Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I discovered thousands of open databases on AWS

infosecwriteups.com

Post reply on HN
Print view View original

51–60 of 75 posts

Re: I discovered thousands of open databases on AWS

#51

Post by remram »

OrderlyTiamat wrote: post #27
Tabular-Iceberg wrote: post #13

Earlier quoted context omitted.

Why not? I’m not saying people should do it, but what are the arguments against it?

(not gp) I would prefer having a link to the other post (as someone above provided) so the comments there can be read. Duplicating the comments means I see the same thing twice, or it means the previous replies to that comment are now obscured to me. Which of the two it is depends on whether I find the other post. Not a desirable situation imho.

There you go: https://news.ycombinator.com/item?id=30144920

Re: I discovered thousands of open databases on AWS

#52

Post by wbkang »

nickjj wrote: post #40
l33tman wrote: post #36

From the article its main focus vulnerability seems to be setups that don't use VPCs, which is default on AWS since long. It discusses human oversights like a server that needs to accept connections from other servers and where they then have opened a too large IP block. But this only makes sense if they were using internet IPs.. within a VPC this wouldn't matter. With some even rudimentary knowledge of how IPV4 work…

I think in a lot of cases folks still make certain things public instead of using a VPC out of convenience. For example if a developer needs to access a resource within a VPC then this sky rockets complexity. You can't just connect to something running in a VPC from the outside world. You'd have to install and configure a VPN and it becomes a whole ceremony for both the person setting all of this up and the person co…

How about just setting up a bastion host and then forwarding ports via SSH? It's much simpler than setting up a VPN.

Re: I discovered thousands of open databases on AWS

#53

Post by sethammons »

kawsper wrote: post #21
rmetzler wrote: post #20

> DevOps, Developers, and IT practitioners often misconfigure some of the following: Binding the socket on the wrong network interfaces. For example, listening to connections from 0.0.0.0/* — So it is visible to all network interfaces, instead of only the inner-network interface IP address (172.x.x.x) Binding to 0.0.0.0 is unfortunately the default for Docker. I wish it would have been different.

Even if you've firewalled you machine, Docker will happily open up the ports to the world, you have to run it with "--iptables=false" to stop it. I accidentally opened up a Redis test-instance to the world like this.

We unknowingly did this at work. We had firewalls in place and docker was more than happy to open up redis to the world. Big lesson learned.

Re: I discovered thousands of open databases on AWS

#54

Post by sethammons »

remram wrote: post #50
fredsmith219 wrote: post #38

It's like the days of sa/no password all over again. Made easier because of the published CIDR blocks.

If you are not using Python, scanning large swaths of IP addresses or even the whole IPv4 space for open port 9200 is very doable.

What's the problem with Python in this situation? Concurrency and Gil locks?

Re: I discovered thousands of open databases on AWS

#55

Post by rr808 »

One thing I've been surprised with is how difficult it is to set up database connectivity. I thought you'd just connect to a private VPC but it makes connections and management difficult. Much easier to go with external IP and rely on firewall rules - though then you risk ending up open.

Re: I discovered thousands of open databases on AWS

#56

Post by Tabular-Iceberg »

bryans wrote: post #16
Tabular-Iceberg wrote: post #12

Earlier quoted context omitted.

I remember hearing about FrontPage Extensions back in the day. I never had an opportunity to make use of them since I used Dreamweaver at the time, but what exactly were they? I tried googling, but couldn’t find a plain language explanation, only opaque marketing speak.

Extensions were a way of connecting the FrontPage editor directly to an IIS server, which provided publishing functionality (i.e. uploads) and basic server management. Ultimately, they were just a bunch of server scripts that responded to commands from the client over an FTP-like connection.

I see, so basically a static site deployment platform using today’s buzzwords.

Re: I discovered thousands of open databases on AWS

#57

Post by rr808 »

zurn wrote: post #19
Chyzwar wrote: post #15

Earlier quoted context omitted.

Because ES cluster should not be on public network. If anything this is red flag for AWS. ES v8 there many improvments to security. It cost that much because AWS is incredibly expensive.

Network segregation is your last line of defense. Having anything rely on it is a recipe for a bad security that's always just one step away from someone getting around it due to misconfiguration, request forgery, networks configuration changes over time, malware transiting over via VPNs etc. And of course from the SW vendor POV they don't know if the customer env employs this defense in depth layer, so it's really i…

One problem is there is very little reliable best practice on network security. Do you have any good resources?

Re: I discovered thousands of open databases on AWS

#58

Post by bluedino »

rmetzler wrote: post #20

> DevOps, Developers, and IT practitioners often misconfigure some of the following: Binding the socket on the wrong network interfaces. For example, listening to connections from 0.0.0.0/* — So it is visible to all network interfaces, instead of only the inner-network interface IP address (172.x.x.x) Binding to 0.0.0.0 is unfortunately the default for Docker. I wish it would have been different.

A lot of tutorials that get copy/pasted for things like Python that do the same thing. It isn't until someone actually reads the docs and realizes what this code does that they understand that it's probably not what they want to do.

Re: I discovered thousands of open databases on AWS

#59

Post by tluyben2 »

efdee wrote: post #39
kawsper wrote: post #21

Earlier quoted context omitted.

Even if you've firewalled you machine, Docker will happily open up the ports to the world, you have to run it with "--iptables=false" to stop it. I accidentally opened up a Redis test-instance to the world like this.

Strange, I've never seen this before. I've been running Docker for years on one of my pet project machines, but while Docker is exposing the ports on 0.0.0.0 my iptables firewall blocks all of them. I'm not using --iptables=false but I'm not discounting the possibility that maybe I've configured this on a more global level somewhere.

That is still strange ; as you can read from others, docker refreshes it’s own iptable rules which then can mess with your own. Maybe you were lucky but seems unlikely to have that much luck. Be careful anyway; if you opened a port, it’ll be on 0.0.0.0 and docker does rearrange your iptables when the container(s) start. Especially default redis and mongo are good foot-shooters.

Re: I discovered thousands of open databases on AWS

#60

Post by grumple »

jeroenhd wrote: post #14

I used to think you have to be pretty good af your job to get trusted to deploy stuff to the cloud for even medium sized companies. As these articles keep reminding me, you only need to fake competence to management to get the green light. Even if you forget that the cloud is the internet and that the entire internet can reach you over the internet, it doesn't take a genius to set up a password for a cloud service. I…

Yikes. I can't believe this and the responses all agree.

There are two things at play here:

The reality of what happens is that devs with limited experience are asked to do things far outside their comfort zone because they aren't staffed enough. This isn't on the dev, it's on the company and a reality when it comes to growth. People make mistakes.

The second thing is that the databases themselves should be secure by default but are not. That's on the developers of that software. DBs should require setting strong passwords on creation.

Aws should also warn users about exposing these services directly to the outside world instead of just within the vpc.

Post reply on HN