Bekeng e fetileng Kommersant , hore "metheo ea bareki ba Street Beat le Sony Center e ne e le sebakeng sa sechaba," empa ha e le hantle ntho e 'ngoe le e' ngoe e mpe haholo ho feta e ngotsoeng sehloohong sena.
Ke se ke entse tlhahlobo e tebileng ea tekheniki mabapi le leak ena. , kahoo mona re tla feta feela lintlha tse kholo.
Дисклеймер: вся информация ниже публикуется исключительно в образовательных целях. Автор не получал доступа к персональным данным третьих лиц и компаний. Информация взята либо из открытых источников, либо была предоставлена автору анонимными доброжелателями.Seva e 'ngoe ea Elasticsearch e nang le li-index e ne e fumaneha mahala:
- graylog2_0
- ya readme
- unauth_text
- http:
- graylog2_1
В graylog2_0 e ne e na le mapolanka ho tloha ka la 16.11.2018 Pulungoana 2019 ho isa Hlakubele XNUMX, le ho graylog2_1 - litlaleho ho tloha ka Hlakubele 2019 ho isa 04.06.2019/XNUMX/XNUMX. Ho fihlela phihlello ea Elasticsearch e koetsoe, palo ea lirekoto ho graylog2_1 hola.
Ho latela enjine ea ho batla ea Shodan, Elasticsearch ena esale e fumaneha mahala ho tloha ka la 12.11.2018 Pulungoana 16.11.2018 (joalo ka ha ho ngoliloe kaholimo, likenyelletso tsa pele tsa marako li ngotsoe ka la XNUMX Pulungoana XNUMX).
Likutung, tšimong gl2_remote_ip Liaterese tsa IP 185.156.178.58 le 185.156.178.62 li hlalositsoe, ka mabitso a DNS srv2.inventive.ru и srv3.inventive.ru:
Ke tsebisitse Sehlopha sa Inventive Retail (www.inventive.ru) mabapi le bothata ba 04.06.2019/18/25 ka 22:30 (nako ea Moscow) 'me ka XNUMX:XNUMX seva "ka khutso" se ile sa nyamela ho fihlella sechaba.
Li-log tse teng (lintlha tsohle ke likhakanyo, likopi ha lia ka tsa tlosoa lipalong, kahoo palo ea tlhahisoleseling ea 'nete e lutiloeng e ka fokotseha):
- liaterese tsa imeile tse fetang limilione tse 3 tsa bareki ba tsoang mabenkeleng a re:Store, Samsung, Street Beat le Lego
- dinomoro tsa mehala tse fetang dimilione tse 7 tsa bareki ho tswa mabenkeleng a re:Store, Sony, Nike, Street Beat le Lego
- ho feta likete tse 21 tsa ho kena/li-password tsa li-account tsa bareki ba mabenkele a Sony le Street Beat.
- lirekoto tse ngata tse nang le linomoro tsa mohala le lengolo-tsoibila li ne li boetse li e-na le mabitso a felletseng (hangata ka Selatine) le linomoro tsa likarete tsa botšepehi.
Mohlala ho tsoa ho logi e amanang le moreki oa lebenkele la Nike (boitsebiso bohle ba bohlokoa bo nketsoe sebaka ke litlhaku tsa "X"):
"message": "{"MESSAGE":"[URI] /personal/profile/[МЕТОД ЗАПРОСА] contact[ДАННЫЕ POST] Arrayn(n [contact[phone]] => +7985026XXXXn [contact[email]] => [email protected] [contact[channel]] => n [contact[subscription]] => 0n)n[ДАННЫЕ GET] Arrayn(n [digital_id] => 27008290n [brand] => NIKEn)n[ОТВЕТ СЕРВЕРА] Код ответа - 200[ОТВЕТ СЕРВЕРА] stdClass Objectn(n [result] => successn [contact] => stdClass Objectn (n [phone] => +7985026XXXXn [email] => [email protected] [channel] => 0n [subscription] => 0n )nn)n","DATE":"31.03.2019 12:52:51"}",Mona ke mohlala oa kamoo li-logins le li-password tse tsoang liak'haonteng tsa bareki tsa marang-rang li bolokiloeng sc-store.ru и street-beat.ru:
"message":"{"MESSAGE":"[URI]/action.php?a=login&sessid=93164e2632d9bd47baa4e51d23ac0260&login=XXX%40gmail.com&password=XXX&remember=Y[МЕТОД ЗАПРОСА] personal[ДАННЫЕ GET] Arrayn(n [digital_id] => 26725117n [brand]=> SONYn)n[ОТВЕТ СЕРВЕРА] Код ответа - [ОТВЕТ СЕРВЕРА] ","DATE":"22.04.2019 21:29:09"}"Polelo ea semmuso ea IRG mabapi le ketsahalo ena e ka baloa , karolo ea eona:
Ha rea ka ra hlokomoloha ntlha ena mme ra fetola li-password ho li-account tsa bareki ho tsa nakoana, e le ho qoba tšebeliso e ka bang teng ea data e tsoang liak'haonteng tsa botho bakeng sa merero ea bolotsana. Khamphani ha e netefatse ho lutla ha data ea hau ea bareki ba street-beat.ru. Merero eohle ea Inventive Retail Group e ile ea hlahlojoa hape. Ha ho litšokelo ho data ea bareki e fumanoeng.
Ho hobe hore IRG ha e tsebe ho tseba hore na ke eng e lutlileng le e sa kang ea tsoa. Mohlala ke ona ho tsoa lenaneng le amanang le moreki oa lebenkele la Street Beat:
"message": "{"MESSAGE":"'DATA' => ['URI' => /local/components/multisite/order/ajax.php,'МЕТОД ЗАПРОСА' = contact,'ДАННЫЕ POST' = Arrayn(n [contact[phone]] => 7915545XXXXn)n,'ДАННЫЕ GET' =nttArrayn(n [digital_id] => 27016686n [brand] => STREETBEATn)n,'ОТВЕТ СЕРВЕРА' = 'Код ответа - '200,'RESPONCE' = stdClass Objectn(n [result] => successn [contact] => stdClass Objectn (n [phone] => +7915545XXXXn [email] => [email protected]","Дата":"01.04.2019 08:33:48"}",Leha ho le joalo, ha re feteleng litabeng tse mpe haholo 'me re hlalose hore na ke hobane'ng ha sena e le ho lutla ha data ea hau ea bareki ba IRG.
Haeba u sheba ka hloko li-index tsa Elasticsearch ena e fumanehang mahala, u tla hlokomela mabitso a mabeli ho tsona: ya readme и unauth_text. Ena ke lets'oao le ikhethang la e 'ngoe ea lingoloa tse ngata tsa ransomware. E amme li-server tse fetang likete tse 4 tsa Elasticsearch lefatšeng ka bophara. Litaba ya readme e shebahala tjena:
"ALL YOUR INDEX AND ELASTICSEARCH DATA HAVE BEEN BACKED UP AT OUR SERVERS, TO RESTORE SEND 0.1 BTC TO THIS BITCOIN ADDRESS 14ARsVT9vbK4uJzi78cSWh1NKyiA2fFJf3 THEN SEND AN EMAIL WITH YOUR SERVER IP, DO NOT WORRY, WE CAN NEGOCIATE IF CAN NOT PAY"Ha seva se nang le li-log tsa IRG se ne se fumaneha ka bolokolohi, script ea thekollo e ile ea fumana boitsebiso ba bareki 'me, ho latela molaetsa oo e o siileng, data e ile ea kopitsoa.
Ho phaella moo, ha ke na pelaelo ea hore database ena e ile ea fumanoa pele ho 'na' me e ne e se e kopitsoe. Nka ba ka re ke na le bonnete ba taba ena. Ha ho na lekunutu la hore li-database tse joalo tse bulehileng li batlisisoa ka boomo le ho phunngoa.
Litaba tse mabapi le ho lutla ha tlhahisoleseling le batho ba kahare li ka lula li fumaneha mocha oa ka oa Telegraph "" .
Source: www.habr.com