Slashdot Mirror
Database Attacks Spread To CouchDB, Hadoop, and ElasticSearch Servers (bleepingcomputer.com)
An anonymous reader writes: Two weeks after cybercriminal groups started to hijack and hold for ransom MongoDB servers, similar attacks are now taking place against CouchDB, Hadoop, and ElasticSearch servers. According to the latest tallies, the number of hijacked MongoDB servers is 34,000 (out of 69,000 available on Shodan), 4,681 ElasticSearch clusters (out of 33,000), 126 Hadoop datastores (out of 5,400), and 452 CouchDB databases (out of 4,600). Furthermore, the group that has hijacked the most MongoDB and ElasticSearch servers is also selling the scripts it used for the attacks.
Two security researchers are tracking the attacks on Google spreadsheets, and report that when a ransom is paid, many victims still report that their data is never restored. But the researchers also identified 124 Hadoop servers where the attacker simply replaced all the tables with a data entry named NODATA4U_SECUREYOURSHIT. "What's strange about these attacks is that the threat actor isn't asking for a ransom demand," reports Bleeping Computer. "Instead, he's just deleting data from Hadoop servers that have left their web-based admin panel open to remote connections on the Internet."
Two security researchers are tracking the attacks on Google spreadsheets, and report that when a ransom is paid, many victims still report that their data is never restored. But the researchers also identified 124 Hadoop servers where the attacker simply replaced all the tables with a data entry named NODATA4U_SECUREYOURSHIT. "What's strange about these attacks is that the threat actor isn't asking for a ransom demand," reports Bleeping Computer. "Instead, he's just deleting data from Hadoop servers that have left their web-based admin panel open to remote connections on the Internet."
data ain't worth it. "shit".
They ARE WEBSCALE!
http://saveie6.com/
It's really, really pathetic how often NoSQL DBs make even MySQL look good.
Events like this are what keep sysadmins employed. If you're not paying someone to protect your technology infrastructure, including a layered backup strategy, an effective security policy, and regular audits, this is going to happen to you too.
The wheel it turns, around and around, with an ancient rumbling sound.
That's how it should be. The only way we can ever get corporations to be more secure is by hurting them. A little ransom doesn't hurt.
Irresponsible disclosure is responsible
Publicly and destructively reminding sysadmins to secure their data, rather than issuing sub rosa demands for bitcoins, is in some sense a reasonable approximation of internet philanthropy. And I notice that -- in contrast to standard ransomware procedure -- backups weren't targeted. More power to them.
The opinions stated herein do not necessarily represent those of anybody at all. Deal with it.
Some men just want to watch the world burn.
How do they trump when faggots always have a cock up there?
> the attacker simply replaced all the tables with a data entry named NODATA4U_SECUREYOURSHIT. "What's strange about these attacks is that the threat actor isn't asking for a ransom demand," reports Bleeping Computer. "Instead, he's just deleting data from Hadoop servers that have left their web-based admin panel open to remote connections on the Internet." Glad to see there's still some people doing it for the lulz.
Loser.
I hope all of these admins are now getting well deserved unemployment checks. This was just plain stupid, and not being a security expert is no excuse.
I expect that quite a few people knew that there were a lot of not adequately secured and Internet-visible DB installations. It was only a question of time until somebody with the criminal energy to use that came along.
Morale: If it is insecure and connected to the Internet, it will get hacked sooner or later.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
While I sort-of agree, with management always looking for cheapest (not "cheapest possible that still gets the job done"), their replacements will likely be worse.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
1. Content that does not need to be indexed, encrypt _before_ inserting.
2. Write a journal of all inserts and updates somewhere, backup offline, so that the database isn't the only authoritative source of information.
3. Have a hot spare of the database running.
Simple shit like that, and other basic stuff. People too lazy to prepare in advance create rods for their own backs. At times like these, it makes me wonder if sysadmins are closet IT masochists who want to be punished for being bad. The worst was that with mongodb, which by default has auth security switched off, some of those who were hacked were hacked because they couldn't be bothered to switch auth security on. Civil engineers that were as sloppy would struggle to keep their career going.
Morale: If it is insecure and connected to the Internet, it will get hacked sooner or later.
Corallary: Using complex new technologies that you don't fully understand, like MongoDB or Hadoop, is a sure fire way to get into trouble. Just because the "cool" kids are using it doesn't meant that it's a good choice for your project too. Think before taking something new and shiny into your production code. Do you really need that? Do you have the problem that you think you have? Getting your butt handed to you by hackers is a hell of way to find out that you made the wrong choice. Businesses have failed for less.
>Furthermore, the group that has hijacked the most MongoDB and ElasticSearch servers is also selling the scripts it used for the attacks.
Well yea, they've extracted much of the money they are going to get from the victims (people are fixing things, or failing to pay because they've been hacked 6 times in a row and have no idea how to get their data.)
>But the researchers also identified 124 Hadoop servers where the attacker simply replaced all the tables with a data entry named NODATA4U_SECUREYOURSHIT. "What's strange about these attacks is that the threat actor isn't asking for a ransom demand," reports Bleeping Computer. "Instead, he's just deleting data from Hadoop servers that have left their web-based admin panel open to remote connections on the Internet."
I was wondering when we'd start to see this kind of activity. I suspect we'll eventually start to see this with the IoT devices - someone will hack the botnet code to brick (perhaps temporarily, perhaps permanently) devices that are infectable, so as to reduce the havoc those devices are causing. Morally I can't justify breaking other people's stuff just because they are a pain in my ass, but clearly there's someone out there who doesn't share my values.
A thousand pounds of wood moving at 300 feet per minute. Don't get in the way.
Thank you for some truth!
That's true. Cream may rise to the top, but shit floats.
The Elasticsearch attack (the common versions so far) is a wildcard/_all index delete along with the creation of a few attention-getting indexes. Attackers don't bother making a copy of the data (hugely time/space-wasting and pointless -- generally it's just logs or development clusters), and if they did copy the data, they certainly wouldn't hold it securely for the owner.
Your data got deleted, that's all.
It's true, if you leave your keys in the car long enough, someone will drive away in it.
Ransomware is web scale!
But, does shit float in cream?
Enquiring minds want to know.
-- Alastair
Always secure your admin console. Make sure they do not ever listen to remote addresses, 127.0.0.1 is a good address to use. Also make sure it have a nice long secure password and after updates and patches test the login. Negative test it. That's just basic DBA work. It can even be scripted.
putting the 'B' in LGBTQ+
"What's strange about these attacks is that the threat actor isn't asking for a ransom demand," reports Bleeping Computer. "Instead, he's just deleting data from Hadoop servers that have left their web-based admin panel open to remote connections on the Internet."
Sad times when a thing like this is now considered strange, why-o-why didn't the hacker ask for money!?
On a long enough timeline, the survival rate for everyone drops to zero.
What a truly inclusive and progressive opinion you have shared. Thanks for convincing me with your surprisingly detailed argument that the Democratic Party is clearly the future I should be voting for.
No wait, you are a bigoted fuck face displaying the characteristics that most people project on to Trump supporters. Go sit on a railroad spike.
Fucks sake, block all so called "security" researchers.