Mo n sọrọ nipa awọn n jo data ti ara ẹni lẹẹkansi, ṣugbọn ni akoko yii Emi yoo sọ fun ọ diẹ nipa igbesi aye lẹhin ti awọn iṣẹ IT nipa lilo apẹẹrẹ ti awọn wiwa aipẹ meji.
Lakoko iṣayẹwo aabo data data, o nigbagbogbo ṣẹlẹ pe o ṣawari awọn olupin (, Mo ti kowe ni bulọọgi kan) ti o jẹ ti awọn iṣẹ akanṣe ti o ti pẹ (tabi kii ṣe igba pipẹ) ti lọ kuro ni agbaye wa. Iru awọn iṣẹ akanṣe paapaa tẹsiwaju lati farawe igbesi aye (iṣẹ), ti o dabi awọn Ebora (gbigba data ti ara ẹni ti awọn olumulo lẹhin iku wọn).
Дисклеймер: вся информация ниже публикуется исключительно в образовательных целях. Автор не получал доступа к персональным данным третьих лиц и компаний. Информация взята либо из открытых источников, либо была предоставлена автору анонимными доброжелателями.Jẹ ki a bẹrẹ pẹlu iṣẹ akanṣe pẹlu orukọ ti npariwo "Ẹgbẹ Putin" (putinteam.ru).
Olupin kan pẹlu MongoDB ṣiṣi silẹ ni a ṣe awari ni 19.04.2019/XNUMX/XNUMX.
Gẹgẹbi o ti le rii, ransomware ni akọkọ lati de ipilẹ yii:
Ibi ipamọ data ko ni awọn data ti ara ẹni ti o niyelori pataki, ṣugbọn awọn adirẹsi imeeli wa (kere ju 1000), awọn orukọ akọkọ / awọn orukọ ibilẹ, awọn ọrọ igbaniwọle ti o hashed, awọn ipoidojuko GPS (ti o han gbangba nigbati o forukọsilẹ lati awọn fonutologbolori), awọn ilu ibugbe ati awọn fọto ti awọn olumulo aaye ti o ṣẹda. iroyin ti ara wọn lori rẹ.
{
"_id" : ObjectId("5c99c5d08000ec500c21d7e1"),
"role" : "USER",
"avatar" : "https://fs.putinteam.ru/******sLnzZokZK75V45-1553581654386.jpeg",
"firstName" : "Вадим",
"lastName" : "",
"city" : "Санкт-Петербург",
"about" : "",
"mapMessage" : "",
"isMapMessageVerify" : "0",
"pushIds" : [
],
"username" : "5c99c5d08000ec500c21d7e1",
"__v" : NumberInt(0),
"coordinates" : {
"lng" : 30.315868,
"lat" : 59.939095
}
}
{
"_id" : ObjectId("5cb64b361f82ec4fdc7b7e9f"),
"type" : "BASE",
"email" : "***@yandex.ru",
"password" : "c62e11464d1f5fbd54485f120ef1bd2206c2e426",
"user" : ObjectId("5cb64b361f82ec4fdc7b7e9e"),
"__v" : NumberInt(0)
}Opo yanturu idoti alaye ati awọn igbasilẹ ofo. Fun apẹẹrẹ, koodu ṣiṣe alabapin iwe iroyin ko ṣayẹwo pe a ti tẹ adirẹsi imeeli sii, nitorinaa dipo adirẹsi, o le kọ ohunkohun ti o fẹ.
Ni idajọ nipasẹ aṣẹ-lori lori oju opo wẹẹbu, a kọ iṣẹ naa silẹ ni ọdun 2018. Gbogbo igbiyanju lati kan si awọn aṣoju ise agbese ko ni aṣeyọri. Sibẹsibẹ, awọn iforukọsilẹ toje wa lori aaye naa - imitation ti igbesi aye wa.
Iṣẹ akanṣe Zombie keji ninu itupalẹ mi loni ni ibẹrẹ Latvia “Roamer” (roamerapp.com/ru).
Ni Oṣu Kẹrin Ọjọ 21.04.2019, Ọdun XNUMX, data MongoDB ṣiṣi silẹ ti ohun elo alagbeka “Roamer” ni a ṣe awari lori olupin ni Germany.
Ibi ipamọ data, 207 MB ni iwọn, ti wa ni gbangba lati Oṣu kọkanla ọjọ 24.11.2018, ọdun XNUMX (gẹgẹbi Shodan)!
Nipa gbogbo awọn ami ita (ti ko ṣiṣẹ adirẹsi imeeli atilẹyin imọ-ẹrọ, awọn ọna asopọ fifọ si ile itaja Google Play, aṣẹ lori oju opo wẹẹbu lati ọdun 2016, ati bẹbẹ lọ) ohun elo naa ti kọ silẹ fun igba pipẹ.
Ni akoko kan, o fẹrẹ jẹ pe gbogbo awọn media thematic kowe nipa ibẹrẹ yii:
- VC:"Ibẹrẹ Latvia Roamer jẹ apaniyan lilọ kiri»
- abule:"Roamer: Ohun elo ti o din iye owo awọn ipe lati odi»
- lifehacker:"Bii o ṣe le dinku awọn idiyele ibaraẹnisọrọ lakoko lilọ kiri nipasẹ awọn akoko 10: Roamer»
"Apaniyan" dabi pe o ti pa ara rẹ, ṣugbọn paapaa nigba ti o ku o tẹsiwaju lati ṣafihan data ti ara ẹni ti awọn olumulo rẹ ...
Ni idajọ nipasẹ itupalẹ alaye ninu ibi ipamọ data, ọpọlọpọ awọn olumulo tẹsiwaju lati lo ohun elo alagbeka yii. Laarin awọn wakati diẹ ti akiyesi, awọn titẹ sii 94 tuntun han. Ati fun akoko lati Oṣu Kẹta Ọjọ 27.03.2019, Ọdun 10.04.2019 si Oṣu Kẹrin Ọjọ 66, Ọdun XNUMX, awọn olumulo tuntun XNUMX ti forukọsilẹ ninu ohun elo naa.
Awọn akọọlẹ (diẹ sii ju awọn igbasilẹ 100 ẹgbẹrun) ti ohun elo pẹlu alaye bii:
- foonu olumulo
- wiwọle àmi lati pe itan (wa nipasẹ awọn ọna asopọ bi: api3.roamerapp.com/call/history/1553XXXXXX)
- itan ipe (awọn nọmba, ipe ti nwọle tabi ti njade, iye owo ipe, iye akoko, akoko ipe)
- onišẹ mobile olumulo
- Awọn adirẹsi IP olumulo
- awoṣe foonu olumulo ati ẹya OS alagbeka lori rẹ (fun apẹẹrẹ, iPhone 7 12.1.4)
- adirẹsi imeeli olumulo
- iwontunwonsi iroyin olumulo ati owo
- orilẹ-ede olumulo
- ipo lọwọlọwọ (orilẹ-ede) ti olumulo
- promo awọn koodu
- ati pupọ siwaju sii.
{
"_id" : ObjectId("5c9a49b2a1f7da01398b4569"),
"url" : "api3.roamerapp.com/call/history/*******5049",
"ip" : "67.80.1.6",
"method" : NumberLong(1),
"response" : {
"calls" : [
{
"start_time" : NumberLong(1553615276),
"number" : "7495*******",
"accepted" : false,
"incoming" : false,
"internet" : true,
"duration" : NumberLong(0),
"cost" : 0.0,
"call_id" : NumberLong(18869601)
},
{
"start_time" : NumberLong(1553615172),
"number" : "7499*******",
"accepted" : true,
"incoming" : false,
"internet" : true,
"duration" : NumberLong(63),
"cost" : 0.03,
"call_id" : NumberLong(18869600)
},
{
"start_time" : NumberLong(1553615050),
"number" : "7985*******",
"accepted" : false,
"incoming" : false,
"internet" : true,
"duration" : NumberLong(0),
"cost" : 0.0,
"call_id" : NumberLong(18869599)
}
]
},
"response_code" : NumberLong(200),
"post" : [
],
"headers" : {
"Host" : "api3.roamerapp.com",
"X-App-Id" : "a9ee0beb8a2f6e6ef3ab77501e54fb7e",
"Accept" : "application/json",
"X-Sim-Operator" : "311480",
"X-Wsse" : "UsernameToken Username="/******S19a2RzV9cqY7b/RXPA=", PasswordDigest="******NTA4MDhkYzQ5YTVlZWI5NWJkODc5NjQyMzU2MjRjZmIzOWNjYzY3MzViMTY1ODY4NDBjMWRkYjdiZTQxOGI4ZDcwNWJmOThlMTA1N2ExZjI=", Nonce="******c1MzE1NTM2MTUyODIuNDk2NDEz", Created="Tue, 26 Mar 2019 15:48:01 GMT"",
"Accept-Encoding" : "gzip, deflate",
"Accept-Language" : "en-us",
"Content-Type" : "application/json",
"X-Request-Id" : "FB103646-1B56-4030-BF3A-82A40E0828CC",
"User-Agent" : "Roamer;iOS;511;en;iPhone 7;12.1.4",
"Connection" : "keep-alive",
"X-App-Build" : "511",
"X-Lang" : "EN",
"X-Connection" : "WiFi"
},
"created_at" : ISODate("2019-03-26T15:48:02.583+0000"),
"user_id" : "888689"
}Nitoribẹẹ, ko ṣee ṣe lati kan si awọn oniwun ipilẹ naa. Awọn olubasọrọ lori ojula ko ṣiṣẹ, awọn ifiranṣẹ lori awujo media. ko si ọkan reacts lori awọn nẹtiwọki.
Ìfilọlẹ naa ṣi wa lori Ile-itaja Ohun elo Apple (itunes.apple.com/app/roamer-roaming-killer/id646368973).
Awọn iroyin nipa awọn n jo alaye ati awọn inu le ṣee rii nigbagbogbo lori ikanni Telegram mi "»: .
orisun: www.habr.com