Rostelecom idayamba kusinthira kutsatsa kwake kukhala anthu olembetsa

Rostelecom, wogwiritsa ntchito kwambiri ma burodibandi ku Russian Federation, akutumikira pafupifupi 13 miliyoni olembetsa, popanda kulengeza kosafunika. kuyikidwa mu ntchito njira yosinthira zikwangwani zake zotsatsa mumayendedwe osadziwika a HTTP a olembetsa. Popeza kuti midadada ya JavaScript yomwe imayikidwa mumayendedwe apaulendo imaphatikizapo khodi yobisika komanso mwayi wopita kumalo okayikitsa osagwirizana ndi Rostelecom (p.analytic.press, d.d1tracker.ru, dmd.digitaltarget.ru), poyamba panali kukayikira kuti zida za woperekayo zinali nazo. Zasokonezedwa ndipo mapulogalamu oyipa adayambitsidwa.Mapulogalamu mu rauta yanyumba. Koma atatumiza madandaulo, oimira Rostelecom adawonetsa kuti m'malo mwa zotsatsa zidachitika mkati mwa dongosolo la ntchito yowonetsa kutsatsa kwa zikwangwani kwa olembetsa, omwe akhala akugwira ntchito kuyambira 10 February.

Kutsatsa kumawonetsedwa kudzera pa netiweki ya mail.ru, ndipo mayendedwe amatsatiridwa kudzera pa d1tracker.ru (purosesayo imakhala mumtambo wa Amazon). Khodiyo imaphatikizanso mafoni ku analytic.press domain, yomwe idalembetsedwa kumapeto kwa Disembala.

Nthawi zambiri, zotsatsa zazithunzi zonse zimawonetsedwa patsamba lonse, kapena chikwangwani chimawonjezedwa pamwamba pamasamba. Nthawi zambiri, midadada yoyikidwa imawoneka ngati kuyika kwa malonda okhumudwitsa ndi masamba omwewo, ndipo wolembetsa samazindikira kuti kutsatsa kumayikidwa ndi wopereka. Mitundu yonse ya mautumiki ochokera ku makampani a chipani chachitatu (osagwirizana ndi Rostelecom) amalengezedwa, kuphatikizapo kugulitsa tochi.

Chitsanzo cha inline code chingapezeke mu izi archive. Mbali ya code ndi obfuscated ndi yodzaza dynamically, kotero popanda kusanthula mwatsatanetsatane n'zovuta kuweruza ngati amangoika malonda kapena kuchita zina pa msakatuli kasitomala mbali.

Kudzera m'malo olumikizirana ndi akaunti yanu palibe kuthekera koletsa kutsatsa, koma mutatha kulemba pempho la tsamba lofunsira, Ogwira ntchito ku Rostelecom amaletsa kutsatsa m'malo mwa olembetsa enieni. Funso ndilakuti ngati kulowetsako kumangokhudza kuchuluka kwa magalimoto a HTTP kapena kampaniyo analowa mu ndipo mumayendedwe a HTTPS kudzera m'malo mwa satifiketi sizinayankhidwe. Webusaiti ya kampaniyo ilibe zambiri zokhudza kuyamba kwa kusintha kwa magalimoto oyendetsa makasitomala.

Source: opennet.ru