I discovered thousands of open databases on AWS
infosecwriteups.com
I discovered thousands of open databases on AWS
1–10 of 75 posts
Re: I discovered thousands of open databases on AWS
#2Another great example why I love to use managed services / serverless services and not take care of security groups and NACLs
Re: I discovered thousands of open databases on AWS
#3This same article was posted previously, so I will post the same response I posted on the other thread:
Elasticsearch until recently did not nudge you to set up a username or password by default. I noticed the last time I installed it on a fresh instance that on completion of the install it gives you a warning about this and tells you what to do to set a password. That is a small improvement.
Most people would not have the service bound to a public interface, but for those who do for whatever reason have a set up where they are accessing it remotely, at least now there is a tip off that it is completely open to the world by default. This is different from pretty much any other service you might install. MariaDB for instance by default does not allow remote root login even if you change the config to bind it to 0.0.0.0.
A lot of people are just totally unaware of this issue. When I read about database leakage, I generally assume 90% probability it was elastic, these days. Defaults are so important.
Re: I discovered thousands of open databases on AWS
#4Previous comments:
https://news.ycombinator.com/item?id=30144021
Re: I discovered thousands of open databases on AWS
#5This same article was posted previously, so I will post the same response I posted on the other thread: Elasticsearch until recently did not nudge you to set up a username or password by default. I noticed the last time I installed it on a fresh instance that on completion of the install it gives you a warning about this and tells you what to do to set a password. That is a small improvement. Most people would not ha…
My solution to this has always been to auto-generate a password and dump it in a by file.
If it's a test instance then this is a nice obvious place to go get it from. If it's not then the service isn't open by default, and in both cases we're not asking people to enable remote access themselves by some scheme which may allow them to do it without setting a password.
Same thing with TLS IMO: let certs be specified, or default to generating some - any option is better then default no encryption.
Re: I discovered thousands of open databases on AWS
#6Another great example why I love to use managed services / serverless services and not take care of security groups and NACLs
Interesting. The conclusion you draw from this differs wildly from my conclusion.
Whenever I read stories like these, it seems clear to me that someone moved to the cloud in order to not have to care about security. The 'cloud does everything for you!'. Just like you imply in your answer that PaaS, the next level of abstraction, will solve all your security problems. This move, however, will inevitably lead to a situation where people work with new and complex systems that they don't understand (remember: not having to understand them is the sole reason they use them). Unfortunately, working with complex systems you don't understand is the number one reason for vulnerabilities in the first place.
I am not convinced that a service exists that abstracts security away from you.
Re: I discovered thousands of open databases on AWS
#7This same article was posted previously, so I will post the same response I posted on the other thread: Elasticsearch until recently did not nudge you to set up a username or password by default. I noticed the last time I installed it on a fresh instance that on completion of the install it gives you a warning about this and tells you what to do to set a password. That is a small improvement. Most people would not ha…
There are lots of lessons in the internet's limited history that show poorly conceived defaults are the most common and dangerous mistake. Microsoft let Frontpage Extension credentials default to the domain name and a blank password through multiple major versions, without any prompt to change anything (you had to seek out the settings, and it wasn't even obvious where they were). Throughout the late 90s and early 00s, entire hosting companies were continuously compromised because of this, along with nearly every school district in the US and tons of major universities. Schools typically had the worst security and most available processing power and bandwidth, already making them the preferred targets of script kiddies everywhere.
That exploit was single-handedly responsible for hundreds of thousands of bots (and more likely millions in later years) which wreaked havoc on the internet as a whole -- these were the days when a handful of bots on good connections could take down the Amazons of the world for lengthy periods (days, not hours). That they let it go on for so long was comical at the time, but in hindsight seems criminally negligent.
Re: I discovered thousands of open databases on AWS
#8This same article was posted previously, so I will post the same response I posted on the other thread: Elasticsearch until recently did not nudge you to set up a username or password by default. I noticed the last time I installed it on a fresh instance that on completion of the install it gives you a warning about this and tells you what to do to set a password. That is a small improvement. Most people would not ha…
Interesting that ES is still such a widely used component, this is a huge red flag about a software product. And of course there are lots of other regular complaints about it (eg uses a lot of memory and wants a 3-node cluster so costs 4 figures/mo to run on AWS).
Re: I discovered thousands of open databases on AWS
#9This has been going on for years with AWS. Unfortunately, there has always been unprotected data sitting on AWS for anyone to read.
This Google Search returned an extremely high number of mentions of various companies' ills, a high signal to noise ratio. It's very saddening to see that.
https://www.google.com/search?q=unprotected+databases+on+aws
Re: I discovered thousands of open databases on AWS
#10This same article was posted previously, so I will post the same response I posted on the other thread: Elasticsearch until recently did not nudge you to set up a username or password by default. I noticed the last time I installed it on a fresh instance that on completion of the install it gives you a warning about this and tells you what to do to set a password. That is a small improvement. Most people would not ha…
This same article was posted previously, so I will post the same response
Don't repaste your own comments just because there's been a dupe.