{"id":33578,"date":"2019-10-31T21:53:23","date_gmt":"2019-10-31T18:53:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vse-vashi-analizy-v-otkrytom-dostupe\/"},"modified":"2019-10-31T21:53:23","modified_gmt":"2019-10-31T18:53:23","slug":"vse-vashi-analizy-v-otkrytom-dostupe","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vse-vashi-analizy-v-otkrytom-dostupe","title":{"rendered":"T\u00eb gjitha analizat tuaja n\u00eb akses t\u00eb hapur","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u00ebrsh\u00ebndetje s\u00ebrish! Kam p\u00ebrs\u00ebri nj\u00eb baz\u00eb t\u00eb hapur me t\u00eb dh\u00ebna mjek\u00ebsore p\u00ebr ju. Ju kujtoj se s\u00eb fundmi k\u00ebtu ishin tre artikujt e mi mbi k\u00ebt\u00eb tem\u00eb: shkelja e t\u00eb dh\u00ebnave personale t\u00eb pacient\u00ebve dhe mjek\u00ebve nga sh\u00ebrbimi mjek\u00ebsor online DOC+<\/a><\/noindex>, mungesa e siguris\u00eb s\u00eb sh\u00ebrbimit 'Doktor Rruga'<\/a><\/noindex> dhe shkelja e t\u00eb dh\u00ebnave t\u00eb stacioneve t\u00eb ndihm\u00ebs s\u00eb shpejt\u00eb mjek\u00ebsore<\/a><\/noindex>.<\/p>\n

<\/p>\n

\"T\u00eb<\/p>\n

<\/p>\n

K\u00ebt\u00eb her\u00eb, n\u00eb qasje t\u00eb hapur doli nj\u00eb server Elasticsearch me log t\u00eb sistemit IT mjek\u00ebsor t\u00eb rrjetit t\u00eb laborator\u00ebve 'Qendra e Diagnostik\u00ebs Molekulare<\/em>' (CMD, www.cmd-online.ru).<\/p>\n

<\/a><\/noindex><\/p>\n

Koh\u00ebzgjatja: t\u00eb gjitha informacionet m\u00eb posht\u00eb publikohen ekskluzivisht p\u00ebr q\u00ebllime edukative. Autori nuk ka pasur qasje n\u00eb t\u00eb dh\u00ebnat personale t\u00eb t\u00eb tret\u00ebve dhe kompani. Informacioni \u00ebsht\u00eb marr\u00eb ose nga burime t\u00eb hapura, ose u \u00ebsht\u00eb dh\u00ebn\u00eb autorit nga miq\u00ebsor\u00eb anonim\u00eb.<\/code><\/p>\n

<\/p>\n

Serveri u zbulua n\u00eb m\u00ebngjesin e 1 prillit dhe kjo nuk m\u00eb dukej aspak qesharake. Njoftimi p\u00ebr problemin iu d\u00ebrgua CMD rreth or\u00ebs 10 t\u00eb mengjesit (MSK) dhe rreth or\u00ebs 15:00 baza u b\u00eb e pa aksesueshme. <\/p>\n

<\/p>\n

Sipas k\u00ebrkuesit Shodan, ky server ka qen\u00eb p\u00ebr her\u00eb t\u00eb par\u00eb n\u00eb qasje t\u00eb hapur m\u00eb 09.03.2019. P\u00ebr m\u00ebnyr\u00ebn se si zbulohen bazat e hapura t\u00eb t\u00eb dh\u00ebnave Elasticsearch<\/a><\/noindex>, kam shkruar nj\u00eb artikull t\u00eb ve\u00e7ant\u00eb.<\/p>\n

<\/p>\n

Nga log-\u00ebt mund t\u00eb merret informacione tejet t\u00eb ndjeshme, duke p\u00ebrfshir\u00eb Emrat e plot\u00eb, gjinin\u00eb, datat e lindjes t\u00eb pacient\u00ebve, emrat e plot\u00eb t\u00eb mjek\u00ebve, \u00e7mimet e studimeve, t\u00eb dh\u00ebnat e studimeve, skedar\u00ebt me rezultatet e skriningut<\/strong> dhe shum\u00eb t\u00eb tjera.<\/p>\n

<\/p>\n

Shembulli i log-ut me rezultatet e analizave t\u00eb pacientit:<\/p>\n

<\/p>\n

\"Pasaporti0423BF97FA5E-1DWW98675708386841791018.03.2019ROOS RU.13SK03.006012iVBORw0KGgoAAAANSUhEUgAABfoAAAfuCAIAAAArOR8rAAD\/\/0lEQVR4Xuy9P7BtQ7u+\/e3oECF6iRAhQoQI0SZCtIkQIdpEiBCxI0SIECFiV50qRKg6VYgQIUKEiDfiRL7rnPtXz+nqHnPMsfb6s+cc61rBqjl79Oh++uoe\/eceT\/c8888\/\/\/<\/code><\/pre>\n
<\/p>\n
Kam vendosur t\u00eb gjitha t\u00eb dh\u00ebnat e ndjeshme me simbolin \u00abX\u00bb. N\u00eb t\u00eb v\u00ebrtet\u00eb, t\u00eb gjitha ishin ruajtur n\u00eb form\u00eb t\u00eb hapur.<\/em><\/p>\n
<\/p>\n
Nga k\u00ebto log-e, leht\u00ebsisht (me dekodimin nga Base64) mund t\u00eb merrnim skedar\u00eb PNG me rezultatet e skirningut, tashm\u00eb n\u00eb nj\u00eb form\u00eb t\u00eb leht\u00eb p\u00ebr t'u lexuar:<\/p>\n
<\/p>\n
\"T\u00eb <\/p>\n
<\/p>\n
T\u00eb dh\u00ebnat n\u00eb formatin log tejkaluan 400 MB dhe p\u00ebrmbanin m\u00eb shum\u00eb se nj\u00eb milion regjistrime. Sigurisht, \u00e7do regjistrim nuk p\u00ebrfaq\u00ebsonte t\u00eb dh\u00ebna t\u00eb nj\u00eb pacienti unik.<\/p>\n
<\/p>\n
P\u00ebrgjigjja zyrtare nga CMD: <\/p>\n
<\/p>\n
D\u00ebshirojm\u00eb t'ju fal\u00ebnderojm\u00eb p\u00ebr informacionin e d\u00ebrguar me koh\u00eb m\u00eb 01.04.2019 n\u00eb lidhje me identifikimin e nj\u00eb vulnerabiliteti n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave p\u00ebr regjistrimin dhe ruajtjen e gabimeve n\u00eb Elasticsearch. <\/p>\n
N\u00eb baz\u00eb t\u00eb k\u00ebtij informacioni, stafi yn\u00eb n\u00eb bashk\u00ebpunim me specialist\u00ebt p\u00ebrkat\u00ebs kufizoi aksesin n\u00eb baz\u00ebn e p\u00ebrmendur. Gabimi n\u00eb d\u00ebrgimin e informacionit konfidencial n\u00eb baz\u00ebn teknike u korrigjua.<\/p>\n
Gjat\u00eb shqyrtimit t\u00eb incidentit u zbulua se shfaqja e k\u00ebsaj baze me regjistrat e gabimeve n\u00eb hap\u00ebsir\u00eb t\u00eb hapur ndodhi p\u00ebr shkak t\u00eb nj\u00eb faktori njer\u00ebzor. Aksesi n\u00eb t\u00eb dh\u00ebna u mbyll me koh\u00eb m\u00eb 01.04.2019. <\/p>\n
Aktualisht, aktivitete t\u00eb brendshme dhe nga specialist\u00eb t\u00eb jasht\u00ebm po zhvillohen p\u00ebr nj\u00eb audit t\u00eb shtuar t\u00eb infrastruktur\u00ebs IT p\u00ebr mbrojtjen e t\u00eb dh\u00ebnave. <\/p>\n
Organizata jon\u00eb ka zhvilluar nj\u00eb rregullore t\u00eb ve\u00e7ant\u00eb p\u00ebr pun\u00ebn me t\u00eb dh\u00ebnat personale dhe sistemin e niveleve t\u00eb p\u00ebrgjegj\u00ebsis\u00eb s\u00eb stafit. <\/p>\n
Infrastruktura aktuale e programit parashikon p\u00ebrdorimin e baz\u00ebs Elasticsearch p\u00ebr ruajtjen e gabimeve. P\u00ebr t\u00eb rritur besueshm\u00ebrin\u00eb e pun\u00ebs s\u00eb disa sistemeve, do t\u00eb realizohet migrimi i server\u00ebve p\u00ebrkat\u00ebs n\u00eb Qendr\u00ebn e T\u00eb Dh\u00ebnave t\u00eb partnerit ton\u00eb, n\u00eb nj\u00eb mjedis t\u00eb certifikuar softuerik-harduerik. <\/p>\n
Ju fal\u00ebnderojm\u00eb p\u00ebr informacionin e dh\u00ebn\u00eb n\u00eb koh\u00eb.<\/p><\/blockquote>\n
Lajmet p\u00ebr rrjedhjet e informacionit dhe p\u00ebr insider\u00ebt mund t\u00eb gjenden gjithmon\u00eb n\u00eb kanalin tim t\u00eb Telegramit \"Shkelje informacioni<\/a><\/noindex>\u00bb.<\/p>\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0418 \u0441\u043d\u043e\u0432\u0430 \u0437\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435! \u0423 \u043c\u0435\u043d\u044f \u043e\u043f\u044f\u0442\u044c \u043d\u0430\u0448\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u0432\u0430\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u0430\u044f \u0431\u0430\u0437\u0430 \u0441 \u043c\u0435\u0434\u0438\u0446\u0438\u043d\u0441\u043a\u0438\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438. \u041d\u0430\u043f\u043e\u043c\u043d\u044e, \u0447\u0442\u043e \u0441\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0442\u0443\u0442 \u0431\u044b\u043b\u043e \u0442\u0440\u0438 \u043c\u043e\u0438\u0445 \u0441\u0442\u0430\u0442\u044c\u0438 \u043d\u0430 \u044d\u0442\u0443 \u0442\u0435\u043c\u0443: \u0443\u0442\u0435\u0447\u043a\u0430 \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u0446\u0438\u0435\u043d\u0442\u043e\u0432 \u0438 \u0432\u0440\u0430\u0447\u0435\u0439 \u0438\u0437 \u043c\u0435\u0434\u0438\u0446\u0438\u043d\u0441\u043a\u043e\u0433\u043e \u043e\u043d\u043b\u0430\u0439\u043d-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 DOC+, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u00ab\u0414\u043e\u043a\u0442\u043e\u0440 \u0440\u044f\u0434\u043e\u043c\u00bb \u0438 \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439 \u0441\u043a\u043e\u0440\u043e\u0439 \u043c\u0435\u0434\u0438\u0446\u0438\u043d\u0441\u043a\u043e\u0439 \u043f\u043e\u043c\u043e\u0449\u0438. \u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0441\u0435\u0440\u0432\u0435\u0440 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25272,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33578","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47T\u00eb gjitha analizat tuaja n\u00eb hap\u00ebsir\u00eb t\u00eb hapur | ProHoster","description":"P\u00ebrs\u00ebri p\u00ebrsh\u00ebndetje! P\u00ebrs\u00ebri kam gjetur nj\u00eb baz\u00eb t\u00eb hapur me t\u00eb dh\u00ebna mjek\u00ebsore p\u00ebr ju.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vse-vashi-analizy-v-otkrytom-dostupe","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0441\u0435 \u0432\u0430\u0448\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u044b \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 | ProHoster","og:description":"\u0418 \u0441\u043d\u043e\u0432\u0430 \u0437\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435! \u0423 \u043c\u0435\u043d\u044f \u043e\u043f\u044f\u0442\u044c \u043d\u0430\u0448\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u0432\u0430\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u0430\u044f \u0431\u0430\u0437\u0430 \u0441 \u043c\u0435\u0434\u0438\u0446\u0438\u043d\u0441\u043a\u0438\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vse-vashi-analizy-v-otkrytom-dostupe","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:53:23+00:00","article:modified_time":"2019-10-31T18:53:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33578","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 15:51:39","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:38:09","updated":"2026-01-21 15:51:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/33578","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=33578"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/33578\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/25272"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=33578"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=33578"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=33578"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}