Ndinonyora zvakawanda pamusoro pekuwanikwa kwezvinyorwa zvinowanikwa zvakasununguka munenge nyika dzose dzepasi, asi pane inenge isina nhau pamusoro pezvinyorwa zveRussia zvakasara munharaunda yevanhu. Kunyangwe munguva pfupi yapfuura nezve "ruoko rweKremlin," irwo muongorori wechiDutch akatya kuwana mune anopfuura zviuru zviviri zvakavhurika dhatabhesi.
Panogona kunge paine pfungwa isiriyo yekuti zvese zvakanaka muRussia uye varidzi veRussia mapurojekiti makuru epamhepo vanotora nzira ine mutoro yekuchengetedza data remushandisi. Ndinokasira kuburitsa ngano iyi ndichishandisa muenzaniso uyu.
Iyo yekuRussia yepamhepo sevhisi yekurapa DOC + sezviri pachena yakakwanisa kusiya iyo ClickHouse dhatabhesi ine matanda ekuwana anowanikwa pachena. Nehurombo, matanda anotaridzika akadzama zvekuti data rega revashandi, vanobatika uye vatengi vesevhisi rinogona kunge rakaburitswa.
Zvinhu zvekutanga kutanga...
ΠΠΈΡΠΊΠ»Π΅ΠΉΠΌΠ΅Ρ: Π²ΡΡ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ Π½ΠΈΠΆΠ΅ ΠΏΡΠ±Π»ΠΈΠΊΡΠ΅ΡΡΡ ΠΈΡΠΊΠ»ΡΡΠΈΡΠ΅Π»ΡΠ½ΠΎ Π² ΠΎΠ±ΡΠ°Π·ΠΎΠ²Π°ΡΠ΅Π»ΡΠ½ΡΡ
ΡΠ΅Π»ΡΡ
. ΠΠ²ΡΠΎΡ Π½Π΅ ΠΏΠΎΠ»ΡΡΠ°Π» Π΄ΠΎΡΡΡΠΏΠ° ΠΊ ΠΏΠ΅ΡΡΠΎΠ½Π°Π»ΡΠ½ΡΠΌ Π΄Π°Π½Π½ΡΠΌ ΡΡΠ΅ΡΡΠΈΡ
Π»ΠΈΡ ΠΈ ΠΊΠΎΠΌΠΏΠ°Π½ΠΈΠΉ. Π‘ΠΊΡΠΈΠ½ΡΠΎΡΡ Π²Π·ΡΡΡ Π»ΠΈΠ±ΠΎ ΠΈΠ· ΠΎΡΠΊΡΡΡΡΡ
ΠΈΡΡΠΎΡΠ½ΠΈΠΊΠΎΠ², Π»ΠΈΠ±ΠΎ Π±ΡΠ»ΠΈ ΠΏΡΠ΅Π΄ΠΎΡΡΠ°Π²Π»Π΅Π½Ρ Π°Π²ΡΠΎΡΡ Π°Π½ΠΎΠ½ΠΈΠΌΠ½ΡΠΌΠΈ Π΄ΠΎΠ±ΡΠΎΠΆΠ΅Π»Π°ΡΠ΅Π»ΡΠΌΠΈ.
Neni, semuridzi weTeregiramu chiteshi "", muverengi wechiteshi aida kuramba asingazivikanwe akasangana ndokutaura zvinotevera:
Yakavhurika ClickHouse server yakawanikwa paInternet, inova yekambani doc+. Iyo server IP kero inoenderana neiyo IP kero iyo iyo docplus.ru domain inogadziriswa.
Kubva Wikipedia: DOC + (New Medicine LLC) ikambani yekurapa yekuRussia inopa masevhisi mumunda we telemedicine, ichidaidza chiremba kumba, kuchengetedza uye kugadzirisa. ruzivo rwezvehutano rwemunhu. Iyo kambani yakagamuchira mari kubva kuYandex.
Tichitarisa neruzivo rwakaunganidzwa, iyo ClickHouse dhatabhesi yaive yakasununguka kuwanikwa, uye chero munhu, achiziva iyo IP kero, aigona kuwana data kubva mairi. Iyi data ingangove matanda ekuwana masevhisi.
Sezvauri kuona kubva pamufananidzo uri pamusoro, mukuwedzera kune www.docplus.ru web server uye ClickHouse server (port 9000), iyo MongoDB dhatabheti yakaturika yakavhurika pane imwecheteyo IP kero (umo, sezviri pachena, hapana chinhu. zvinonakidza).
Sekuziva kwangu, iyo Shodan.io yekutsvaga injini yakashandiswa kuwana iyo ClickHouse server (inenge Ndakanyora zvakasiyana) pamwe chete nechinyorwa chakakosha , iyo yakaongorora dhatabhesi yakawanikwa nekuda kwekushaikwa kwehuchokwadi uye yakanyora matafura ayo ese. Panguva iyoyo kwairatidzika kuva 474 vavo.
Kubva pane zvinyorwa tinoziva kuti nekukasira, iyo ClickHouse server inoteerera HTTP pachiteshi 8123. Naizvozvo, kuti uone zviri mumatafura, zvakakwana kumhanyisa chimwe chinhu senge ichi SQL query:
http://[IP-Π°Π΄ΡΠ΅Ρ]:8123?query=SELECT * FROM [Π½Π°Π·Π²Π°Π½ΠΈΠ΅ ΡΠ°Π±Π»ΠΈΡΡ]Nekuda kwekuita chikumbiro, izvo zvinogona kudzoserwa ndizvo zvinoratidzwa mumufananidzo uri pazasi:
Kubva pascreenshot zviri pachena kuti ruzivo rwuri mumunda HEADERS ine data nezve nzvimbo (latitude uye longitudo) yemushandisi, yake IP kero, ruzivo nezve mudziyo waakabatana nawo kune sevhisi, OS vhezheni, nezvimwe.
Kana zvikaitika kune mumwe munhu kuti achinje zvishoma mubvunzo weSQL, semuenzaniso, seizvi:
http://[IP-Π°Π΄ΡΠ΅Ρ]:8123?query=SELECT * FROM [Π½Π°Π·Π²Π°Π½ΠΈΠ΅ ΡΠ°Π±Π»ΠΈΡΡ] WHERE REQUEST LIKE β%25Profiles%25β
ipapo chimwe chinhu chakafanana nedata yevashandi inogona kudzoserwa, zvinoti: zita rakazara, zuva rekuzvarwa, murume kana mukadzi, nhamba yekuzivikanwa yemutero, kunyoreswa uye nzvimbo chaiyo yekero yekugara, nhamba dzenhare, zvinzvimbo, email kero nezvimwe zvakawanda:
Ruzivo rwese urwu kubva pamufananidzo uri pamusoro rwakanyanya kufanana neiyo data yeHR kubva ku1C: Enterprise 8.3.
Kunyatsotarisisa parameter API_USER_TOKEN iwe unogona kufunga kuti ichi chiratidzo che "kushanda" chaunogona kuita zviito zvakasiyana-siyana pachinzvimbo chemushandisi, kusanganisira kuwana data rake rega. Asi chokwadi handikwanise kutaura izvi.
Parizvino hapana ruzivo rwekuti ClickHouse server ichiri kuwanikwa zvakasununguka pane imwecheteyo IP kero.
Source: www.habr.com