🥇Сотни тысяч платежей граждан в ГИБДД и ФССП находились в открытом доступе

Medicinski podatki – so bile, podatki o kreditih – so bile, tokrat je prišel čas podatkov o plačilih za kazni GIBDD in dolgovih zaradi izvršilnih postopkov službe za izvrševanje sodb.

Dobra novica je, da ti plačila niso povezana z uradno spletno stranjo državnih storitev. Slaba novica – podatkov je veliko in so bolj kot ne 'osebni'.

Odziv: vse informacije, ki so spodaj objavljene, so namenjene izključno izobraževalnim namenom. Avtor ni imel dostopa do osebnih podatkov tretjih oseb in podjetij. Informacije so pridobljene bodisi iz odprtih virov bodisi so bile avtorju posredovane anonimno prijaznimi ljudmi.

12. aprila (ponoči) je bil odkrit strežnik Elasticsearch, ki ni zahteval overitve za povezavo. O tem, kako odkrivamo odprte baze Elasticsearch sem pisal v blogu.

V indeksih Elasticsearch so bili shranjeni logi neke informacijske sistema (IS). Bilo je predpostavljeno, da je ta strežnik povezan s spletnimi stranmi, ki sprejemajo plačila za različne državne storitve: oplatagibdd.ru, paygibdd.ru, gos-oplata.ru, shtrafov.net in oplata-fssp.ru.

Zjutraj 13.04.2019 sem poslal obvestilo na naslednje elektronske naslove: support@gos-oplata.ru, support@oplata-fssp.ru, support@paygibdd.ru, vendar odgovora (kot se pogosto zgodi) nisem prejel. Strežnik je bil tiho 'zaprt' in je izginil iz odprte dostopnosti 13.04.2019 okoli 15:20-15:45 (MSK).

Ob času zapiranja strežnika so indeksi Elasticsearch izgledali tako:

Zdaj preidimo k najbolj zanimivemu – neposredno k osebnim podatkom. Kot sem že omenil, so bili v indeksih shranjeni neki logi neke IS. In kot to pogosto gre, so bili logi zelo podrobni, celo preveč.

Logi so se hranili, od 28.02.2019, in ne za celotno obdobje delovanja IS. V nekaterih indeksih so bili podatki od 17.03.2019.

Na primer, iz logov iz indeksa gosoplata je bilo mogoče pridobiti naslednje (skupaj 248365, izključujoč logiranje napak):

{
        "_index": "gosoplata",
        "_type": "log",
        "@timestamp": "2019-03-02T20:55:02+03:00",
          "message": "Nalog found in GIS",
          "extra": "[n    'gis_info' => unserialize('O:34:"app\models\payment\api\PenaltyInfo":10:{s:10:"billNumber";s:20:"ХХХХХ021170025955001";s:8:"billDate";s:10:"2017-04-03";s:10:"validUntil";s:10:"2017-06-03";s:6:"amount";s:9:"146030.26";s:7:"addInfo";s:1424:"Payment of the debt for IP № ХХХХХ/17/ ХХХХХ -IP dated 03.04.2017 regarding MIХХХХ Х. Х., Debt on credit payments (excluding mortgage)///UIN32253021170025955001_IP0;Subdivision: UFK FOR NOVGOROD REGION (OSP OF NOVGOROD, BATECKY AND KRESTETSKY DISTRICTS OF THE STATE EXECUTIVE SERVICE OF RUSSIA FOR NOVGOROD REGION, Account No. 05501845860);Recipient: UFK FOR NOVGOROD REGION (OSP OF NOVGOROD, BATECKY AND KRESTETSKY DISTRICTS OF THE STATE EXECUTIVE SERVICE OF RUSSIA FOR NOVGOROD REGION, Account No. 05501845860);Recipient Bank: NOVGOROD BRANCH;Recipient Account Number: 40302810400001000005;TIN: 5321100670;KPP: 532132002;Recipient Bank BIK: 044959001;OKATO: 49625000;KBK: 0;idDebtsum:146540.26;ipPaymentAmount:0.00;ipOperationAmount:0.00;dataUnloadDate:2018-12-04T11:26:19.000;dataIdDate:2017-01-27;dataIdNumber:2-53/2017;dataIpRiseDate:2017-04-03;dataIpNumber: ХХХХХ/17/ХХХХХ-IP;dataIdDbtrFio:МИХХХ ХХХ ХХХ;dataIdDbtrBorn:ХХХ-09-03;dataIdDebtText:Debt on credit payments (excluding mortgage);";s:7:"docName";s:3:"inn";s:9:"docNumber";s:12:" ХХХХХ0819584";s:9:"payStatus";s:1:"0";s:9:"quittance";s:1:"3";s:11:"amountToPay";s:9:"146030.26";}'),n]",
          "context": "[n    '_GET' => [],n    '_POST' => [],n]"
        }
      }

Я заменил все чувствительные данные символом «Х». В действительности все хранилось в открытом виде.

Из индекса oplata-fssp (всего 283958 исключая ошибки):

 {
        "_index": "oplata-fssp",
        "_type": "log",
          "@timestamp": "2019-02-28T22:17:24+03:00",
          "extra": "[n    'request_data' => [n        'MNT_ID' => 'ХХХХХ3280',n        'MNT_TRANSACTION_ID' => ''ХХХХХ0795c78337a5a308',n        'MNT_OPERATION_ID' => ''ХХХХХ 3232',n        'MNT_AMOUNT' => '544.00',n        'MNT_CURRENCY_CODE' => 'RUB',n        'MNT_TEST_MODE' => '0',n        'MNT_SIGNATURE' => '6435224ccХХХХХХХ10bbc970f6479787',n        'paymentSystem_unitId' => '1686945',n        'MNT_CORRACCOUNT' => '303',n        'MNT_PAY_SYSTEM' => 'payanyway',n        'MNT_IS_REGULAR' => '',n        'MNT_FORM_METHOD' => 'POST',n        'cardnumber' => '639002********7417',n    ],n    'model_attributes' => [n        'id' => 482137,n        'parent_id' => null,n        'name' => 'ПОХХХ ГАЛИНА ГХХХ',n        'ur' => 0,n        'birthdate' => 'ХХХХ-06-06',n        'doc_type' => null,n        'doc_value' => null,n        'hash' => ''ХХХХХ795c78337a5a308',n        'created_at' => '2019-02-28 22:16:10',n        'form_url' => 'https://service.moneta.ru/assistant.widget? 'ХХХХХ&MNT_CURRENCY_CODE=RUB&MNT_AMOUNT=544.00&MNT_DESCRIPTION=Оплата задолженности ФССП. Заказ N482137 УИН: 32223088190136500007 Делопроизводство: ХХХХХХ/19/ХХХХХ-ИП&MNT_TEST_MODE=0&'ХХХХХ &MNT_SUCCESS_URL=https://oplata-fssp.ru/payment/success&MNT_FAIL_URL=https://oplata-fssp.ru/payment/fail&MNT_PAY_SYSTEM=payanyway&MNT_IS_REGULAR=&MNT_FORM_METHOD=POST&followup=true',n        'email' => ''ХХХХХ@bk.ru',n        'payment_system_id' => 'moneta',n        'transaction_id' => '338533232',n        'updated_at' => '2019-02-28 22:16:16',n        'a3_order_hash' => null,n        'receipt_send' => null,n        'receipt_status_id' => null,n        'payment_status_id' => 'callback_received',n        'lead_source' => 'fssp',n    ],n]",
          "context": "[n    '_GET' => [],n    '_POST' => [n        'MNT_ID' => ''ХХХХХ280',n        'MNT_TRANSACTION_ID' => ''ХХХХХ795c78337a5a308',n        'MNT_OPERATION_ID' => ''ХХХХХ3232',n        'MNT_AMOUNT' => '544.00',n        'MNT_CURRENCY_CODE' => 'RUB',n        'MNT_TEST_MODE' => '0',n        'MNT_SIGNATURE' => '6435224cc'ХХХХХ10bbc970f6479787',n        'paymentSystem_unitId' => ''ХХХХХ45',n        'MNT_CORRACCOUNT' => '303',n        'MNT_PAY_SYSTEM' => 'payanyway',n        'MNT_IS_REGULAR' => '',n        'MNT_FORM_METHOD' => 'POST',n        'cardnumber' => '639002********7417',n    ],n]"
        }
      }

Tuk vidno (vrednost cardnumber), da je jedino to što je platni portal (u ovom slučaju moneta.ru) štitio od curenja punih brojeva kreditnih kartica i njihovih vlasnika (samo prvih 6 i poslednjih 4 cifre broja kartice).

Takođe je iz logova vidljivo da zvanični sajt FSSP nudi građanima da vrše uplate preko ovog sistema: is.fssprus.ru/pay/?service=gosoplata&pay=ХХХХХХ/18/ХХХХХХ-IP. Što indirektno potvrđuje tekst na dnu sajta oplata-fssp.ru:

Sada da vidimo kakva je situacija sa kaznama za saobraćaj. Očigledno za to odgovaraju indeksi shatrafov-net (4528 unosa bez grešaka) i paygibdd (140666 unosa bez grešaka):

{
        "_index": "shtrafov-net",
        "_type": "log",
          "@timestamp": "2019-03-17T17:16:51+03:00",
          "message": "INSERT INTO customer (doc_type, doc_value, licence_plate, vehicle_model) VALUES ('ctc', '99026ХХХХХ', 'УХХХРМХХ', 'LEND ROVER RANGE ROVER')",
          "context": "[n    '_GET' => [],n    '_POST' => [n        'postdate' => '10/03/2019',n        'postnum' => '18810018180002ХХХХХХ',n        'postsum' => '1000',n        'divid' => '1194040',n        'uin' => '18810018180002ХХХХХХ',n        'regnum' => 'УХХХРМ',n        'regreg' => '1Х',n        'reg' => 'ХХХХХ34084',n        'discount' => '1',n        'discountdate' => '01/04/2019 23:59:59',n        'allfines' => '[{"Discount":"1","enableDiscount":false,"DateDecis":"2019-03-10 09:05:00","KoAPcode":"12.6","DateDiscount":"01/04/2019 23:59:59","VehicleModel":"LEND ROVER RANGE ROVER","KoAPtext":"DRIVING A VEHICLE BY A DRIVER NOT BUCKLED UP WITH A SAFETY BELT, TRANSPORTING PASSENGERS NOT WEARING SEAT BELTS IF THE VEHICLE IS EQUIPPED WITH SAFETY BELTS, AS WELL AS DRIVING A MOTORCYCLE OR TRANSPORTING PASSENGERS ON A MOTORCYCLE WITHOUT HELMETS OR WITH UNFASTENED HELMETS","NumPost":"18810018180002ХХХХХХ","kbk":"18811630020016000140","Summa":1000,"Division":1194040,"enablePics":false,"id":"18#FF474785255","SupplierBillID":"18810018180002ХХХХХХ","DatePost":"10/03/2019"},{"Discount":"1","enableDiscount":false,"DateDecis":"2019-03-08 14:55:00","KoAPcode":"12.9ч.2","DateDiscount":"01/04/2019 23:59:59","VehicleModel":"LEND ROVER RANGE ROVER","KoAPtext":"SPEEDING BY MORE THAN 20 BUT NOT MORE THAN 40 KM/H","NumPost":"18810118190312ХХХХХХ","kbk":"18811630020016000140","Summa":500,"Division":1194010,"enablePics":true,"id":"18#18810118190312ХХХХХХ","SupplierBillID":"18810118190312ХХХХХХ","DatePost":"12/03/2019"}]',n    ],n]"
        }

{
        "_index": "paygibdd",
        "_type": "log",
        "@timestamp": "2019-02-28T17:30:57+03:00",
        "message": "Входящий запрос на оплату",
          "extra": "[n    'request_data' => [n        'postdate' => '02.10.2017',n        'postnum' => '188101161710029ХХХХХ',n        'postsum' => '500',n        'divid' => '1192201',n        'uin' => '188101161710029ХХХХХ',n        'regnum' => 'XХХХCB',n        'regreg' => '1ХХ',n        'reg' => '16462ХХХХХ',n        'discount' => '1',n        'discountdate' => '2017-10-23 23:59:59',n        'allfines' => '[{"Discount":"0","DateDecis":"2016-12-17 02:30:00","KoAPcode":"12.26ч.1","KoAPtext":"FAILURE TO COMPLY WITH A LEGAL REQUIREMENT OF A POLICE OFFICER TO UNDERGO A MEDICAL EXAMINATION TO DETERMINE INTOXICATION","NumPost":"188104121603000ХХХХХ","kbk":"18811630020016000140","Summa":"30000","Division":1188030,"enablePics":false,"id":"12#FF176064188","SupplierBillID":"188104121603000ХХХХХ","DatePost":"2017-03-06","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2017-09-18 14:32:00","KoAPcode":"12.9ч.2","DateDiscount":"2017-10-23 23:59:59","KoAPtext":"SPEEDING BY MORE THAN 20 BUT NOT MORE THAN 40 KM/H","NumPost":"188101161710029ХХХХХ","kbk":"18811630020016000140","Summa":"500","Division":1192201,"enablePics":true,"id":"16#43522519023478911ХХХХХ","SupplierBillID":"188101161710029ХХХХХ","DatePost":"2017-10-02","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2017-11-01 04:23:00","KoAPcode":"12.9ч.2","DateDiscount":"2017-11-24 23:59:59","KoAPtext":"SPEEDING BY MORE THAN 20 BUT NOT MORE THAN 40 KM/H","NumPost":"18810116171104ХХХХХ","kbk":"18811630020016000140","Summa":"500","Division":1192201,"enablePics":true,"id":"16#44211639030358281ХХХХХ","SupplierBillID":"1881011617110ХХХХХ","DatePost":"2017-11-04","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2017-10-31 12:08:00","KoAPcode":"12.9ч.2","DateDiscount":"2017-11-27 23:59:59","KoAPtext":"SPEEDING BY MORE THAN 20 BUT NOT MORE THAN 40 KM/H","NumPost":"188101161711056ХХХХХ","kbk":"18811630020016000140","Summa":"500","Division":1192201,"enablePics":true,"id":"16#44236760030609331ХХХХХ","SupplierBillID":"188101161711056ХХХХХ","DatePost":"2017-11-05","DateSSP":null},{"Discount":"1","enableDiscount":false,"DateDecis":"2018-01-27 23:46:00","KoAPcode":"12.37ч.2","DateDiscount":"2018-02-16 23:59:59","KoAPtext":"FAILURE BY A VEHICLE OWNER TO COMPLY WITH THE FEDERAL LAW ON OSAGO REQUIREMENTS, INCLUDING DRIVING A VEHICLE WITHOUT OSAGO INSURANCE","NumPost":"188102161820027ХХХХХ","kbk":"18811630020016000140","Summa":"800","Division":1192200,"enablePics":false,"id":"16#4516501003986993ХХХХХ","SupplierBillID":"188102161820027ХХХХХ","DatePost":"2018-01-27","DateSSP":null}]',n    ],n]\

Суммируя написанное выше – все детали платежей были доступны: номер постановления о штрафе, государственный номерной знак автомобиля, номер исполнительного производства при платеже в пользу службы судебных приставов, первые и последние цифры банковских карт, через какой платёжный шлюз была произведена оплата, ФИО и адрес электронной почты плательщика и многое другое.

За один выбранный день (12.04) в индексах находилось (записей):

shtrafov-net    251
paygibdd        3821
gosoplata       20676
oplata-fssp     15277

Поисковик Shodan впервые обнаружил этот сервер в открытом доступе 24.02.2019.

Novice o puščanju informacij in insajderjih lahko vedno najdete na mojem Telegram kanalu „Puščanje informacij».

Izvor: habr.com

Stotine tisoč plačil državljanov v GIBDD in FSSP so bile dostopne javnosti