Slashdot Mirror
Researchers Find Over 6,000 Compromised Redis Installations (riskbasedsecurity.com)
An anonymous Slashdot reader writes:
Security researchers have discovered over 6,000 compromised installations of Redis, the open source in-memory data structure server, among the tens of thousands of Redis servers indexed by Shodan. "By default, Redis has no authentication or security mechanism enabled, and any security mechanisms must be implemented by the end user."
The researchers also found 106 different Redis versions compromised, suggesting "there are a lot of Redis installations that are not upgrading to the most recent versions to fix any known security issues." 5,892 infections were linked to the same email address, with two more email addresses that were both linked to more than 200. "The key take away from this research for us has been that insecure default installations continue to be a significant issue, even in 2016."
Redis "is designed to be accessed by trusted clients inside trusted environments," according to its documentation. "This means that usually it is not a good idea to expose the Redis instance directly to the internet or, in general, to an environment where untrusted clients can directly access the Redis TCP port or UNIX socket... Redis is not optimized for maximum security but for maximum performance and simplicity."
The researchers also found 106 different Redis versions compromised, suggesting "there are a lot of Redis installations that are not upgrading to the most recent versions to fix any known security issues." 5,892 infections were linked to the same email address, with two more email addresses that were both linked to more than 200. "The key take away from this research for us has been that insecure default installations continue to be a significant issue, even in 2016."
Redis "is designed to be accessed by trusted clients inside trusted environments," according to its documentation. "This means that usually it is not a good idea to expose the Redis instance directly to the internet or, in general, to an environment where untrusted clients can directly access the Redis TCP port or UNIX socket... Redis is not optimized for maximum security but for maximum performance and simplicity."
Belonging to outsourced "software engineers" (i.e. copy-pasters) making $3/hr working for Tata or Infosys?
"5,892 infections were linked to the same email address, with two more email addresses that were both linked to more than 200."
Redis "is designed to be accessed by trusted clients inside trusted environments," according to its documentation. "This means that usually it is not a good idea to expose the Redis instance directly to the internet or, in general, to an environment where untrusted clients can directly access the Redis TCP port or UNIX socket..."
What part of "Don't leave this open to the Internet" is not clear?
Il n'y a pas de Planet B.
Did some contracting work for a firm that builds software for public transportation. Posting anon because of that. Software uses NServiceBus. They need persistence support for NServiceBus. So that meant that RavenDB got enabled. Suddenly end-customer asks why some port is open and why when they browse to it with a webbrowser they find a website that leaks all sorts of data about travelers and about their billing data.
Response from our project manager: none. He just didn't understand the issue.
I'm sure such horror and daily-wtf stories happen all the times.
This is a systemic problem in development, and not just in the software world. Quite often it is difficult to explain the necessity of additional work when the prototype works. Security is invisible, so under tight resource constraints it is the first to get dropped. You can see the same problem in all sorts of tutorials on the web: Almost every tutorial stops once the desired functionality is achieved. It is also important to disable or block off "undesired functionality", yet that part is rarely found in tutorials.
Thank you for this information. I've seen several how-to guides on setting up Redis in various environments but did not come across this stark warning in any of them!
""By default, Redis has no authentication or security mechanism enabled..."
Why? Why in the world would you make this the default?
Just cruising through this digital world at 33 1/3 rpm...
Okay, I'll stick my neck out. Why can't the redis port be tunneled through ssh?
227-3517
This is the first time I've heard of Redis. Would it have killed you to include a short description in the summary?
From google:
Redis is an open source (BSD licensed), in-memory data structure store, used as database, cache and message broker.
@antirez of Redis here. The original idea was to stick to this original model of "care about your setup", but given the disaster of exposed Redis instances, since Redis 3.2 version, now Redis has a "protected mode" feature that basically means that when the server detects to be: 1) configured to listen to all interfaces. 2) Without any password set, it enters a special setup where connections from localhost works, but connection from external interfaces are accepted only to be served with a fixed reply "This is protected mode bla bla bla make sure you understand that this instance is not secure". The long message includes instructions on how to fix the setup ASAP in different ways (both secure and insecure ways) in order to re-allow access from external clients. So this should improve in the next months as people upgrade.