ±ΡΠ°Π·ΠΎΠ²Π°ΡΠ΅Π»ΡΠ½ΡΡ
ΡΠ΅Π»ΡΡ
. ΠΠ²ΡΠΎΡ Π½Π΅ ΠΏΠΎΠ»ΡΡΠ°Π» Π΄ΠΎΡΡΡΠΏΠ° ΠΊ ΠΏΠ΅ΡΡΠΎΠ½Π°Π»ΡΠ½ΡΠΌ Π΄Π°Π½Π½ΡΠΌ ΡΡΠ΅ΡΡΠΈΡ
Π»ΠΈΡ ΠΈ ΠΊΠΎΠΌΠΏΠ°Π½ΠΈΠΉ. ΠΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ Π²Π·ΡΡΠ° Π»ΠΈΠ±ΠΎ ΠΈΠ· ΠΎΡΠΊΡΡΡΡΡ
ΠΈΡΡΠΎΡΠ½ΠΈΠΊΠΎΠ², Π»ΠΈΠ±ΠΎ Π±ΡΠ»Π° ΠΏΡΠ΅Π΄ΠΎΡΡΠ°Π²Π»Π΅Π½Π° Π°Π²ΡΠΎΡΡ Π°Π½ΠΎΠ½ΠΈΠΌΠ½ΡΠΌΠΈ Π΄ΠΎΠ±ΡΠΎΠΆΠ΅Π»Π°ΡΠ΅Π»ΡΠΌΠΈ.
Mlandu woyamba. "Radario"
Madzulo a 06.05.2019/XNUMX/XNUMX dongosolo lathu , yomwe ili ndi ntchito yogulitsa tikiti yamagetsi ya Radario.
Malinga ndi mwambo wachisoni womwe wakhazikitsidwa kale, sevayo ili ndi zipika zatsatanetsatane zautumiki wautumiki, komwe kunali kotheka kupeza zidziwitso zaumwini, zolemba za ogwiritsa ntchito ndi mapasiwedi, komanso matikiti amagetsi pazochitika zosiyanasiyana m'dziko lonselo.
Chiwerengero chonse cha zipika chinaposa 1 TB.
Malinga ndi injini yosakira ya Shodan, seva yakhala ikupezeka pagulu kuyambira pa Marichi 11.03.2019, 06.05.2019. Ndinadziwitsa antchito a Radario pa 22/50/07.05.2019 nthawi ya 09:30 (MSK) ndipo pa XNUMX/XNUMX/XNUMX pafupifupi XNUMX:XNUMX seva sinapezeke.
Zolembazo zinali ndi chizindikiro chapadziko lonse lapansi (chimodzi), chopereka mwayi wopeza matikiti onse ogulidwa kudzera pamaulalo apadera, monga:
http://radario.ru/internal/tickets/XXXXXXXX/print?access_token=******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTk
http://radario.ru/internal/orders/YYYYYYY/print?access_token=******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTkVuto linalinso loti kuwerengera matikiti, kuwerengera kosalekeza kwa maoda kunagwiritsidwa ntchito komanso kuwerengera kosavuta kwa nambala ya tikiti (Kutali) kapena kuyitanitsa (YYYYYYY), zinali zotheka kupeza matikiti onse ku dongosolo.
Kuti muwone kufunikira kwa nkhokwe, ngakhale moona mtima ndidagula tikiti yotsika mtengo kwambiri:
ndipo pambuyo pake adazipeza pa seva yapagulu muzolemba za IS:
http://radario.ru/internal/tickets/11819272/print?access_token==******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTkPayokha, ndikufuna kutsindika kuti matikiti analipo pazochitika zomwe zachitika kale komanso zomwe zikukonzedwabe. Ndiko kuti, woukira akhoza kugwiritsa ntchito tikiti ya munthu wina kuti alowe zomwe zakonzedwa.
Pafupifupi, index iliyonse ya Elasticsearch yokhala ndi zipika za tsiku limodzi (kuyambira pa 24.01.2019/07.05.2019/25 mpaka 35/XNUMX/XNUMX) imakhala ndi matikiti XNUMX mpaka XNUMX.
Kuphatikiza pa matikiti omwewo, mndandandawo uli ndi ma login (maadiresi a imelo) ndi mawu achinsinsi kuti athe kupeza maakaunti awo a Radario omwe amagulitsa matikiti kuzochitika zawo kudzera muutumikiwu:
Content: "ReturnUrl=&UserEmail=***@yandex.ru&UserPassword=***"Pazonse, zopitilira 500 zolowera / mawu achinsinsi zidapezeka. Ziwerengero zogulitsa matikiti zimawonekera mumaakaunti amunthu omwe ali nawo:
Zinanso zopezeka poyera zinali mayina, manambala a foni ndi ma adilesi a imelo a ogula omwe adaganiza zobweza matikiti omwe adagulidwa kale:
"Content": "{"name":"***","surname":"*** ","middleName":"ΠΠ²Π³Π΅Π½ΡΠ΅Π²Π½Π° ","passportType":1,"passportNumber":"","passportIssueDate":"11-11-2011 11:11:11","passportIssuedBy":"","email":"***@mail.ru","phone":"+799*******","ticketNumbers":["****24848","****948732"],"refundReason":4,"comment":""}"Mβtsiku limodzi losankhidwa mwachisawawa, zolembedwa zoterozo zoposa 500 zinapezedwa.
Ndinalandira yankho ku chenjezo kuchokera kwa mkulu waukadaulo wa Radario:
Ndine wamkulu waukadaulo wa Radario ndipo ndikufuna kukuthokozani chifukwa chozindikira vuto. Monga mukudziwa, tatseka mwayi wopeza zotanuka ndipo tikuthetsa nkhani yoperekanso matikiti kwa makasitomala.
Patapita nthawi, kampaniyo inanena kuti:
Chiwopsezo chinapezeka mu njira yogulitsa tikiti yamagetsi ya Radario ndikuwongolera mwachangu, zomwe zingayambitse kutulutsa kwa data kuchokera kwa makasitomala autumiki, mkulu wa zamalonda wa kampaniyo, Kirill Malyshev, adauza Moscow City News Agency.
"Tidazindikira kuti pali chiwopsezo pamakina ogwiritsiridwa ntchito ndi zosintha zanthawi zonse, zomwe zidakhazikika zitadziwika. Chifukwa cha chiwopsezo, pansi pazifukwa zina, zochita zosasangalatsa za anthu ena zingayambitse kutayika kwa deta, koma palibe zochitika zomwe zinalembedwa. Pakali pano, zolakwa zonse zathetsedwa,β anatero K. Malyshev.
Woimira kampaniyo adatsindika kuti adaganiza zoperekanso matikiti onse omwe adagulitsidwa panthawi yothetsera vutoli kuti athetseretu kuthekera kwa chinyengo chilichonse kwa makasitomala.
Patatha masiku angapo, ndidayang'ana kupezeka kwa data pogwiritsa ntchito maulalo otayikira - mwayi wopeza matikiti "owonekera" adaphimbidwa. M'malingaliro anga, iyi ndi njira yoyenerera, yaukadaulo yothetsera vuto la kutayikira kwa data.
Mlandu wachiwiri. "Fly.ru"
M'mawa kwambiri pa 15.05.2019/XNUMX/XNUMX DeviceLock Data Breach Intelligence adazindikira seva yapagulu ya Elasticsearch yokhala ndi zipika za IS.
Pambuyo pake zidadziwika kuti seva ndi ya ntchito yosankha alendo "Sletat.ru".
Kuchokera ku index cbto__0 zinali zotheka kupeza masauzande (11,7 zikwi kuphatikiza zobwereza) za ma adilesi a imelo, komanso zambiri zolipirira (ndalama zoyendera) ndi zowonera (nthawi, komwe, zambiri za tikiti ya ndege) Π²ΡΠ΅Ρ apaulendo ophatikizidwa paulendowu, ndi zina zambiri) mu kuchuluka kwa zolemba pafupifupi 1,8:
"full_message": "ΠΠΎΠ»ΡΡΠ΅Π½ Π·Π°ΠΏΡΠΎΡ Π·Π° ΡΠΎΠ·Π΄Π°Π½ΠΈΠ΅ ΠΏΠ»Π°ΡΠ΅ΠΆΠ½ΠΎΠ³ΠΎ ΡΡΠ΅Π΄ΡΡΠ²Π°: {"SuccessReturnUrl":"https://sletat.ru/tour/7-1939548394-65996246/buy/?ClaimId=b5e3bf98-2855-400d-a93a-17c54a970155","ErrorReturnUrl":"https://sletat.ru/","PaymentAgentId":15,"DocumentNumber":96629429,"DocumentDisplayNumber":"4451-17993","Amount":36307.0,"PaymentToolType":3,"ExpiryDateUtc":"2020-04-03T00:33:55.217358+03:00","LifecycleType":2,"CustomerEmail":"[email protected]","Description":"","SettingsId":"8759d0dd-da54-45dd-9661-4e852b0a1d89","AdditionalInfo":"{"TourOfficeAdditionalInfo":{"IsAdditionalPayment":false},"BarrelAdditionalInfo":{"Tickets":[{"Passenger":{"FIO":"XXX VIKTORIIA"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX ANDREI"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX Andrei"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false}],"Segments":[{"Flight":"5659","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"LED","DepartureAirport":"LED","DepartureAirportIataCode":"LED","DepartureDate":"2019-04-11T02:45:00","DepartureTime":null,"ArrivalCity":"SHJ","ArrivalAirport":"SHJ","ArrivalAirportIataCode":"SHJ","ArrivalDate":"2019-04-11T09:40:00","ArrivalTime":null,"FareCode":null},{"Flight":"5660","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"SHJ","DepartureAirport":"SHJ","DepartureAirportIataCode":"SHJ","DepartureDate":"2019-04-14T10:45:00","DepartureTime":null,"ArrivalCity":"LED","ArrivalAirport":"LED","ArrivalAirportIataCode":"LED","ArrivalDate":"2019-04-14T15:50:00","ArrivalTime":null,"FareCode":null}]},"Tickets":[{"Passenger":{"FIO":"XXX VIKTORIIA"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX ANDREI"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX Andrei"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false}],"Segments":[{"Flight":"5659","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"LED","DepartureAirport":"LED","DepartureAirportIataCode":"LED","DepartureDate":"2019-04-11T02:45:00","DepartureTime":null,"ArrivalCity":"SHJ","ArrivalAirport":"SHJ","ArrivalAirportIataCode":"SHJ","ArrivalDate":"2019-04-11T09:40:00","ArrivalTime":null,"FareCode":null},{"Flight":"5660","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"SHJ","DepartureAirport":"SHJ","DepartureAirportIataCode":"SHJ","DepartureDate":"2019-04-14T10:45:00","DepartureTime":null,"ArrivalCity":"LED","ArrivalAirport":"LED","ArrivalAirportIataCode":"LED","ArrivalDate":"2019-04-14T15:50:00","ArrivalTime":null,"FareCode":null}]}","FinancialSystemId":9,"Key":"18fe21d1-8c9c-43f3-b11d-6bf884ba6ee0"}"Mwa njira, maulalo amaulendo olipidwa akugwira ntchito:
M'ma index okhala ndi dzina graylog_ m'mawu omveka bwino anali ma logins ndi mapasiwedi a mabungwe oyendayenda olumikizidwa ndi Sletat.ru ndi kugulitsa maulendo kwa makasitomala awo:
"full_message": "Tours by request 155213901 added to local cache with key 'user_cache_155213901' at 5/6/2019 4:49:07 PM, rows found 0, sortedPriceLength 215. QueryString: countryId=90&cityFromId=1265&s_nightsMin=6&s_nightsMax=14&stars=403%2c404&minHotelRating=1¤cyAlias=RUB&pageSize=300&pageNumber=1&s_showcase=true&includeOilTaxesAndVisa=0&login=zakaz%40XXX.ru&password=XXX, Referer: , UserAgent: , IP: 94.154.XX.XX."Malinga ndi kuyerekezera kwanga, mazana angapo olowera / achinsinsi awiriawiri adawonetsedwa.
Kuchokera ku akaunti yaumwini ya bungwe loyendera maulendo pa portal agent.sletat.ru zinali zotheka kupeza deta ya makasitomala, kuphatikizapo manambala a pasipoti, mapasipoti apadziko lonse, masiku obadwa, mayina athunthu, manambala a foni ndi ma adilesi a imelo.
Ndinadziwitsa ntchito ya Sletat.ru pa 15.05.2019/10/46 pa 16:00 (MSK) ndipo maola angapo pambuyo pake (mpaka XNUMX:XNUMX) idazimiririka pakupeza kwawo kwaulere. Pambuyo pake, poyankha kufalitsa ku Kommersant, oyang'anira ntchitoyo adanena zachilendo kwambiri kudzera muzofalitsa:
Mtsogoleri wa kampaniyo, Andrei Vershinin, adalongosola kuti Sletat.ru imapereka maulendo angapo akuluakulu oyendayenda omwe ali ndi mwayi wopeza mbiri ya mafunso mu injini yosaka. Ndipo adaganiza kuti DeviceLock idachilandira: "Komabe, nkhokwe yomwe yatchulidwayo ilibe mapasipoti a alendo, malowedwe ndi ma passwords, zidziwitso zolipira, ndi zina zambiri." Andrei Vershinin adanena kuti Sletat.ru sanalandirebe umboni uliwonse wa milandu yotereyi. "Tsopano tikuyesera kulumikizana ndi DeviceLock. Tikukhulupirira kuti ili ndi dongosolo. Anthu ena sakonda kukula kwathu mwachangu, βadawonjezera. "
Monga tawonera pamwambapa, malowedwe, mapasiwedi, ndi zidziwitso za pasipoti za alendo zinali pagulu kwa nthawi yayitali (osachepera pa Marichi 29.03.2019, XNUMX, pomwe seva ya kampaniyo idalembedwa koyamba pagulu ndi injini yosakira ya Shodan). Nβzoona kuti palibe amene analankhula nafe. Ndikukhulupirira kuti adadziwitsa mabungwe oyendayenda za kutayikirako ndikuwakakamiza kusintha mawu achinsinsi.
Nkhani zakutulutsa zambiri komanso zamkati zitha kupezeka panjira yanga ya Telegraph "".
Source: www.habr.com