Slashdot Mirror
Database Attacks Spread To CouchDB, Hadoop, and ElasticSearch Servers (bleepingcomputer.com)
An anonymous reader writes: Two weeks after cybercriminal groups started to hijack and hold for ransom MongoDB servers, similar attacks are now taking place against CouchDB, Hadoop, and ElasticSearch servers. According to the latest tallies, the number of hijacked MongoDB servers is 34,000 (out of 69,000 available on Shodan), 4,681 ElasticSearch clusters (out of 33,000), 126 Hadoop datastores (out of 5,400), and 452 CouchDB databases (out of 4,600). Furthermore, the group that has hijacked the most MongoDB and ElasticSearch servers is also selling the scripts it used for the attacks.
Two security researchers are tracking the attacks on Google spreadsheets, and report that when a ransom is paid, many victims still report that their data is never restored. But the researchers also identified 124 Hadoop servers where the attacker simply replaced all the tables with a data entry named NODATA4U_SECUREYOURSHIT. "What's strange about these attacks is that the threat actor isn't asking for a ransom demand," reports Bleeping Computer. "Instead, he's just deleting data from Hadoop servers that have left their web-based admin panel open to remote connections on the Internet."
Two security researchers are tracking the attacks on Google spreadsheets, and report that when a ransom is paid, many victims still report that their data is never restored. But the researchers also identified 124 Hadoop servers where the attacker simply replaced all the tables with a data entry named NODATA4U_SECUREYOURSHIT. "What's strange about these attacks is that the threat actor isn't asking for a ransom demand," reports Bleeping Computer. "Instead, he's just deleting data from Hadoop servers that have left their web-based admin panel open to remote connections on the Internet."
data ain't worth it. "shit".
They ARE WEBSCALE!
http://saveie6.com/
It's really, really pathetic how often NoSQL DBs make even MySQL look good.
Events like this are what keep sysadmins employed. If you're not paying someone to protect your technology infrastructure, including a layered backup strategy, an effective security policy, and regular audits, this is going to happen to you too.
The wheel it turns, around and around, with an ancient rumbling sound.
That's how it should be. The only way we can ever get corporations to be more secure is by hurting them. A little ransom doesn't hurt.
Irresponsible disclosure is responsible
Publicly and destructively reminding sysadmins to secure their data, rather than issuing sub rosa demands for bitcoins, is in some sense a reasonable approximation of internet philanthropy. And I notice that -- in contrast to standard ransomware procedure -- backups weren't targeted. More power to them.
The opinions stated herein do not necessarily represent those of anybody at all. Deal with it.
> the attacker simply replaced all the tables with a data entry named NODATA4U_SECUREYOURSHIT. "What's strange about these attacks is that the threat actor isn't asking for a ransom demand," reports Bleeping Computer. "Instead, he's just deleting data from Hadoop servers that have left their web-based admin panel open to remote connections on the Internet." Glad to see there's still some people doing it for the lulz.
I hope all of these admins are now getting well deserved unemployment checks. This was just plain stupid, and not being a security expert is no excuse.
I expect that quite a few people knew that there were a lot of not adequately secured and Internet-visible DB installations. It was only a question of time until somebody with the criminal energy to use that came along.
Morale: If it is insecure and connected to the Internet, it will get hacked sooner or later.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
While I sort-of agree, with management always looking for cheapest (not "cheapest possible that still gets the job done"), their replacements will likely be worse.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
>Furthermore, the group that has hijacked the most MongoDB and ElasticSearch servers is also selling the scripts it used for the attacks.
Well yea, they've extracted much of the money they are going to get from the victims (people are fixing things, or failing to pay because they've been hacked 6 times in a row and have no idea how to get their data.)
>But the researchers also identified 124 Hadoop servers where the attacker simply replaced all the tables with a data entry named NODATA4U_SECUREYOURSHIT. "What's strange about these attacks is that the threat actor isn't asking for a ransom demand," reports Bleeping Computer. "Instead, he's just deleting data from Hadoop servers that have left their web-based admin panel open to remote connections on the Internet."
I was wondering when we'd start to see this kind of activity. I suspect we'll eventually start to see this with the IoT devices - someone will hack the botnet code to brick (perhaps temporarily, perhaps permanently) devices that are infectable, so as to reduce the havoc those devices are causing. Morally I can't justify breaking other people's stuff just because they are a pain in my ass, but clearly there's someone out there who doesn't share my values.
A thousand pounds of wood moving at 300 feet per minute. Don't get in the way.
That's true. Cream may rise to the top, but shit floats.
Ransomware is web scale!
But, does shit float in cream?
Enquiring minds want to know.
-- Alastair
Always secure your admin console. Make sure they do not ever listen to remote addresses, 127.0.0.1 is a good address to use. Also make sure it have a nice long secure password and after updates and patches test the login. Negative test it. That's just basic DBA work. It can even be scripted.
putting the 'B' in LGBTQ+
"What's strange about these attacks is that the threat actor isn't asking for a ransom demand," reports Bleeping Computer. "Instead, he's just deleting data from Hadoop servers that have left their web-based admin panel open to remote connections on the Internet."
Sad times when a thing like this is now considered strange, why-o-why didn't the hacker ask for money!?
On a long enough timeline, the survival rate for everyone drops to zero.