{"id":34790,"date":"2019-10-31T22:00:24","date_gmt":"2019-10-31T19:00:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe\/"},"modified":"2019-10-31T22:00:24","modified_gmt":"2019-10-31T19:00:24","slug":"opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","title":{"rendered":"\u00c5terigen hundratusentals betalningar fr\u00e5n medborgare till GIBDD och FSSP var offentligt tillg\u00e4ngliga","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kom ih\u00e5g att jag <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/448440\/\">skrev p\u00e5 Habr\u00e9<\/a><\/noindex> och p\u00e5 min egen <noindex><a rel=\"nofollow\" href=\"http:\/\/tele.click\/dataleak\/961\">Telegram-kanal<\/a><\/noindex>, hur detaljer om betalningar till GIBDD och FSSP av anv\u00e4ndare av webbplatser hamnade i \u00f6ppen tillg\u00e5ng. <em>oplatagibdd.rf<\/em>, <em>paygibdd.ru<\/em>, <em>gos-oplata.ru<\/em>, <em>b\u00f6ter.net<\/em> och <em>oplata-fssp.ru<\/em>?<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"\u00c5terigen hundratusentals betalningar fr\u00e5n medborgare till GIBDD och FSSP var offentligt tillg\u00e4ngliga\" src=\"\/wp-content\/uploads\/2019\/05\/3f0928a00144c08cb608032ad7550ae5.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Men skratta inte, det h\u00e4r \u00e4r verkligen ingen sk\u00e4mt \u2014 samma server med data fr\u00e5n samma system blev \u00e5terigen \u00f6ppen f\u00f6r hela v\u00e4rlden.<\/p>\n<p><\/p>\n<p>N\u00e5v\u00e4l, l\u00e5t oss b\u00f6rja reda ut \u2026<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<pre><code class=\"plaintext\">Opublicerat meddelande: all information nedan publiceras uteslutande i utbildningssyfte. F\u00f6rfattaren har inte f\u00e5tt tillg\u00e5ng till personuppgifter om tredje part eller f\u00f6retag. Informationen \u00e4r h\u00e4mtad antingen fr\u00e5n \u00f6ppna k\u00e4llor eller har tillhandah\u00e5llits f\u00f6rfattaren av anonyma v\u00e4lvilliga k\u00e4llor.<\/code><\/pre>\n<p><\/p>\n<p>F\u00f6rst lite p\u00e5minnelse om h\u00e4ndelsef\u00f6rloppet:<\/p>\n<p><\/p>\n<ul>\n<li>Den 12 april 2019 (p\u00e5 natten) uppt\u00e4cktes en Elasticsearch-server som inte kr\u00e4vde autentisering f\u00f6r anslutning.<\/li>\n<li>Den 13 april 2019 (p\u00e5 morgonen) skickades en avisering till server\u00e4gare.<\/li>\n<li>Den 13 april 2019 (p\u00e5 dagen) togs servern \"tyst\" bort fr\u00e5n \u00f6ppen tillg\u00e5ng.<\/li>\n<\/ul>\n<p><\/p>\n<p>Vid f\u00f6rsta st\u00e4ngningen av servern s\u00e5g Elasticsearch-indexen ut s\u00e5 h\u00e4r:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"\u00c5terigen hundratusentals betalningar fr\u00e5n medborgare till GIBDD och FSSP var offentligt tillg\u00e4ngliga\" src=\"\/wp-content\/uploads\/2019\/05\/7f2ee67a67a4caf7c7e0eebb0f50b33d.png\" style=\"display:block;margin: 0 auto;\" \/> <\/p>\n<p><\/p>\n<p>Och den 21 maj 2019 runt klockan 16:00 (MSK) dyker samma Elasticsearch-server, med samma (plus nya) index \u00e5terigen upp i \u00f6ppen tillg\u00e5ng:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"\u00c5terigen hundratusentals betalningar fr\u00e5n medborgare till GIBDD och FSSP var offentligt tillg\u00e4ngliga\" src=\"\/wp-content\/uploads\/2019\/05\/f915e575967ca597f19e913944dbc3dc.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Jag kunde inte tro mina \u00f6gon n\u00e4r jag s\u00e5g (direkt efter presentationen p\u00e5 <em>PHDays<\/em> om uppt\u00e4ckten av \u00f6ppna databaser) en avisering fr\u00e5n v\u00e5r <noindex><a rel=\"nofollow\" href=\"https:\/\/www.devicelock.com\/ru\/data-breach-intelligence\/\">DeviceLock Data Breach Intelligence<\/a><\/noindex>. \u00c4rligt talat, f\u00f6rsta tanken var att det var n\u00e5got systemfel.<\/p>\n<p><\/p>\n<p>Men nej, det var inget fel, och efter att jag dubbelkollade allt manuellt, skickade jag kl. 01:25 den 22 maj 2019 \u00e5terigen en avisering till samma adresser som f\u00f6rsta g\u00e5ngen.<\/p>\n<p><\/p>\n<p>Fr\u00e5n den f\u00f6rsta st\u00e4ngningen skannades denna server av Shodan 11 g\u00e5nger, och fram till den 21 maj var Elasticsearch p\u00e5 den st\u00e4ngt.<\/p>\n<p><\/p>\n<p>F\u00f6rst den 24 maj 2019 p\u00e5 morgonen f\u00f6rsvann denna Elasticsearch fr\u00e5n \u00f6ppen tillg\u00e5ng f\u00f6r andra g\u00e5ngen. Under denna tid har indexen \u00f6kat ordentligt:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"\u00c5terigen hundratusentals betalningar fr\u00e5n medborgare till GIBDD och FSSP var offentligt tillg\u00e4ngliga\" src=\"\/wp-content\/uploads\/2019\/05\/889a939c98424e316308b41f0392e7ae.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Och om vi tittar p\u00e5 datan (bara betydelsefull information som inneh\u00e5ller personuppgifter om medborgare) i indexen fr\u00e5n den 1:a till den 22:a maj, ser bilden ut s\u00e5 h\u00e4r:<\/p>\n<p><\/p>\n<ul>\n<li>127,525 poster i indexet <em>paygibdd<\/em> <\/li>\n<li>49,627 poster i indexet <em>shtrafov-net<\/em><\/li>\n<li>162,282 poster i indexet <em>oplata-fssp<\/em><\/li>\n<li>220,201 poster i indexet <em>gosoplata<\/em><\/li>\n<\/ul>\n<p><\/p>\n<p>Exempeldata fr\u00e5n indexet <em>gosoplata<\/em>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"\u00c5terigen hundratusentals betalningar fr\u00e5n medborgare till GIBDD och FSSP var offentligt tillg\u00e4ngliga\" src=\"\/wp-content\/uploads\/2019\/05\/8f596de149b6c6a4bf7d06abfcc90e2c.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Exempeldata fr\u00e5n indexet <em>paygibdd<\/em>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"\u00c5terigen hundratusentals betalningar fr\u00e5n medborgare till GIBDD och FSSP var offentligt tillg\u00e4ngliga\" src=\"\/wp-content\/uploads\/2019\/05\/20c88b7f644f551775bd73d02f6c4dc6.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Och pricken \u00f6ver i:et blev ett brev fr\u00e5n en av adresserna som jag skickade aviseringar till:<\/p>\n<p><\/p>\n<blockquote><p>Vi har mottagit ditt brev om \u00f6ppet ElasticSearch \u2014 tack f\u00f6r informationen, databasen har st\u00e4ngts. Systemadministrat\u00f6ren som \u00e5ter \u00f6ppnade \u00e5tkomsten har blivit avskedad. Juridiska tj\u00e4nsten f\u00f6rbereder att skicka en anm\u00e4lan till inrikesministeriet i Republiken Tatarstan om tecken p\u00e5 en brottslig handling av systemadministrat\u00f6ren enligt artiklar 272 och 273 i den ryska strafflagen.<\/p><\/blockquote>\n<p>Nyheter om datal\u00e4ckor och visselbl\u00e5sare kan alltid hittas p\u00e5 min Telegram-kanal \u00ab<noindex><a rel=\"nofollow\" href=\"http:\/\/tele.click\/dataleak\">Dataintr\u00e5ng<\/a><\/noindex>\u00bb: <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/dataleak\">https:\/\/t.me\/dataleak<\/a><\/noindex>.<\/p>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/454048\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0432 \u043f\u043e\u043b\u044c\u0437\u0443 \u0413\u0418\u0411\u0414\u0414 \u0438 \u0424\u0421\u0421\u041f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0430\u0439\u0442\u043e\u0432 \u043e\u043f\u043b\u0430\u0442\u0430\u0433\u0438\u0431\u0434\u0434.\u0440\u0444, paygibdd.ru, gos-oplata.ru, \u0448\u0442\u0440\u0430\u0444\u043e\u0432.net \u0438 oplata-fssp.ru? \u0422\u043e\u043b\u044c\u043a\u043e \u043d\u0435 \u043d\u0430\u0434\u043e \u0441\u043c\u0435\u044f\u0442\u044c\u0441\u044f, \u044d\u0442\u043e \u0432\u043e\u0432\u0441\u0435 \u043d\u0435 \u0448\u0443\u0442\u043a\u0430 \u2014 \u0442\u043e\u0442 \u0436\u0435 \u0441\u0430\u043c\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0442\u043e\u0439 \u0436\u0435 \u0441\u0430\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0434\u043b\u044f \u0432\u0441\u0435\u0433\u043e \u043c\u0438\u0440\u0430. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26212,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34790","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u044f\u0442\u044c \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0433\u0440\u0430\u0436\u0434\u0430\u043d \u0432 \u0413\u0418\u0411\u0414\u0414 \u0438 \u0424\u0421\u0421\u041f \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:00:24+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:00:24+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00c5terigen hundratusentals medborgares betalningar till GIBDD och FSSP var i \u00f6ppen tillg\u00e5ng | ProHoster","description":"Kom ih\u00e5g att jag skrev p\u00e5 Habr\u00e9 och p\u00e5 min Telegram-kanal, hur.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u044f\u0442\u044c \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439 \u0433\u0440\u0430\u0436\u0434\u0430\u043d \u0432 \u0413\u0418\u0411\u0414\u0414 \u0438 \u0424\u0421\u0421\u041f \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438\u0441\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 | ProHoster","og:description":"\u041f\u043e\u043c\u043d\u0438\u0442\u0435 \u044f \u043f\u0438\u0441\u0430\u043b \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u0438 \u0443 \u0441\u0435\u0431\u044f \u0432 Telegram-\u043a\u0430\u043d\u0430\u043b\u0435, \u043a\u0430\u043a.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/opyat-sotni-tysyach-platezhej-grazhdan-v-gibdd-i-fssp-nahodilis-v-otkrytom-dostupe","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:24+00:00","article:modified_time":"2019-10-31T19:00:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34790","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:15:37","updated":"2026-01-21 20:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/34790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=34790"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/34790\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/26212"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=34790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=34790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=34790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}