Okubili kokukodwa: idatha yezivakashi namathikithi emicimbi yamasiko ayetholakala esidlangalaleni

Namuhla sizobheka amacala amabili ngesikhathi esisodwa - idatha yamakhasimende kanye nozakwethu bezinkampani ezimbili ezihluke ngokuphelele yayitholakala ngokukhululekile "sibonga" ukuvula amaseva e-Elasticsearch anamalogi wezinhlelo zolwazi (IS) zalezi zinkampani.

Esimweni sokuqala, lawa amashumi ezinkulungwane (futhi mhlawumbe amakhulu ezinkulungwane) amathikithi emicimbi yamasiko ehlukahlukene (amathiyetha, amakilabhu, uhambo lomfula, njll.) athengiswa ngohlelo lweRadario (www.radario.ru).

Esimweni sesibili, lena idatha yohambo lokuvakasha lwezinkulungwane (mhlawumbe amashumi ezinkulungwane ezimbalwa) zabahambi abathenge ukuvakasha ngama-ejensi okuvakasha axhunywe ohlelweni lwe-Sletat.ru (www.sletat.ru).

Ngithanda ukuqaphela ngaso leso sikhathi ukuthi akuwona kuphela amagama ezinkampani ezivumele ukuthi idatha itholakale esidlangalaleni ahluke, kodwa futhi nendlela yalezi zinkampani zokuqaphela lesi sigameko kanye nokusabela okulandelayo kuso. Kodwa izinto zokuqala kuqala ...

Дисклеймер: вся информация ниже публикуется исключительно в образовательных целях. Автор не получал доступа к персональным данным третьих лиц и компаний. Информация взята либо из открытых источников, либо была предоставлена автору анонимными доброжелателями.

Icala lokuqala. "Radario"

Kusihlwa ngomhla ka-06.05.2019/XNUMX/XNUMX uhlelo lwethu ithole ukuthi iseva ye-Elasticsearch itholakala mahhala, ephethwe yinkonzo yokuthengisa amathikithi e-elekthronikhi i-Radario.

Ngokwesiko elidabukisayo elivele selisunguliwe, iseva iqukethe izingodo ezinemininingwane yesistimu yolwazi yesevisi, lapho kwakungenzeka khona ukuthola idatha yomuntu siqu, ukungena ngemvume komsebenzisi namaphasiwedi, kanye namathikithi e-elekthronikhi ngokwawo emicimbi eyahlukahlukene ezweni lonke.

Isamba sevolumu yamalogi sidlule i-TB engu-1.

Ngokusho kwenjini yokusesha yakwaShodan, iseva ibilokhu itholakala esidlangalaleni kusukela ngoMashi 11.03.2019, 06.05.2019. Ngazise abasebenzi be-Radario ngomhla ka-22/50/07.05.2019 ngo-09:30 (MSK) futhi ngomhla ka-XNUMX/XNUMX/XNUMX cishe ngo-XNUMX:XNUMX iseva ayizange itholakale.

Amalogi aqukethe ithokheni yokugunyazwa yendawo yonke (eyodwa), enikeza ukufinyelela kuwo wonke amathikithi athengiwe ngezixhumanisi ezikhethekile, njenge:

http://radario.ru/internal/tickets/XXXXXXXX/print?access_token=******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTk

http://radario.ru/internal/orders/YYYYYYY/print?access_token=******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTk

Inkinga futhi ukuthi ukubala amathikithi, kwasetshenziswa izinombolo eziqhubekayo zama-oda kanye nokubalwa okulula kwenombolo yethikithi (UXXXXXX) noma oda (YYYYYYY), kwakungenzeka ukuthola wonke amathikithi ohlelweni.

Ukuhlola ukuhlobana kwesizindalwazi, ngaze ngazithengela ithikithi elishibhe kakhulu:

futhi kamuva wayithola kuseva yomphakathi kumalogi we-IS:

http://radario.ru/internal/tickets/11819272/print?access_token==******JuYWw6MDIzOWRjOTM1NzJiNDZjMTlhZGFjZmRhZTQ3ZDgyYTk

Ngokwehlukana, ngithanda ukugcizelela ukuthi amathikithi abetholakala kokubili emicimbini esuke yenzeka kanye nakuleyo esahlelwa. Okusho ukuthi, umuntu ongase abe umhlaseli angasebenzisa ithikithi lomunye ukuze angenele umcimbi ohleliwe.

Ngokwesilinganiso, inkomba ngayinye ye-Elasticsearch equkethe izingodo zosuku olulodwa (kusuka ku-24.01.2019/07.05.2019/25 kuya ku-35/XNUMX/XNUMX) iqukethe amathikithi ayizinkulungwane ezingama-XNUMX kuye kwangama-XNUMX.

Ngokungeziwe kumathikithi ngokwawo, inkomba iqukethe ukungena (amakheli e-imeyili) kanye namagama ayimfihlo okungena kuma-akhawunti omuntu siqu ozakwethu be-Radario abathengisa amathikithi emicimbi yabo ngale sevisi:

Content: "ReturnUrl=&UserEmail=***@yandex.ru&UserPassword=***"

Sekukonke, kutholwe amapheya okungena/amaphasiwedi angaphezu kuka-500. Izibalo zokuthengiswa kwamathikithi ziyabonakala kuma-akhawunti womuntu siqu wozakwethu:

Okunye okwakutholakala esidlangalaleni amagama, izinombolo zocingo namakheli e-imeyili abathengi abanqume ukubuyisela amathikithi athengwe ngaphambilini:

"Content": "{"name":"***","surname":"*** ","middleName":"Евгеньевна ","passportType":1,"passportNumber":"","passportIssueDate":"11-11-2011 11:11:11","passportIssuedBy":"","email":"***@mail.ru","phone":"+799*******","ticketNumbers":["****24848","****948732"],"refundReason":4,"comment":""}"

Ngosuku olulodwa olukhethwe ngokungahleliwe, kwatholakala amarekhodi anjalo angaphezu kuka-500.

Ngithole impendulo kusexwayiso esivela kumqondisi wezobuchwepheshe we-Radario:

Ngingumqondisi wezobuchwepheshe we-Radario futhi ngithanda ukubonga ngokuhlonza inkinga. Njengoba nazi, sivale ukufinyelela ku-elastic futhi sixazulula inkinga yokuphinda sikhiphe amathikithi kumakhasimende.

Kamuva inkampani yenza isitatimende esisemthethweni:

Kutholwe ubungozi ohlelweni lokuthengiswa kwamathikithi e-elekthronikhi eRadario futhi kwalungiswa ngokushesha, okungase kuholele ekuvuzeni kwedatha evela kumakhasimende wensizakalo, umqondisi wezokuthengisa wenkampani, uKirill Malyshev, utshele i-Moscow City News Agency.

“Empeleni sithole ubungozi ekusebenzeni kwesistimu okuhlobene nezibuyekezo ezijwayelekile, ezilungiswe ngokushesha ngemuva kokutholwa. Njengomphumela wokuba sengozini, ngaphansi kwezimo ezithile, izenzo ezingenabungane zezinkampani zangaphandle zingaholela ekuvuzeni kwedatha, kodwa azikho izigameko ezirekhodiwe. Okwamanje, wonke amaphutha aseqediwe,” kusho uK. Malyshev.

Omele inkampani ugcizelele ukuthi kunqunywe ukuthi kuphinde kukhishwe wonke amathikithi athengiswe ngesikhathi kuxazululwa le nkinga ukuze kuqedwe ngokuphelele ukukhwabanisa okubhekiswe kumakhasimende esevisi.

Ezinsukwini ezimbalwa kamuva, ngabheka ukutholakala kwedatha ngisebenzisa izixhumanisi eziputshuziwe - ukufinyelela kumathikithi "aveziwe" bekumboziwe ngempela. Ngokubona kwami, lena indlela enekhono, yobungcweti yokuxazulula inkinga yokuvuza kwedatha.

Icala lesibili. "Fly.ru"

Ekuseni ngo-15.05.2019/XNUMX/XNUMX I-DeviceLock Data Breach Intelligence ikhombe iseva ye-Elasticsearch yomphakathi enamalogu e-IS ethile.

Kamuva kwasungulwa ukuthi iseva ingeyesevisi yokukhetha ukuvakasha "Sletat.ru".

Kusukela kunkomba cbto__0 kube nokwenzeka ukuthola izinkulungwane (izinkulungwane ezingu-11,7 kuhlanganisa nezimpinda) zamakheli e-imeyili, kanye nolunye ulwazi lokukhokha (izindleko zokuvakasha) kanye nedatha yokuvakasha (nini, kuphi, imininingwane yethikithi lendiza всех abahambi abafakwe ohambweni, njll.) ngenani lamarekhodi acishe abe yizinkulungwane eziyi-1,8:

"full_message": "Получен запрос за создание платежного средства: {"SuccessReturnUrl":"https://sletat.ru/tour/7-1939548394-65996246/buy/?ClaimId=b5e3bf98-2855-400d-a93a-17c54a970155","ErrorReturnUrl":"https://sletat.ru/","PaymentAgentId":15,"DocumentNumber":96629429,"DocumentDisplayNumber":"4451-17993","Amount":36307.0,"PaymentToolType":3,"ExpiryDateUtc":"2020-04-03T00:33:55.217358+03:00","LifecycleType":2,"CustomerEmail":"[email protected]","Description":"","SettingsId":"8759d0dd-da54-45dd-9661-4e852b0a1d89","AdditionalInfo":"{"TourOfficeAdditionalInfo":{"IsAdditionalPayment":false},"BarrelAdditionalInfo":{"Tickets":[{"Passenger":{"FIO":"XXX VIKTORIIA"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX ANDREI"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX Andrei"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false}],"Segments":[{"Flight":"5659","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"LED","DepartureAirport":"LED","DepartureAirportIataCode":"LED","DepartureDate":"2019-04-11T02:45:00","DepartureTime":null,"ArrivalCity":"SHJ","ArrivalAirport":"SHJ","ArrivalAirportIataCode":"SHJ","ArrivalDate":"2019-04-11T09:40:00","ArrivalTime":null,"FareCode":null},{"Flight":"5660","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"SHJ","DepartureAirport":"SHJ","DepartureAirportIataCode":"SHJ","DepartureDate":"2019-04-14T10:45:00","DepartureTime":null,"ArrivalCity":"LED","ArrivalAirport":"LED","ArrivalAirportIataCode":"LED","ArrivalDate":"2019-04-14T15:50:00","ArrivalTime":null,"FareCode":null}]},"Tickets":[{"Passenger":{"FIO":"XXX VIKTORIIA"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX ANDREI"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false},{"Passenger":{"FIO":"XXX Andrei"},"ReservationSystem":null,"TicketNumber":null,"IsRefundPossible":false}],"Segments":[{"Flight":"5659","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"LED","DepartureAirport":"LED","DepartureAirportIataCode":"LED","DepartureDate":"2019-04-11T02:45:00","DepartureTime":null,"ArrivalCity":"SHJ","ArrivalAirport":"SHJ","ArrivalAirportIataCode":"SHJ","ArrivalDate":"2019-04-11T09:40:00","ArrivalTime":null,"FareCode":null},{"Flight":"5660","AviaCompany":null,"AviaCompanyIataCode":null,"DepartureCity":"SHJ","DepartureAirport":"SHJ","DepartureAirportIataCode":"SHJ","DepartureDate":"2019-04-14T10:45:00","DepartureTime":null,"ArrivalCity":"LED","ArrivalAirport":"LED","ArrivalAirportIataCode":"LED","ArrivalDate":"2019-04-14T15:50:00","ArrivalTime":null,"FareCode":null}]}","FinancialSystemId":9,"Key":"18fe21d1-8c9c-43f3-b11d-6bf884ba6ee0"}"

Ngendlela, izixhumanisi zokuvakasha ezikhokhelwayo ziyasebenza impela:

Ezinkombeni ezinegama i-graylog_ emibhalweni ecacile kwakukhona ukungena kanye namagama ayimfihlo ezinkampani zokuhamba ezixhunywe ohlelweni lwe-Sletat.ru kanye nokudayisa izinkambo kumakhasimende abo:

"full_message": "Tours by request 155213901 added to local cache with key 'user_cache_155213901' at 5/6/2019 4:49:07 PM, rows found 0, sortedPriceLength 215. QueryString: countryId=90&cityFromId=1265&s_nightsMin=6&s_nightsMax=14&stars=403%2c404&minHotelRating=1&currencyAlias=RUB&pageSize=300&pageNumber=1&s_showcase=true&includeOilTaxesAndVisa=0&login=zakaz%40XXX.ru&password=XXX, Referer: , UserAgent: , IP: 94.154.XX.XX."

Ngokwezilinganiso zami, amakhulu amaningana amapheya wokungena/iphasiwedi abonisiwe.

Kusuka ku-akhawunti yomuntu siqu ye-ejensi yezokuvakasha kuphothali i-agent.sletat.ru kwakungenzeka ukuthola idatha yekhasimende, okuhlanganisa izinombolo zepasipoti, amaphasipoti amazwe ngamazwe, izinsuku zokuzalwa, amagama aphelele, izinombolo zocingo namakheli e-imeyili.

Ngazise isevisi ye-Sletat.ru ngomhlaka-15.05.2019/10/46 ngo-16:00 (MSK) futhi ngemva kwamahora ambalwa (kuze kube ngu-XNUMX:XNUMX) yanyamalala ekufinyeleleni kwabo mahhala. Kamuva, ekuphenduleni ukushicilelwa kwe-Kommersant, abaphathi benkonzo benza isitatimende esingavamile kakhulu ngokusebenzisa abezindaba:

Inhloko yenkampani, u-Andrei Vershinin, wachaza ukuthi i-Sletat.ru inikeza inqwaba yabavakashi abakhulu bozakwethu ukufinyelela kumlando wemibuzo enjinini yokusesha. Futhi ucabange ukuthi i-DeviceLock iyitholile: “Kodwa-ke, isizindalwazi esishiwo asiqukethe imininingwane yamaphasiphothi ezivakashi, ukungena ngemvume kwenkampani yezokuvakasha namaphasiwedi, imininingwane yokukhokha, njll. U-Andrei Vershinin waphawula ukuthi i-Sletat.ru ayikatholi noma yibuphi ubufakazi balezi zinsolo ezinzima. “Manje sizama ukuxhumana ne-DeviceLock. Sikholelwa ukuthi lokhu kuwumyalelo. Abanye abantu abakuthandi ukukhula kwethu ngokushesha, ”engeza. "

Njengoba kukhonjisiwe ngenhla, ukungena, amagama ayimfihlo, kanye nedatha yepasipoti yabavakashi bekusesidlangalaleni isikhathi eside (okungenani kusukela ngoMashi 29.03.2019, XNUMX, lapho iseva yenkampani yaqoshwa okokuqala esizindeni somphakathi yinjini yokusesha yakwaShodan). Yiqiniso, akekho owasithinta. Ngethemba ukuthi okungenani bazazisile izinhlangano zezokuvakasha mayelana nokuputshuka futhi babaphoqa ukuthi bashintshe amagama abo ayimfihlo.

Izindaba mayelana nokuvuza kolwazi kanye nabangaphakathi zingatholakala njalo esiteshini sami seTelegram "Ukuputshuka kolwazi".

Source: www.habr.com