The expert told NTV about spyware hacking methods.

[Матушкин Андрей Николаевич]

The last two weeks of the Runet have been shaken by data leakage scandals: first, MegaFon users’s SMS got public access, then the personal data of sex shop buyers, Russian Railways passports, and the day before the network community had fun all day reading government documents with the heading “For official use ". The editorial board of NTV.ru is trying to figure out who is to blame for what happened. To do this, we contacted a data protection specialist.

Andrei Masalovich is an expert on information security and competitive intelligence. He studied methods of protecting and hacking data in the KGB, then in FAPSI. In 1997, he was transferred to the reserve with the rank of lieutenant colonel, after which he led a number of companies providing network audit services. In 2001, he became president of the Inforus consortium, which unites more than 30 Russian IT companies.

Two years ago, for the sake of an experiment for the Slon.ru editorial office, Masalovich’s search robots on the Internet in just ten minutes found a 266-page secret document with data on the Y-12 object - enriched uranium storage in the USA, and then a map of the storage itself . Andrei Masalovich is convinced that truly safe systems do not exist, but information leakage can be stopped. That's just worth it millions.

- On the eve of the article about the next scandal with the disclosure of the data of passengers who bought train tickets online, on our website came out under the heading “Runet is cracking at the seams”. What do you think is happening on the Web and why did such massive data leaks suddenly appear?

Andrei Masalovich: Now there are two fundamentally different areas of information hunting on the Internet - google hack (“google hack”), when people search for vulnerabilities on sites through a search engine to hack these sites later, and google dork (“google dock”), from English "dork" - "blockhead." The latter is not considered hacking in its purest form, but rather a set of tricks that allow you to find someone else’s existing blunder or hacking fact and mock it. For comparison, it’s the same as going out onto the streets of a resort town and starting to photograph drains of sewers –– it seems that there was an environmental disaster in the city, but we know that such a situation exists in all neighboring cities. As for the Network, I can show how to find from 5 to 15 thousand open folders on the Pentagon website with one command.

- And how does this compare with the scandals surrounding the information that appeared in the search for Yandex?

Andrei Masalovich: It so happened that Yandex has grown to Google - now more than half of the requests go through them, and on top of that, these tools (from the google dork category - approx. NTV) fell into the hands of youngsters, so what’s happening Now both with SMS and with train tickets - not a leak, this is a statement of the abundance of minor leaks for everyone without exception. And anyone can get to them.

- Representatives of search engines say that the whole problem is that the sites where the data flowed from did not have a special Robot.txt file, which should contain instructions for the search robot - which files to index and which not.

Andrei Masalovich: As for the Robot.txt file, this is an ethical norm, no more. The presence of such a file is not mandatory either for sites or for search engines. However, search engines constantly violate ethical rules, for example, the robot.txt file on the Megafon website was on July 19 and 20, that is, after the scandal broke out, but the data was still indexed by Yandex and Rambler ". Search engines continued to monitor the pages of the mobile operator, although now, of course, they are quite difficult to convict of this. Now they (representatives of search engines - approx. NTV) say: “Prove it!”. But it is clear that their programmers have long since cleared all traces.

- So what really happened then, and how did the leak of SMS, data of buyers of sex shops, passengers of Russian Railways happen?

Andrei Masalovich: In all three examples, the same thing happened technically: if there is a large database, it is very beneficial from the point of view of site performance to create a buffer space - a cache, in order to synchronize the database later. If you do not protect this space correctly, it becomes available. Moreover, the robots are accessible not for ordinary users, but because the robot can visit the site at least 10 times per minute and catch short-lived pages. So did the Yandex robot in the case of a leak of passenger data of Russian Railways, when the pages themselves were not accessible to users, but in the Yandex cache for the short time that this data existed, it was saved.

- It turns out that you can’t protect yourself from such leaks in any way?

Andrei Masalovich: My worldview is based on two statements: the first - leaks cannot be avoided, the second - you cannot build a 100 percent information security system. You know, in my opinion there is such a rule written down in the GOST of labor protection - it is forbidden to use the word “safe” as an adjective, simply because there is nothing absolutely safe. We can only minimize risks to an acceptable level - but at the same time, we must correctly assess these risks and threats. In general, there are four things that I advise companies that care about the confidentiality of information to implement:

1. Develop a security policy, and as part of this policy, calculate the risks, as well as the responsibility for non-compliance with any rules. Honestly, I have never seen a literate security policy.

2. Conduct an audit - an initial inventory of the level of leaks. I can tell you a little secret - any mobile operator from the Big Three (MTS, Beeline, Megafon - approx. NTV) - leaks happen all the time. The case with the “Megaphone” SMS is what young boys discovered who dabbled in google dork tools. At work, I constantly encounter a password leak from these organizations, and this is already serious.

3. Constantly improve staff literacy. Over the past 200 weeks, I have conducted 200 seminars, now I'm flying to Tashkent to train the prosecutor's office of Uzbekistan. It happens that people have read some books about hackers, and these experts do not know anything about real threats. For example, did you know that there are already hardware keyloggers - keyboard traffic interceptors disguised as a regular mouse, a kind of trojan. It is enough for an attacker to give such a “mouse” to the victim, in a week the hacker will take everything from the system, including passwords and confidential information, without using the Internet at all. Miracle mouse, by the way, is mass-produced.

4. And the last one is monitoring automation, you can’t manually track all the leaks, but you can automatically. Leaks of passwords, personal data - these tasks are easily formalized. Of course, we are talking about a high-level system, its cost can reach 10–20 million rubles, but companies like Yandex have such money and if they pressed it, they would put it.

- Do you think that it is the search engines that should install them?

Andrei Masalovich: Data disclosure - if it’s not about state secrets, when everyone is to blame, the one who makes the data publicly admits. The extreme ones are search engines, although to be honest, everyone has a stigma in the cannon. By the way, how else does google hack differ from google dork - there are dozens of documents with a signature stamp for official use in the search engine results, but there are few real secrets there. To find truly secret documents - you need to use serious hacking methods. There are people who are successfully doing this.

This is called competitive intelligence. It appeared about 25 years ago, before Google. Then the collection of information was also carried out on open sources, for example, newspaper articles. Understand - for a long time there is a set of methods that allow you to get to sensitive information. In my arsenal of such tools there are probably 700 pieces. About 10 years ago it turned out that search engines help me a lot, sometimes because of unethicality, sometimes due to oversight by developers, sometimes they simply suck in documents that actually go public should not.

- In your opinion, any scandals related to the ingress of personal data are possible in the near future?

Andrei Masalovich: For the past four years I have been engaged in information security and what is called an “information security leak audit”. It is clear that customers are not poor people, and they have something to hide. But for 4 years of inspections, I have never signed the conclusion "no leaks were found." Something, yes, will certainly come up.

Read more: https://www.ntv.ru/novosti/234528#ixzz2oQsBVyEC

 

[Плотников Юрий Михайлович]

Thank!

 

[Марат]

Thank!

 

[Турабян Владимир]

Thank!

 

[Краев Евгений Леонидович]

Thanks for the material, interesting!