Poloketi Zombie - fa'amama fa'amaumauga a tagata e tusa lava pe ua maliliu

O loʻo ou talanoa e uiga i faʻamatalaga a le tagata lava ia, ae o le taimi lenei o le a ou taʻu atu ia te oe se mea itiiti e uiga i le olaga mulimuli o galuega IT e faʻaaoga ai le faʻataʻitaʻiga o mea na maua talu ai nei.

I le taimi o se su'esu'ega fa'amaumauga mo le puipuiga o fa'amaumauga, e masani ona tupu e te mauaina ni 'au'aunaga (auala e su'e ai fa'amaumauga, Na ou tusia i totonu o se blog) o loʻo auai i galuega faatino ua leva (pe leʻi leva tele) na tuʻua ai lo tatou lalolagi. O ia poloketi e faʻaauau pea ona faʻataʻitaʻi i le olaga (galuega), pei o zombies (aoina mai o faʻamatalaga patino o tagata faʻaoga pe a mavae lo latou oti).

Дисклеймер: вся информация ниже публикуется исключительно в образовательных целях. Автор не получал доступа к персональным данным третьих лиц и компаний. Информация взята либо из открытых источников, либо была предоставлена автору анонимными доброжелателями.

Sei o tatou amata i se poloketi ma le igoa leotele "Putin's Team" (putinteam.ru).

O se 'auʻaunaga e tatala MongoDB na maua ile 19.04.2019/XNUMX/XNUMX.

E pei ona mafai ona e vaʻai, o le ransomware na muamua oʻo i lenei faʻavae:

O le database e le o iai ni faʻamatalaga patino taua, ae o loʻo i ai tuatusi imeli (itiiti ifo i le 1000), igoa muamua / igoa faʻaigoa, faʻaupuga faʻamalo, faʻamaopoopo GPS (e foliga mai pe a lesitala mai smartphones), aai e nonofo ai ma ata o tagata faʻaoga nofoaga na faia. la latou tala patino i ai.

{ 
    "_id" : ObjectId("5c99c5d08000ec500c21d7e1"), 
    "role" : "USER", 
    "avatar" : "https://fs.putinteam.ru/******sLnzZokZK75V45-1553581654386.jpeg", 
    "firstName" : "Вадим", 
    "lastName" : "", 
    "city" : "Санкт-Петербург", 
    "about" : "", 
    "mapMessage" : "", 
    "isMapMessageVerify" : "0", 
    "pushIds" : [

    ], 
    "username" : "5c99c5d08000ec500c21d7e1", 
    "__v" : NumberInt(0), 
    "coordinates" : {
        "lng" : 30.315868, 
        "lat" : 59.939095
    }
}

{ 
    "_id" : ObjectId("5cb64b361f82ec4fdc7b7e9f"), 
    "type" : "BASE", 
    "email" : "***@yandex.ru", 
    "password" : "c62e11464d1f5fbd54485f120ef1bd2206c2e426", 
    "user" : ObjectId("5cb64b361f82ec4fdc7b7e9e"), 
    "__v" : NumberInt(0)
}

E tele naua lapisi fa'amatalaga ma fa'amaumauga gaogao. Mo se faʻataʻitaʻiga, e le siakiina e le numera o le faʻasalalauga faʻasalalau ua tuʻuina se tuatusi imeli, o lea nai lo se tuatusi, e mafai ona e tusia soʻo se mea e te manaʻo ai.

I le faʻamasinoina o le puletaofia i luga o le upega tafaʻilagi, na lafoaia le poloketi i le 2018. E le'i manuia taumafaiga uma e fa'afeso'ota'i sui o le poloketi. Ae ui i lea, e seasea resitalaina i luga o le saite - o loʻo i ai se faʻataʻitaʻiga o le olaga.

O le poloketi zombie lona lua i laʻu auiliiliga i aso nei o le Latvian startup "Roamer" (roamerapp.com/ru).

I le aso 21.04.2019 o Aperila, XNUMX, na maua ai se faʻamaumauga MongoDB o le telefoni feaveaʻi "Roamer" i luga o se 'auʻaunaga i Siamani.

O le database, 207 MB i le lapopoa, ua avanoa lautele talu mai Novema 24.11.2018, XNUMX (e tusa ai ma Shodan)!

I faʻailoga uma i fafo (e le o galue i le tuatusi imeli lagolago faʻapitoa, fesoʻotaʻiga gau i le Google Play store, puletaofia i luga o le upega tafaʻilagi mai le 2016, ma isi) ua leva ona lafoaia le talosaga.

I se tasi taimi, toetoe lava o faʻasalalauga autu uma na tusia e uiga i lenei amataga:

• VC:"O le amataga o Latvia Roamer o se fasioti tagata feoai»
• le-nuu: "Roamer: O se talosaga e faʻaitiitia ai le tau o telefoni mai fafo»
• tagata olaola:"Fa'afefea ona fa'aitiitia tau feso'ota'iga a'o feoa'i e 10 taimi: Roamer»

O le "fasioti tagata" e foliga mai na fasiotia o ia lava, ae tusa lava pe ua oti na te faʻaauau pea ona faʻaalia faʻamatalaga patino a ana tagata faʻaoga ...

I le faʻamasinoina o le auʻiliʻiliga o faʻamatalaga i totonu o faʻamaumauga, o loʻo faʻaauau pea ona faʻaogaina e le tele o tagata faʻaoga lenei telefoni feaveaʻi. I totonu o ni nai itula talu ona matauina, e 94 tala fou na aliali mai. Ma mo le vaitaimi mai ia Mati 27.03.2019, 10.04.2019 ia Aperila 66, XNUMX, XNUMX tagata fou na lesitala i le talosaga.

Fa'amaumauga (sili atu i le 100 afe fa'amaumauga) o le talosaga ma fa'amatalaga e pei o:

• telefoni fa'aoga
• avanoa fa'ailoga e vala'au ai tala fa'asolopito (maua e ala i so'oga e pei o: api3.roamerapp.com/call/history/1553XXXXXX)
• vala'au tala fa'asolopito (numera, ulufale mai po'o fafo, telefoni tau, umi, taimi ole vala'au)
• tagata fa'aoga feavea'i
• Fa'aoga tuatusi IP
• fa'ata'ita'iga telefoni a le tagata fa'aoga ma le OS feavea'i o lo'o i luga (mo se fa'ata'ita'iga, iPhone 7 12.1.4)
• tuatusi imeli tagata faaaoga
• paleni fa'amatalaga a tagata fa'aoga ma tupe
• atunuu fa'aoga
• nofoaga o iai nei (atunuu) o le tagata fa'aoga
• promo code
• ma sili atu.

{ 
    "_id" : ObjectId("5c9a49b2a1f7da01398b4569"), 
    "url" : "api3.roamerapp.com/call/history/*******5049", 
    "ip" : "67.80.1.6", 
    "method" : NumberLong(1), 
    "response" : {
        "calls" : [
            {
                "start_time" : NumberLong(1553615276), 
                "number" : "7495*******", 
                "accepted" : false, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(0), 
                "cost" : 0.0, 
                "call_id" : NumberLong(18869601)
            }, 
            {
                "start_time" : NumberLong(1553615172), 
                "number" : "7499*******", 
                "accepted" : true, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(63), 
                "cost" : 0.03, 
                "call_id" : NumberLong(18869600)
            }, 
            {
                "start_time" : NumberLong(1553615050), 
                "number" : "7985*******", 
                "accepted" : false, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(0), 
                "cost" : 0.0, 
                "call_id" : NumberLong(18869599)
            }
        ]
    }, 
    "response_code" : NumberLong(200), 
    "post" : [

    ], 
    "headers" : {
        "Host" : "api3.roamerapp.com", 
        "X-App-Id" : "a9ee0beb8a2f6e6ef3ab77501e54fb7e", 
        "Accept" : "application/json", 
        "X-Sim-Operator" : "311480", 
        "X-Wsse" : "UsernameToken Username="/******S19a2RzV9cqY7b/RXPA=", PasswordDigest="******NTA4MDhkYzQ5YTVlZWI5NWJkODc5NjQyMzU2MjRjZmIzOWNjYzY3MzViMTY1ODY4NDBjMWRkYjdiZTQxOGI4ZDcwNWJmOThlMTA1N2ExZjI=", Nonce="******c1MzE1NTM2MTUyODIuNDk2NDEz", Created="Tue, 26 Mar 2019 15:48:01 GMT"", 
        "Accept-Encoding" : "gzip, deflate", 
        "Accept-Language" : "en-us", 
        "Content-Type" : "application/json", 
        "X-Request-Id" : "FB103646-1B56-4030-BF3A-82A40E0828CC", 
        "User-Agent" : "Roamer;iOS;511;en;iPhone 7;12.1.4", 
        "Connection" : "keep-alive", 
        "X-App-Build" : "511", 
        "X-Lang" : "EN", 
        "X-Connection" : "WiFi"
    }, 
    "created_at" : ISODate("2019-03-26T15:48:02.583+0000"), 
    "user_id" : "888689"
}

Ioe, e le mafai ona faʻafesoʻotaʻi tagata e ona le faʻavae. O fesoʻotaʻiga i luga o le saite e le aoga, feʻau i luga o faʻasalalauga lautele. e leai se tasi e tali mai i luga o upega tafailagi.

O lo'o maua pea le polokalame ile Apple App Store (itunes.apple.com/app/roamer-roaming-killer/id646368973).

Talafou e uiga i faʻamatalaga faʻamatalaga ma tagata e mafai ona maua i taimi uma i luga o laʻu Telegram channel "Lisi fa'amatalaga" https://t.me/dataleak.

puna: www.habr.com