Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cache On Delivery — Memcached Opens an Accidental Security Hole

Posted by timothy on from the everything-has-a-downside dept.

jamie spotted this eye-opening presentation (here's a longer explanation) about how easy it is to access sensitive data on many sites using memcached, writing "If you already know what memcached is, skim to slide #17. The jaw-drop will happen around slide #33. Turns out many websites expose their totally-non-protected memcached interface to the Internet, including gowalla, bit.ly, and PBS."

4 of 149 comments (clear)

  1. I fail to see why this is news by OverlordQ · · Score: 5, Insightful

    Much less 'memcached' being at fault. They say it themselves:

    Memcached does not spend much, if any, effort in ensuring its defensibility from random internet connections. So you must not expose memcached directly to the internet, or otherwise any untrusted users.

    All this is is stupid admins doing stupid things story and those are dime a dozen.

    --
    Your hair look like poop, Bob! - Wanker.
    1. Re:I fail to see why this is news by TheRaven64 · · Score: 5, Insightful

      Which is exactly the point. The default install should never be working-and-insecure. It should be secure, and ideally it should be working. If it is not possible for the default install to be both useful and secure, as appears to be the case with memcached, then it should install only listening on localhost and require explicit intervention by the user to accept connections from other hosts.

      If you can install it and have it work by default, then there is no reason for the user to bother reading the manual, so they won't learn that it needs to be specially configured to be secure. If the default is secure but not particularly useful, then the user needs to explicitly adjust the setting that makes it insecure, and in so doing needs to read the documentation explaining that this will make it insecure and how to mitigate it.

      --
      I am TheRaven on Soylent News
  2. More Boiled and Distilled. by SuperKendall · · Score: 5, Insightful

    Memcache allows anyone to overwrite a cache instance. Seriously? It does not authenticate a write to the cache? And they didn't see this as a problem when desgining memcache? Really?

    Anyone can write on your underwear too, if you are stupid enough to wear it outside your pants.

    Is that an underwear design flaw?

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:More Boiled and Distilled. by Farmer+Tim · · Score: 5, Insightful

      Best. Analogy. Ever.

      --
      Blank until /. makes another boneheaded UI decision.