Kutayikira kwa data yamakasitomala kuchokera ku re: Store, Samsung, Sony Center, Nike, LEGO ndi masitolo a Street Beat

Sabata yatha Kommersant lipoti, kuti "makasitomala a Street Beat ndi Sony Center anali pagulu la anthu," koma zenizeni zonse ndi zoipa kwambiri kuposa zomwe zalembedwa m'nkhaniyi.

Ndachita kale tsatanetsatane waukadaulo wa kutayikiraku. mu njira ya Telegraph, kotero apa tingodutsa mfundo zazikulu zokha.

Дисклеймер: вся информация ниже публикуется исключительно в образовательных целях. Автор не получал доступа к персональным данным третьих лиц и компаний. Информация взята либо из открытых источников, либо была предоставлена автору анонимными доброжелателями.

Seva ina ya Elasticsearch yokhala ndi ma index inalipo mwaulere:

• greylog2_0
• readme
• unauth_text
• http:
• greylog2_1

В greylog2_0 inali ndi zipika kuyambira Novembara 16.11.2018, 2019 mpaka Marichi XNUMX, ndi mu greylog2_1 - zolemba kuyambira Marichi 2019 mpaka 04.06.2019/XNUMX/XNUMX. Mpaka mwayi wa Elasticsearch utatsekedwa, kuchuluka kwa zolembedwa mkati greylog2_1 kukula.

Malinga ndi injini yosakira ya Shodan, Elasticsearch iyi yakhala ikupezeka kwaulere kuyambira Novembara 12.11.2018, 16.11.2018 (monga zalembedwa pamwambapa, zolembera zoyambazo ndi za Novembara XNUMX, XNUMX).

Mu zipika, m'munda gl2_remote_ip Ma adilesi a IP 185.156.178.58 ndi 185.156.178.62 adatchulidwa, okhala ndi mayina a DNS srv2.inventive.ru и srv3.inventive.ru:

Ndinadziwitsa Malingaliro a kampani Inventive Retail Group (www.inventive.ru) za vuto la 04.06.2019/18/25 pa 22:30 (nthawi ya Moscow) ndipo pofika XNUMX:XNUMX seva "cha mwakachetechete" idasowa kuti anthu asapezeke.

Zolemba zomwe zili (deta yonse ndikungoyerekeza, zobwereza sizinachotsedwe pakuwerengera, kotero kuchuluka kwa zidziwitso zenizeni zomwe zatsitsidwa ndizochepa):

• maimelo opitilira 3 miliyoni amakasitomala ochokera ku re:Store, Samsung, Street Beat ndi masitolo a Lego
• manambala amafoni opitilira 7 miliyoni amakasitomala ochokera kumasitolo a re:Store, Sony, Nike, Street Beat ndi Lego
• zopitilira 21 zolowera / mawu achinsinsi kuchokera kuakaunti yanu ya ogula am'masitolo a Sony ndi Street Beat.
• zolemba zambiri zokhala ndi manambala a foni ndi imelo zinalinso ndi mayina athunthu (nthawi zambiri mu Chilatini) ndi manambala a makadi okhulupilika.

Chitsanzo kuchokera pachipika chokhudzana ndi kasitomala wa sitolo ya Nike (zonse zomwe zili zobisika m'malo ndi zilembo za "X"):

"message": "{"MESSAGE":"[URI] /personal/profile/[МЕТОД ЗАПРОСА] contact[ДАННЫЕ POST] Arrayn(n    [contact[phone]] => +7985026XXXXn    [contact[email]] => [email protected]    [contact[channel]] => n    [contact[subscription]] => 0n)n[ДАННЫЕ  GET] Arrayn(n    [digital_id] => 27008290n    [brand] => NIKEn)n[ОТВЕТ СЕРВЕРА] Код ответа - 200[ОТВЕТ СЕРВЕРА] stdClass Objectn(n    [result] => successn    [contact] => stdClass Objectn        (n            [phone] => +7985026XXXXn            [email] => [email protected]            [channel] => 0n            [subscription] => 0n        )nn)n","DATE":"31.03.2019 12:52:51"}",

Ndipo nachi chitsanzo cha momwe ma logins ndi mapasiwedi amakaunti amunthu ogula pamasamba adasungidwa sc-store.ru и street-beat.ru:

"message":"{"MESSAGE":"[URI]/action.php?a=login&sessid=93164e2632d9bd47baa4e51d23ac0260&login=XXX%40gmail.com&password=XXX&remember=Y[МЕТОД ЗАПРОСА] personal[ДАННЫЕ  GET] Arrayn(n    [digital_id] => 26725117n    [brand]=> SONYn)n[ОТВЕТ СЕРВЕРА] Код ответа - [ОТВЕТ СЕРВЕРА] ","DATE":"22.04.2019 21:29:09"}"

Mawu ovomerezeka a IRG pazochitikazi atha kuwerengedwa apa, kuchokera pamenepo:

Sitinathe kunyalanyaza mfundoyi ndikusintha mapasiwedi kukhala maakaunti amakasitomala kukhala osakhalitsa, kuti tipewe kugwiritsa ntchito deta kuchokera kumaakaunti amunthu pazachinyengo. Kampaniyo sikutsimikizira kutayikira kwa data yamakasitomala a street-beat.ru. Ntchito zonse za Inventive Retail Group zidawunikidwanso. Palibe ziwopsezo za data yamakasitomala zomwe zidapezeka.

Ndizoipa kuti IRG silingadziwe zomwe zatsika komanso zomwe sizinachitike. Nachi chitsanzo kuchokera pachipika chokhudzana ndi kasitomala wa sitolo ya Street Beat:

"message": "{"MESSAGE":"'DATA' => ['URI' => /local/components/multisite/order/ajax.php,'МЕТОД ЗАПРОСА' = contact,'ДАННЫЕ POST' = Arrayn(n    [contact[phone]] => 7915545XXXXn)n,'ДАННЫЕ  GET' =nttArrayn(n    [digital_id] => 27016686n    [brand] => STREETBEATn)n,'ОТВЕТ СЕРВЕРА' = 'Код ответа - '200,'RESPONCE' = stdClass Objectn(n    [result] => successn    [contact] => stdClass Objectn        (n            [phone] => +7915545XXXXn            [email] => [email protected]","Дата":"01.04.2019 08:33:48"}",

Komabe, tiyeni tipitirire ku nkhani zoyipa kwambiri ndikufotokozera chifukwa chake uku ndikutulutsa kwamakasitomala a IRG.

Mukayang'anitsitsa ma index a Elasticsearch omwe amapezeka kwaulere, muwona mayina awiri mwa iwo: readme и unauth_text. Ichi ndi chizindikiro cha chimodzi mwazolemba zambiri za ransomware. Zinakhudza ma seva opitilira 4 Elasticsearch padziko lonse lapansi. Zamkatimu readme zikuwoneka ngati izi:

"ALL YOUR INDEX AND ELASTICSEARCH DATA HAVE BEEN BACKED UP AT OUR SERVERS, TO RESTORE SEND 0.1 BTC TO THIS BITCOIN ADDRESS 14ARsVT9vbK4uJzi78cSWh1NKyiA2fFJf3 THEN SEND AN EMAIL WITH YOUR SERVER IP, DO NOT WORRY, WE CAN NEGOCIATE IF CAN NOT PAY"

Ngakhale seva yokhala ndi zipika za IRG inali kupezeka mwaulele, script ya ransomware idapeza chidziwitso cha makasitomala ndipo, malinga ndi uthenga womwe idasiya, deta idatsitsidwa.

Kuphatikiza apo, sindikukayika kuti databaseyi idapezeka ndisanakhalepo ndipo idatsitsidwa kale. Ndinganene kuti ndikutsimikiza izi. Palibe chinsinsi kuti nkhokwe zotseguka zotere zimafufuzidwa mwadala ndikutulutsidwa.

Nkhani zakutulutsa zambiri komanso zamkati zitha kupezeka panjira yanga ya Telegraph "Zambiri zatuluka»: https://t.me/dataleak.

Source: www.habr.com