APNIC registrar, inotarisira kugoverwa kwekero dzeIP mudunhu reAsia-Pacific, yakashuma chiitiko semugumisiro wekuti SQL dump yebasa reWhois, kusanganisira zvakavanzika data uye password hashes, yakaitwa pachena. Zvinokosha kuziva kuti iyi haisi yekutanga kudonha kwedata remunhu muAPNIC - muna 2017, iyo Whois dhatabhesi yakanga yatovepo pachena, zvakare nekuda kwekutarisa kwevashandi.
Mukuita kuunza rutsigiro rweiyo RDAP protocol, yakagadzirirwa kutsiva WHOIS protocol, vashandi veAPNIC vakaisa SQL dump yedhatabhesi inoshandiswa muWhois service muGoogle Cloud cloud storage, asi havana kurambidza kupinda kwairi. Nekuda kwekukanganisa muzvirongwa, iyo SQL dump yaivepo pachena kwemwedzi mitatu uye chokwadi ichi chakaratidzwa chete muna Chikumi 4, apo mumwe wevakazvimirira vekuchengetedza vaongorori akaona izvi uye akazivisa munyori nezve dambudziko.
Iyo SQL dump yaive ne "auth" hunhu hune password hashes yekuchinja Maitainer uye Incident Response Team (IRT) zvinhu, pamwe nerumwe ruzivo rwemutengi rusina kuratidzwa muWhois panguva yemibvunzo yakajairwa (kazhinji yekuwedzera ruzivo rwekusangana uye manotsi nezve mushandisi) . Panyaya yekudzoreredza password, vapambi vakakwanisa kushandura zviri mukati meminda nematanho evaridzi ve IP kero blocks muWhois. Iyo Maintainer chinhu inotsanangura munhu ane basa rekugadzirisa boka remarekodhi akabatanidzwa kuburikidza ne "mnt-by" hunhu, uye chinhu cheIRT chine ruzivo rwekutaurirana kune vatariri vanopindura kune dambudziko zviziviso. Ruzivo nezve password hashing algorithm yakashandiswa haina kupihwa, asi muna 2017, yakare MD5 uye CRYPT-PW algorithms (8-character passwords ane hashes zvichienderana neUNIX crypt function) yakashandiswa kuita hashing.
Mushure mekuzivisa chiitiko, APNIC yakatanga kusetazve mapassword ezvinhu muWhois. Padivi reAPNIC, hapana zviratidzo zvezviito zvisiri pamutemo zvisati zvaonekwa, asi hapana vimbiso yekuti data haina kuwira mumaoko evanorwisa, sezvo pasina matanda akazara ekuwana mafaera muGoogle Cloud. Sezvakaitika mushure mechiitiko chakapfuura, APNIC yakavimbisa kuita ongororo uye kuchinja maitiro etekinoroji kudzivirira kuvuza kwakafanana mune ramangwana.
Source: opennet.ru