411–420 of 544 posts
Earlier quoted context omitted.
What about developers just being competent before deploying a database on the public internet? At least google "securing X" before just pumping data in.
How about all professionals in every industry being competent before doing anything? Then we wouldn't have any issues in society.
ELI5: Way back in the early 2000s I was a young mid level developer and we had a SQL Server backed solution. There was a wide spread attack on Sql Server installations that didn’t change the default blank SA password. We were one of the companies that didn’t. But, even then I knew not to have a publicly accessible database server. We just didn’t give the server a public IP address. Nothing fancy. We weren’t affected…
Because you're completely wrong; what you're advocating is nothing more than security by obscurity. An address is just an address; it tells you where something is. If you don't have a firewall in place, then any attacker who cares enough to actually route a packet to your internal servers can access them. If you do have a firewall in place, then an attacker gains nothing from knowing the address of a server they can'…
You know a “private IP address” isn’t one that’s not known it’s one that not routable over the public internet.
RFC 1918 was written in 1993
Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol
I hate to laugh when people's hard work is being destroyed, but this is some impressive trolling by the attacker: > An interesting theory as to why the attacker used the term "meow" is because cats like to drop (or knock) items from tables.
ELI5: Way back in the early 2000s I was a young mid level developer and we had a SQL Server backed solution. There was a wide spread attack on Sql Server installations that didn’t change the default blank SA password. We were one of the companies that didn’t. But, even then I knew not to have a publicly accessible database server. We just didn’t give the server a public IP address. Nothing fancy. We weren’t affected…
> Why do people keep making the same mistake? Because there are always new developers showing up that haven't been taught. (Eternal September if you will) The real solution would be: 1. We are past the point were our practice needs professional licensure. We need standards, a governing body, and ethics. 2. Those above items need to be taught to new developers. How long has security been an after thought to CS degree…
Earlier quoted context omitted.
Because you're completely wrong; what you're advocating is nothing more than security by obscurity. An address is just an address; it tells you where something is. If you don't have a firewall in place, then any attacker who cares enough to actually route a packet to your internal servers can access them. If you do have a firewall in place, then an attacker gains nothing from knowing the address of a server they can'…
You realize you can’t get to a private IP address over the Internet right? It’s kind of how that whole TCP/IP thing works. You know a “private IP address” isn’t one that’s not known it’s one that not routable over the public internet. RFC 1918 was written in 1993
Of course you can - most end users have private IP addresses these days, yet they somehow manage to communicate with people on the internet.
A private IP address is of course not routable directly on the Internet. But routers route, and can certainly route a packet from the public internet to an RFC 1918 private address. If the routers on the edge of your RFC1918 network do not have firewalls in place, then they will happily route packets to your internal servers and you're no better off (against a serious attacker; a script kiddie might ignore you as too much effort, sure) than if you used public addresses. If those routers do have firewalls in place, then you're also no better off than if you used public addresses.
Earlier quoted context omitted.
How about all professionals in every industry being competent before doing anything? Then we wouldn't have any issues in society.
Strawman. And a weak one at that. Fuck off with conflating the minimum amount of competency needed to secure the data you needlessly collect with that kind of naivete.
Earlier quoted context omitted.
Oops no welfare for you! I understand that some people won't learn without encouragement but it's not a good thing for all.
online databases that can be written and deleted by anyone on the internet are no good at all. The data can't be trusted. Of course no welfare for you! All I do is to replace all the names with my name and I can take all the welfare in the whole country! Or for example, doing a search for names and replacing all female names with male names ... how can you trust a database like that? Making decisions based on a writa…
Earlier quoted context omitted.
You realize you can’t get to a private IP address over the Internet right? It’s kind of how that whole TCP/IP thing works. You know a “private IP address” isn’t one that’s not known it’s one that not routable over the public internet. RFC 1918 was written in 1993
> You realize you can’t get to a private IP address over the Internet right? Of course you can - most end users have private IP addresses these days, yet they somehow manage to communicate with people on the internet. A private IP address is of course not routable directly on the Internet. But routers route, and can certainly route a packet from the public internet to an RFC 1918 private address. If the routers on th…
Any NAT would be stateful and the communication would have had to be initiated from the cluster.
Not having a public IP address is not about “obscuring” the IP address. It’s not like so said why didn’t they have ES listening on a non standard port.
If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…
That's just victim blaming. The same logic applies to every crime: "lock your doors if you don't want your TV to be stolen!". It also works at any level of security: "Lock your doors and hire guards if you don't want clever thieves breaking a window..." But if you require everyone to take adequate measures to physically secure their houses, you don't even need laws and morality! And while this may provide the sort of…
Earlier quoted context omitted.
Recommend to setup two subnets in your project. One public and one private. This prevents this sort of issues, instances in the private subnet simply don't get a public IP, they can't be reached over the internet. For reference, the standard practice in a company is to have a (third) separate subnet for databases, with zero internet access (no NAT gateway). Connection must be explicitly opened from/to database client…
> Recommend to setup two subnets in your project. One public and one private. This is very good advice. We recently had a uni project where we had to use a MongoDB database. Somebody just apt-get installed a mongodb onto a DO droplet called it a day. Two days later the only remaining records prompted us to transfer x amount of BTC to a adress that was store in our DB. It just contained dummy data, but it is worrying…
If the default install does this, then I'd blame the package /distro maintainers. It should definitely at least only listen on localhost by default, with stern warnings what is going to happen if you change that without setting up proper security.