Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cache On Delivery — Memcached Opens an Accidental Security Hole

Posted by timothy on from the everything-has-a-downside dept.

jamie spotted this eye-opening presentation (here's a longer explanation) about how easy it is to access sensitive data on many sites using memcached, writing "If you already know what memcached is, skim to slide #17. The jaw-drop will happen around slide #33. Turns out many websites expose their totally-non-protected memcached interface to the Internet, including gowalla, bit.ly, and PBS."

5 of 149 comments (clear)

  1. Re:Firewall? by IICV · · Score: 4, Interesting

    Yeah, slide 52 (paraphrased) is as follows:

    Fixes?

    1. FW. FW. FW. FW. FW. FW. FW. FW. FW. FW. FW. FW. FW. FW....
    2. .....
    3. Also, FW

    I assume he means "firewalls" by "FW". Seriously, you can't even bother to spell out "firewall" in a presentation?

  2. Admin or distro? by shish · · Score: 5, Interesting

    Debian's default config says:

    # Specify which IP address to listen on. The default is to listen on all IP addresses
    # This parameter is one of the only security measures that memcached has, so make sure
    # it's listening on a firewalled interface.
    -l 127.0.0.1

    Are there any distros that don't have it locked down by default? I would hope not, but if something has it insecure out of the box with no warning that might explain it... (though a good sysadmin would firewall all internal services, whether the documentation tells them to or not)

    --
    I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
    1. Re:Admin or distro? by Paul+Jakma · · Score: 2, Interesting

      So what if you want to run memcached on a multi-user machine?

      It's slightly mad that software like this, which is designed without security, would use TCP per default, instead of local Unix sockets (access to which can be controlled with standard Unix filesystem permissions on the containing directory (careful about relying on permissions on the socket itself have any effect - not portable)). Indeed, it doesn't even seem to support Unix sockets (would be a trivial patch though).

      --
      I use Friend/Foe + mod-point modifiers as a karma/reputation system.
  3. Re:A few clarifications by marcoslaviero · · Score: 5, Interesting

    There's a deeper issue at play here as it relates to shifting apps and platforms away from your own hardware/networks. Developers are now often responsible for deploying apps onto cloud systems where they don't have experience with network-security or the tools for protecting network-based services, and this is an obvious difference from the traditional network/app split that occurs in most corporates. It doesn't help that memcached (by default) binds to * but they do make this pretty clear (also, remote enumeration of the cache is genuinely a debug feature).

    Man pages help, but when the defaults don't aid developers we need to a rethink both of the software (memcached) and the systems were it's not running securely (cloud platforms).

  4. Re:I fail to see why this is news by Enleth · · Score: 2, Interesting

    netstat -lpn seems simple enough. I tend to run it every time I change something in a configuration file of a network-enabled service, just to be sure. It would be irresponsible to do otherwise.

    --
    This is Slashdot. Common sense is futile. You will be modded down.