Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cache On Delivery — Memcached Opens an Accidental Security Hole

Posted by timothy on from the everything-has-a-downside dept.

jamie spotted this eye-opening presentation (here's a longer explanation) about how easy it is to access sensitive data on many sites using memcached, writing "If you already know what memcached is, skim to slide #17. The jaw-drop will happen around slide #33. Turns out many websites expose their totally-non-protected memcached interface to the Internet, including gowalla, bit.ly, and PBS."

1 of 149 comments (clear)

  1. Let me see if I understand this by Anonymous Coward · · Score: -1, Troll

    Let me see if I understand this and can boil it down:

    Memcache allows anyone to overwrite a cache instance. Seriously? It does not authenticate a write to the cache? And they didn't see this as a problem when desgining memcache? Really?