🥇Mapulojekiti a Zombie - data yotayikira ngakhale atamwalira

Ndikulankhula za kutayikira kwa deta yaumwini kachiwiri, koma nthawi ino ndikuwuzani pang'ono za moyo wa pambuyo pa ntchito za IT pogwiritsa ntchito chitsanzo cha zomwe zapezedwa posachedwapa.

Pakuwunika kwachitetezo cha database, nthawi zambiri zimachitika kuti mumapeza ma seva (momwe mungafufuzire ma database, Ndinalemba mu blog) za mapulojekiti omwe akhalapo kale (kapena osati kale kwambiri) achoka kudziko lathu. Ntchito zotere zimapitirizabe kutsanzira moyo (ntchito), zofanana ndi Zombies (kusonkhanitsa deta ya ogwiritsa ntchito pambuyo pa imfa yawo).

Дисклеймер: вся информация ниже публикуется исключительно в образовательных целях. Автор не получал доступа к персональным данным третьих лиц и компаний. Информация взята либо из открытых источников, либо была предоставлена автору анонимными доброжелателями.

Tiyeni tiyambe ndi polojekiti yokhala ndi dzina lokweza "Putin's Team" (putinteam.ru).

Seva yokhala ndi MongoDB yotseguka idapezeka pa 19.04.2019/XNUMX/XNUMX.

Monga mukuwonera, a ransomware anali oyamba kufika pa izi:

Malo osungirako malowa alibe zambiri zaumwini, koma pali ma adilesi a imelo (osakwana 1000), mayina oyambirira / mayina, mawu achinsinsi, ma GPS ogwirizanitsa (mwachiwonekere polembetsa kuchokera ku mafoni a m'manja), mizinda yokhalamo ndi zithunzi za ogwiritsa ntchito omwe adapanga. akaunti yawoyawo pa izo.

{ 
    "_id" : ObjectId("5c99c5d08000ec500c21d7e1"), 
    "role" : "USER", 
    "avatar" : "https://fs.putinteam.ru/******sLnzZokZK75V45-1553581654386.jpeg", 
    "firstName" : "Вадим", 
    "lastName" : "", 
    "city" : "Санкт-Петербург", 
    "about" : "", 
    "mapMessage" : "", 
    "isMapMessageVerify" : "0", 
    "pushIds" : [

    ], 
    "username" : "5c99c5d08000ec500c21d7e1", 
    "__v" : NumberInt(0), 
    "coordinates" : {
        "lng" : 30.315868, 
        "lat" : 59.939095
    }
}

{ 
    "_id" : ObjectId("5cb64b361f82ec4fdc7b7e9f"), 
    "type" : "BASE", 
    "email" : "***@yandex.ru", 
    "password" : "c62e11464d1f5fbd54485f120ef1bd2206c2e426", 
    "user" : ObjectId("5cb64b361f82ec4fdc7b7e9e"), 
    "__v" : NumberInt(0)
}

Ambiri zinyalala zambiri ndi zolemba zopanda kanthu. Mwachitsanzo, kachidindo ka kalata yolembera makalata sikumayang'ana kuti imelo yalowetsedwa, kotero m'malo mwa adiresi, mukhoza kulemba chilichonse chimene mukufuna.

Potengera kukopera kwatsambali, ntchitoyi idasiyidwa mu 2018. Zoyesayesa zonse zolumikizana ndi oyimira polojekiti sizinaphule kanthu. Komabe, pali zolembetsa zosawerengeka patsamba - pali kutsanzira moyo.

Ntchito yachiwiri ya zombie pakuwunika kwanga lero ndikuyambitsa ku Latvia "Roamer" (roamerapp.com/ru).

Pa Epulo 21.04.2019, XNUMX, database yotseguka ya MongoDB ya pulogalamu yam'manja ya "Roamer" idapezeka pa seva ku Germany.

Malo osungirako zinthu zakale, 207 MB kukula kwake, akhala akupezeka poyera kuyambira Novembara 24.11.2018, XNUMX (malinga ndi Shodan)!

Ndi zizindikiro zonse zakunja (osagwira ntchito imelo adilesi yothandizira, maulalo osweka ku Google Play sitolo, kukopera pawebusayiti kuyambira 2016, ndi zina zambiri) pulogalamuyi idasiyidwa kwanthawi yayitali.

Panthawi ina, pafupifupi ma TV onse amalemba za kuyambika uku:

VC: "Woyambitsa waku Latvia Roamer ndi wakupha woyendayenda»
mudzi: "Roamer: Ntchito yomwe imachepetsa mtengo wamafoni ochokera kunja»
lifehacker: "Momwe mungachepetsere ndalama zoyankhulirana mukamayendayenda nthawi 10: Roamer»

"Wakuphayo" akuwoneka kuti wadzipha yekha, koma ngakhale atamwalira akupitiriza kuulula zambiri za ogwiritsa ntchito ...

Kutengera kusanthula kwazomwe zili mu database, ogwiritsa ntchito ambiri akupitiliza kugwiritsa ntchito pulogalamu yam'manja iyi. M'maola ochepa chabe akuwonekera, zolemba zatsopano 94 zidawonekera. Ndipo kuyambira pa Marichi 27.03.2019, 10.04.2019 mpaka Epulo 66, XNUMX, ogwiritsa ntchito atsopano XNUMX adalembetsa mu pulogalamuyi.

Zolemba (zopitilira 100) za pulogalamuyi ndi zambiri monga:

foni yam'manja
ma tokeni kuti muyimbe mbiri yakale (yopezeka kudzera pamaulalo monga: api3.roamerapp.com/call/history/1553XXXXXX)
mbiri yoyimba (nambala, mafoni obwera kapena otuluka, mtengo woyimba, nthawi, nthawi yoyimba)
wogwiritsa ntchito mafoni
Ma adilesi a IP
mtundu wa foni ya wogwiritsa ntchito ndi mtundu wa OS wa m'manja (mwachitsanzo, iPhone 7 12.1.4)
imelo adilesi ya ogwiritsa
akaunti ya osuta ndi ndalama
dziko la ogwiritsa ntchito
malo apano (dziko) la wogwiritsa ntchito
kodi zotsatsa
ndi zina zambiri.

{ 
    "_id" : ObjectId("5c9a49b2a1f7da01398b4569"), 
    "url" : "api3.roamerapp.com/call/history/*******5049", 
    "ip" : "67.80.1.6", 
    "method" : NumberLong(1), 
    "response" : {
        "calls" : [
            {
                "start_time" : NumberLong(1553615276), 
                "number" : "7495*******", 
                "accepted" : false, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(0), 
                "cost" : 0.0, 
                "call_id" : NumberLong(18869601)
            }, 
            {
                "start_time" : NumberLong(1553615172), 
                "number" : "7499*******", 
                "accepted" : true, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(63), 
                "cost" : 0.03, 
                "call_id" : NumberLong(18869600)
            }, 
            {
                "start_time" : NumberLong(1553615050), 
                "number" : "7985*******", 
                "accepted" : false, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(0), 
                "cost" : 0.0, 
                "call_id" : NumberLong(18869599)
            }
        ]
    }, 
    "response_code" : NumberLong(200), 
    "post" : [

    ], 
    "headers" : {
        "Host" : "api3.roamerapp.com", 
        "X-App-Id" : "a9ee0beb8a2f6e6ef3ab77501e54fb7e", 
        "Accept" : "application/json", 
        "X-Sim-Operator" : "311480", 
        "X-Wsse" : "UsernameToken Username="/******S19a2RzV9cqY7b/RXPA=", PasswordDigest="******NTA4MDhkYzQ5YTVlZWI5NWJkODc5NjQyMzU2MjRjZmIzOWNjYzY3MzViMTY1ODY4NDBjMWRkYjdiZTQxOGI4ZDcwNWJmOThlMTA1N2ExZjI=", Nonce="******c1MzE1NTM2MTUyODIuNDk2NDEz", Created="Tue, 26 Mar 2019 15:48:01 GMT"", 
        "Accept-Encoding" : "gzip, deflate", 
        "Accept-Language" : "en-us", 
        "Content-Type" : "application/json", 
        "X-Request-Id" : "FB103646-1B56-4030-BF3A-82A40E0828CC", 
        "User-Agent" : "Roamer;iOS;511;en;iPhone 7;12.1.4", 
        "Connection" : "keep-alive", 
        "X-App-Build" : "511", 
        "X-Lang" : "EN", 
        "X-Connection" : "WiFi"
    }, 
    "created_at" : ISODate("2019-03-26T15:48:02.583+0000"), 
    "user_id" : "888689"
}

Inde, sikunali kotheka kulankhulana ndi eni ake a mazikowo. Contacts pa malo sagwira ntchito, mauthenga pa chikhalidwe TV. palibe amene amayankha pamanetiweki.

Pulogalamuyi ikupezekabe pa Apple App Store (itunes.apple.com/app/roamer-roaming-killer/id646368973).

Nkhani zakutulutsa zambiri komanso zamkati zitha kupezeka panjira yanga ya Telegraph "Zambiri zatuluka»: https://t.me/dataleak.

Source: www.habr.com

Mapulojekiti a Zombie - kutsitsa kwa ogwiritsa ntchito ngakhale atamwalira

Tiyeni tiyambe ndi polojekiti yokhala ndi dzina lokweza "Putin's Team" (putinteam.ru).

Ntchito yachiwiri ya zombie pakuwunika kwanga lero ndikuyambitsa ku Latvia "Roamer" (roamerapp.com/ru).

Kuwonjezera ndemanga kuletsa reply