Iiprojekthi zeZombie - idatha evuzayo yabasebenzisi nasemva kokufa kwabo

Ndithetha malunga nokuvuza kwedatha yobuqu kwakhona, kodwa ngeli xesha ndiza kukuxelela kancinci malunga nobomi emva kokufa kweeprojekthi ze-IT usebenzisa umzekelo wezinto ezimbini ezifunyenwe mva nje.

Ngexesha lophicotho lokhuseleko lwesiseko sedata, kuyenzeka ukuba ufumane iiseva (indlela yokukhangela oovimba beenkcukacha, Ndabhala kwiblogi) yeeprojekthi ezide (okanye kungekudala) zashiya ihlabathi lethu. Iiprojekthi ezinjalo ziqhubeka nokuxelisa ubomi (umsebenzi), zifana ne-zombies (ukuqokelela idatha yobuqu yabasebenzisi emva kokufa kwabo).

Дисклеймер: вся информация ниже публикуется исключительно в образовательных целях. Автор не получал доступа к персональным данным третьих лиц и компаний. Информация взята либо из открытых источников, либо была предоставлена автору анонимными доброжелателями.

Masiqale ngeprojekthi enegama elikhulu elithi "Iqela likaPutin" (putinteam.ru).

Iseva eneMongoDB evulekileyo yafunyanwa nge-19.04.2019/XNUMX/XNUMX.

Njengoko ubona, iransomware yaba yeyokuqala ukufikelela kwesi siseko:

I-database ayinayo idatha yobuqu ebaluleke kakhulu, kodwa kukho iidilesi ze-imeyile (ngaphantsi kwe-1000), amagama okuqala / iifani, iiphasiwedi ezikhawulezayo, ulungelelwaniso lwe-GPS (ngokucacileyo xa ubhalisa kwii-smartphones), izixeko zokuhlala kunye neefoto zabasebenzisi besayithi abadalileyo. akhawunti yabo yobuqu kuyo.

{ 
    "_id" : ObjectId("5c99c5d08000ec500c21d7e1"), 
    "role" : "USER", 
    "avatar" : "https://fs.putinteam.ru/******sLnzZokZK75V45-1553581654386.jpeg", 
    "firstName" : "Вадим", 
    "lastName" : "", 
    "city" : "Санкт-Петербург", 
    "about" : "", 
    "mapMessage" : "", 
    "isMapMessageVerify" : "0", 
    "pushIds" : [

    ], 
    "username" : "5c99c5d08000ec500c21d7e1", 
    "__v" : NumberInt(0), 
    "coordinates" : {
        "lng" : 30.315868, 
        "lat" : 59.939095
    }
}

{ 
    "_id" : ObjectId("5cb64b361f82ec4fdc7b7e9f"), 
    "type" : "BASE", 
    "email" : "***@yandex.ru", 
    "password" : "c62e11464d1f5fbd54485f120ef1bd2206c2e426", 
    "user" : ObjectId("5cb64b361f82ec4fdc7b7e9e"), 
    "__v" : NumberInt(0)
}

Ezininzi kakhulu inkunkuma ulwazi kunye neerekhodi ezingenanto. Umzekelo, ikhowudi yobhaliso lwencwadana ayijongi ukuba idilesi ye-imeyile ifakiwe, ngoko endaweni yedilesi, ungabhala nantoni na oyifunayo.

Ngokujonga i-copyright kwiwebhusayithi, iprojekthi iye yashiywa ngo-2018. Zonke iinzame zokuqhagamshelana nabameli beprojekthi azizange zibe yimpumelelo. Nangona kunjalo, kukho ukubhaliswa okunqabileyo kwisayithi - kukho ukuxelisa ubomi.

Iprojekthi yesibini ye-zombie ekuhlalutyweni kwam namhlanje kukuqala kweLatvia "Roamer" (roamerapp.com/ru).

Nge-21.04.2019 ka-Epreli, i-XNUMX, isiseko sedatha se-MongoDB esivulekileyo sesicelo seselfowuni "Roamer" safunyanwa kwiseva eJamani.

I-database, i-207 MB ngobukhulu, ifumaneka esidlangalaleni ukususela ngoNovemba 24.11.2018, XNUMX (ngokweShodan)!

Ngayo yonke imiqondiso yangaphandle (engasebenziyo idilesi ye-imeyile yenkxaso yobugcisa, izixhumanisi eziphukileyo kwi-Google Play Store, i-copyright kwiwebhusayithi ukusuka kwi-2016, njl.) isicelo sishiywe ixesha elide.

Ngaxa lithile, phantse yonke imithombo yeendaba yabhala malunga noku kuqaliswa:

• VC:"Isiqalisi saseLatvia iRoamer ngumbulali ojikelezayo»
• ilali: "I-Roamer: Isicelo esinciphisa iindleko zeefowuni ezivela phesheya»
• lifehacker: "Indlela yokunciphisa iindleko zonxibelelwano ngelixa uzulazula ngamaxesha e-10: Roamer»

"Umbulali" ubonakala ezibulele, kodwa nangona efile, uyaqhubeka nokutyhila idatha yobuqu yabasebenzisi bakhe ...

Ngokujonga uhlalutyo lolwazi kwisiseko sedatha, abasebenzisi abaninzi bayaqhubeka nokusebenzisa esi sicelo seselula. Kwiiyure nje ezimbalwa emva kokuba kujongwe, kwavela amangeno amatsha angama-94. Kwaye ixesha elisusela nge-27.03.2019 kaMatshi 10.04.2019 ukuya ku-Epreli 66, XNUMX, abasebenzisi abatsha abangama-XNUMX ababhalise kwisicelo.

Iilogi (ngaphezu kwe-100 amawaka eerekhodi) zesicelo ngolwazi olunje:

• ifowuni yomsebenzisi
• iimpawu zokufikelela kwimbali yokufowuna (ekhoyo ngamakhonkco afana nala: api3.roamerapp.com/call/history/1553XXXXXX)
• imbali yomnxeba (amanani, umnxeba ongenayo okanye ophumayo, iindleko zokufowuna, ubude bexesha, ixesha lokufowuna)
• umsebenzisi weselula
• Iidilesi ze-IP zabasebenzisi
• imodeli yefowuni yomsebenzisi kunye nenguqulelo ye-OS ephathwayo kuyo (umzekelo, I-iPhone 7 12.1.4)
• idilesi ye-imeyile yomsebenzisi
• ibhalansi yeakhawunti yomsebenzisi kunye nemali
• ilizwe labasebenzisi
• indawo yangoku (ilizwe) yomsebenzisi
• iikhowudi zokukhuthaza
• nangaphezulu.

{ 
    "_id" : ObjectId("5c9a49b2a1f7da01398b4569"), 
    "url" : "api3.roamerapp.com/call/history/*******5049", 
    "ip" : "67.80.1.6", 
    "method" : NumberLong(1), 
    "response" : {
        "calls" : [
            {
                "start_time" : NumberLong(1553615276), 
                "number" : "7495*******", 
                "accepted" : false, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(0), 
                "cost" : 0.0, 
                "call_id" : NumberLong(18869601)
            }, 
            {
                "start_time" : NumberLong(1553615172), 
                "number" : "7499*******", 
                "accepted" : true, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(63), 
                "cost" : 0.03, 
                "call_id" : NumberLong(18869600)
            }, 
            {
                "start_time" : NumberLong(1553615050), 
                "number" : "7985*******", 
                "accepted" : false, 
                "incoming" : false, 
                "internet" : true, 
                "duration" : NumberLong(0), 
                "cost" : 0.0, 
                "call_id" : NumberLong(18869599)
            }
        ]
    }, 
    "response_code" : NumberLong(200), 
    "post" : [

    ], 
    "headers" : {
        "Host" : "api3.roamerapp.com", 
        "X-App-Id" : "a9ee0beb8a2f6e6ef3ab77501e54fb7e", 
        "Accept" : "application/json", 
        "X-Sim-Operator" : "311480", 
        "X-Wsse" : "UsernameToken Username="/******S19a2RzV9cqY7b/RXPA=", PasswordDigest="******NTA4MDhkYzQ5YTVlZWI5NWJkODc5NjQyMzU2MjRjZmIzOWNjYzY3MzViMTY1ODY4NDBjMWRkYjdiZTQxOGI4ZDcwNWJmOThlMTA1N2ExZjI=", Nonce="******c1MzE1NTM2MTUyODIuNDk2NDEz", Created="Tue, 26 Mar 2019 15:48:01 GMT"", 
        "Accept-Encoding" : "gzip, deflate", 
        "Accept-Language" : "en-us", 
        "Content-Type" : "application/json", 
        "X-Request-Id" : "FB103646-1B56-4030-BF3A-82A40E0828CC", 
        "User-Agent" : "Roamer;iOS;511;en;iPhone 7;12.1.4", 
        "Connection" : "keep-alive", 
        "X-App-Build" : "511", 
        "X-Lang" : "EN", 
        "X-Connection" : "WiFi"
    }, 
    "created_at" : ISODate("2019-03-26T15:48:02.583+0000"), 
    "user_id" : "888689"
}

Ngokuqinisekileyo, kwakungenakwenzeka ukuqhagamshelana nabanini besiseko. Abafowunelwa kwisiza abasebenzi, imiyalezo kwimidiya yoluntu. akukho mntu uphendula kwiinethiwekhi.

I-app isafumaneka kwi-Apple App Store (itunes.apple.com/app/roamer-roaming-killer/id646368973).

Iindaba malunga nokuvuza kolwazi kunye nabangaphakathi banokuhlala befumaneka kwijelo lam leTelegram "Ulwazi luyavuza" https://t.me/dataleak.

umthombo: www.habr.com