Duży wyciek z popularnego sklepu Gearbest – mamy kilka unikalnych informacji z samego źródła

Gearbest to jeden z największych sklepów w Internecie (ma też polską wersję strony) – dokładniej jest na 255 miejscu wśród najbardziej popularnych globalnie witryn (odliczając serwisy newsowe, Google, inne wyszukiwarki, czy Wikipedię – to naprawdę wysoka pozycja).

Okazuje się, że serwis niezbyt dobrze zabezpieczył dane swoich użytkowników (najprawdopodobniej była to duża, niezabezpieczona baza Elasticsearch). Panowie z VPNMentor byli  w stanie uzyskać dostęp do takich danych jak: dane zamówień, dane użytkowników (w tym dane osobowe, hasła, e-maile), dane o płatnościach i fakturach (ale prawdopodobnie bez danych o kartach płatniczych):

Fragment pobranych danych

Testowo udało się bez problemu zalogować na wybrane dwa konta z bazy:

We were able to log in to these two Gearbest accounts and operate them as if we were the users. We could view current and past orders, accumulated Gearbest points, and change the account password and details.

Część informacji jest opisana dość niejasno (np. jest mowa o „parial hashing”, nie wiadomo czy wyciekły hasła w plaintext, …). Postanowiliśmy więc podpytać ludzi z VPNMentor o kilka szczegółów. Odpowiedzi otrzymaliśmy dzisiaj (15.03.2019, 6:12 czasu polskiego)

1. Sekurak: „It’s worth noting that some email addresses contained some hashing” -> are you writing about passwords or e-mails? What kind of hashes were employed?”
   VPN Mentor: „We saw the emails, some where with *** instead of real characters. You can see attached image 01.  I blurred the parts of the address that can allow people to guess, but Gearbest used *** instead of some characters.
   

   ***

2. Sekurak: „Passwords. There were hashes (can you determine the algorithm?) or plaintext passwords in the DB?”
   VPN Mentor: „We found plain text passwords”
3. Sekurak: „Is the DB still accessible?”
   VPN Mentor: „They thanked us today and removed it. It was live just until a few hours ago”
4. Sekurak: „Could you provide specific dates when you contacted Gearbest?”
   VPN Mentor: „We contacted them a few times starting March 10. We contacted from a few emails/twitter accounts etc. Since there was no response and user data was live, we had to take action.
5. Sekurak: „How many clients/records you were able to see in the DB? (all / some?) You write about millions – is it rather 5 millions or 100 millions / 500 millions?”
   VPN Mentor: „if we wanted to know exact number we had to download the entire DB, which is something we didn’t want to do. Based on the index files we saw we estimated hundreds of thousands of orders (conservative). Since the reports were reset daily, every day fresh records saw light so you can say that within the period of time it was accessible, more than a million records where exposed.”
6. Sekurak: „Are you able to identify any users from Poland (.pl) domain?”
   VPN Mentor: „We could and we saw. But we didn’t download their details. (…)

W międzyczasie dopytujemy jeszcze o parę innych szczegółów, a może Wy chcielibyście o coś (za naszym pośrednictwem) zapytać?

Gearbest rozpoczął dzisiaj wysyłkę maili dotyczącą naruszenia bezpieczeństwa:

Dear Customer,

Thank you for your recent registration on Gearbest.

Customers’ information security is our priority, and we work hard to ensure protection of such information implementing all available methods in the market.

In this context, we have found that some customers’ account information (username and password) could have been compromised. Although we have already fixed the issue and made your account data fully secure, your account password has been disabled.

Please log in to your Gearbest account to reset a new password.

We remain at your entire disposal for any questions you may have.

King Regards
Gearbest

Jest też parę słów od Gearbest:

The external tools we use are intended to improve efficiency and prevent data overload and the Data will only be stored in such tools for less than 3 calendar days before it is automatically destroyed. Considering possible data security breaches, we protected those tools with powerful firewalls to avoid any such data being compromised by malicious scanning from others. However, our investigation reveals that on March 1st, 2019, such firewalls were mistakenly taken down by one of our security team members for reasons still being under investigation. (…)

Currently, we believe this may have affected our newly registered customers as well as our old customers who placed orders with Gearbest during the time from March 1st 2019 to March 15th, 2019, in a total number of about 280,000.

-ms