61–70 of 544 posts
Earlier quoted context omitted.
Most SAAS db providers provide their database over the internet, but secured with a login/pass. Eg all DB's on Heroku elements marketplace work like this.
You can also usually lock it down by IP address.
Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.
No other bad actors can get it, but we don't know if it's already been found, and now that it's gone we have no idea what data is out in the wild. And as you note, we can't trust the companies to accurately report it themselves.
Damn, last week we were wondering where did our data went and why there are so many meow indexes! We were meowed !!!
How does this work? Will it affect MySQL databases accessible from the Internet but secured with a long random password?
Earlier quoted context omitted.
No other bad actors can get it, but we don't know if it's already been found, and now that it's gone we have no idea what data is out in the wild. And as you note, we can't trust the companies to accurately report it themselves.
Ideally they'd report it so that password managers could warn everyone, but with just the database URI there isn't necessarily any obvious way to know what domain or business its associated with.
Earlier quoted context omitted.
Databases that are read only would be unaffected by this attack.
Read-only in practice, not inherently read-only in the way that e.g. CD-ROM is. Such systems still need to have their otherwise-static dataset updated "online" by an ETL pipeline agent-user. Which often means, in the DBMSes with less fine-grained security models, that such users need to have full DML (and even DDL) capabilities, rather than only insert capability.
How does this work? Will it affect MySQL databases accessible from the Internet but secured with a long random password?
Don't expose MySQL databases to the internet. Just don't. Stick an API layer in at the very least with key based auth, and only the bare minimum capabilities allowed for the user. That said, if you'd read the article you'd see that so far only unsecured MongoDB, Elasticsearch and Redis installations are being attacked so far.