Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I discovered thousands of open databases on AWS

infosecwriteups.com

Post reply on HN
Print view View original

41–50 of 75 posts

Re: I discovered thousands of open databases on AWS

#41

Post by notwedtm »

jfkimmes wrote: post #6
jack335 wrote: post #2

Another great example why I love to use managed services / serverless services and not take care of security groups and NACLs

Interesting. The conclusion you draw from this differs wildly from my conclusion. Whenever I read stories like these, it seems clear to me that someone moved to the cloud in order to not have to care about security. The 'cloud does everything for you!'. Just like you imply in your answer that PaaS, the next level of abstraction, will solve all your security problems. This move, however, will inevitably lead to a situ…

I think the word "managed" is the clear differentiator here. There is a huge difference between setting up ElasticSearch on some EC2 instances yourself, and paying ElasticCo for a managed cluster.

I would expect the latter to be sure by default.

Re: I discovered thousands of open databases on AWS

#42

Post by mtberatwork »

mushyhammer wrote: post #30
jeroenhd wrote: post #14

I used to think you have to be pretty good af your job to get trusted to deploy stuff to the cloud for even medium sized companies. As these articles keep reminding me, you only need to fake competence to management to get the green light. Even if you forget that the cloud is the internet and that the entire internet can reach you over the internet, it doesn't take a genius to set up a password for a cloud service. I…

> you only need to fake competence to management With so many 10x full-stack developers who're just looking to get sh done and clock out, it can't be otherwise. If managing a server becomes just another bullet point in a developer job, this is exactly what we get. Sure I can deploy stuff, but you shouldn't trust me. Unfortunately many are not so honest or even aware of the complexity (unknown unknowns).

> If managing a server becomes just another bullet point in a developer job, this is exactly what we get.

Yup...the same management are the ones that laid off the DBAs, system admins, network engineers, etc because "the cloud" hand waves all this stuff away now.

Re: I discovered thousands of open databases on AWS

#43

Post by blitzar »

jeroenhd wrote: post #14

I used to think you have to be pretty good af your job to get trusted to deploy stuff to the cloud for even medium sized companies. As these articles keep reminding me, you only need to fake competence to management to get the green light. Even if you forget that the cloud is the internet and that the entire internet can reach you over the internet, it doesn't take a genius to set up a password for a cloud service. I…

> I used to think you have to be pretty good at your job ...

I didnt need to get beyond there to see when you went wrong, and the bar for competence is not high across the board. Sadly I havent found a way to make money out of it, but you have to be aware of it to navigate the world safely.

Re: I discovered thousands of open databases on AWS

#44

Post by willcipriano »

hutzlibu wrote: post #35
jeroenhd wrote: post #14

I used to think you have to be pretty good af your job to get trusted to deploy stuff to the cloud for even medium sized companies. As these articles keep reminding me, you only need to fake competence to management to get the green light. Even if you forget that the cloud is the internet and that the entire internet can reach you over the internet, it doesn't take a genius to set up a password for a cloud service. I…

"I suppose it's kind of liberating to know that you can be dumb enough to fling patient data into an unprotected cloud server and still get a job in IT. The bar is really set that low." On the other hand, I would argue that there are way too many footguns hidden everywhere, like the default binding of docker mentioned here. So yes, a highly skilled IT security professional knows them all, but they are rare. And I thi…

I don't know how you idiot proof a Turing complete language, but I don't imagine it would be much of a pleasure to use for non-idiots.

If networking 101 is a foot gun to you, I don't think you know enough to be responsible for anything important. I don't think there is a software fix for that lack of knowledge.

Re: I discovered thousands of open databases on AWS

#45

Post by c0balt »

willcipriano wrote: post #44
hutzlibu wrote: post #35

Earlier quoted context omitted.

"I suppose it's kind of liberating to know that you can be dumb enough to fling patient data into an unprotected cloud server and still get a job in IT. The bar is really set that low." On the other hand, I would argue that there are way too many footguns hidden everywhere, like the default binding of docker mentioned here. So yes, a highly skilled IT security professional knows them all, but they are rare. And I thi…

I don't know how you idiot proof a Turing complete language, but I don't imagine it would be much of a pleasure to use for non-idiots. If networking 101 is a foot gun to you, I don't think you know enough to be responsible for anything important. I don't think there is a software fix for that lack of knowledge.

Isn't the first point a goal of most "no-code" solutions? Sure, you can most likely still infinite loop but it is a far easier to not screw up compared to "normal" programming.

Re: I discovered thousands of open databases on AWS

#46

Post by malka »

qwertox wrote: post #32
kawsper wrote: post #21

Earlier quoted context omitted.

Even if you've firewalled you machine, Docker will happily open up the ports to the world, you have to run it with "--iptables=false" to stop it. I accidentally opened up a Redis test-instance to the world like this.

Is there any additional information on this? Assuming I add a rule via `iptables -I INPUT -s 123.123.123.123 -p tcp --dport 8080 -j DROP` and on interface:port 0.0.0.0:8080 of the host is a container listening which got run as `docker run -d -p 0.0.0.0:8080:8080 some/server:latest` Will that container still be accessible to 123.123.123.132?

Yes. Docker will create specific rules for the lifetime of the container.

I was bit by this once. Be very careful with docker. Do not rely blindly on your firewall of it runs on the same machine.

Re: I discovered thousands of open databases on AWS

#47

Post by tokumei »

jeroenhd wrote: post #14

I used to think you have to be pretty good af your job to get trusted to deploy stuff to the cloud for even medium sized companies. As these articles keep reminding me, you only need to fake competence to management to get the green light. Even if you forget that the cloud is the internet and that the entire internet can reach you over the internet, it doesn't take a genius to set up a password for a cloud service. I…

Also, all databases and app servers should be private, accessed by a bastion server. The only thing the outside should be able to reach are the load balancers/reverse proxies.

Re: I discovered thousands of open databases on AWS

#48

Post by remram »

qwertox wrote: post #32
kawsper wrote: post #21

Earlier quoted context omitted.

Even if you've firewalled you machine, Docker will happily open up the ports to the world, you have to run it with "--iptables=false" to stop it. I accidentally opened up a Redis test-instance to the world like this.

Is there any additional information on this? Assuming I add a rule via `iptables -I INPUT -s 123.123.123.123 -p tcp --dport 8080 -j DROP` and on interface:port 0.0.0.0:8080 of the host is a container listening which got run as `docker run -d -p 0.0.0.0:8080:8080 some/server:latest` Will that container still be accessible to 123.123.123.132?

The Docker container is using a separate network namespace with a separate virtual interface that packets are routed to. The "PREROUTING" chain runs before the "INPUT" chain so yes, the rules you put in "INPUT" won't apply.

Re: I discovered thousands of open databases on AWS

#49

Post by michaelcampbell »

qwertox wrote: post #32
kawsper wrote: post #21

Earlier quoted context omitted.

Even if you've firewalled you machine, Docker will happily open up the ports to the world, you have to run it with "--iptables=false" to stop it. I accidentally opened up a Redis test-instance to the world like this.

Is there any additional information on this? Assuming I add a rule via `iptables -I INPUT -s 123.123.123.123 -p tcp --dport 8080 -j DROP` and on interface:port 0.0.0.0:8080 of the host is a container listening which got run as `docker run -d -p 0.0.0.0:8080:8080 some/server:latest` Will that container still be accessible to 123.123.123.132?

Well, trick question since you typo'd the IP, but "yes" to the spirit. I ran into exactly the case described https://www.techrepublic.com/article/how-to-fix-the-docker-a..., albeit with mysql instead of mongo.
Post reply on HN