Slashdot Mirror
The Kremlin's Remote-Access Credentials Left Thousands Of Businesses Exposed For Years (zdnet.com)
A Dutch security researcher says he found credentials for the Russian government's backdoor account for accessing servers of businesses operating in Russia, ZDNet reports:
The researcher says that after his initial finding, he later found the same "admin@kremlin.ru" account on over 2,000 other MongoDB databases that had been left exposed online, all belonging to local and foreign businesses operating in Russia. Examples include databases belonging to local banks, financial institutions, big telcos, and even Disney Russia.... "The first time I saw these credentials was in the user table of a Russian Lotto website," Victor Gevers told ZDNet in an interview Monday. "I had to do some digging to understand that the Kremlin requires remote access to systems that handle financial transactions....
"All the systems this password was on were already fully accessible to anyone," Gevers said. "The MongoDB databases were deployed with default settings. So anyone without authentication had CRUD [Create, Read, Update and Delete] access."
"It took a lot of time and also many attempts to contact and warn the Kremlin about this issue," the researcher added -- specifically, three years, five months and 15 days. The Kremlin reused the same credentials "everywhere," reports IT News, "leaving a large number of businesses open to access from the internet."
Long-time Slashdot reader Bismillah calls it "an illustration of the dangers of giving governments backdoors into systems and networks."
"All the systems this password was on were already fully accessible to anyone," Gevers said. "The MongoDB databases were deployed with default settings. So anyone without authentication had CRUD [Create, Read, Update and Delete] access."
"It took a lot of time and also many attempts to contact and warn the Kremlin about this issue," the researcher added -- specifically, three years, five months and 15 days. The Kremlin reused the same credentials "everywhere," reports IT News, "leaving a large number of businesses open to access from the internet."
Long-time Slashdot reader Bismillah calls it "an illustration of the dangers of giving governments backdoors into systems and networks."
Long-time Slashdot reader Bismillah calls it "an illustration of the dangers of giving governments backdoors into systems and networks."
Make it a contest. See who has worse security, the government, or businesses?
Own servers vs the rest of us.
It's always the Russians. Oh wait...
They really dont care. And when forcing access people who raise this objection are laighed at and told it wont happen. Yet here it is.....
Really? Is this a Russian requirement or just lazy MongoDB admins? Because any thought that Russian law enforcement has to use evidence collected from these systems will be tainted by the possibility that some other persons might have inserted said evidence into a suspects account surreptitiously.
Have gnu, will travel.
Because obviously Mr Putin personally uses those backdoors every day - right from his desk in the Kremlin. It's just like the thousands of Web sites worldwide that have backdoor accounts named "Admin@Whitehouse.gov" or "Admin@CIA.gov".
By the way, I wonder who authorised this "Dutch researcher" to poke around inside 2,000 Web sites located in Russia? Imagine, if you will, that a "Russian researcher" was found to have done the same to over 2,000 sites in the USA. For further credit, try to imagine the headlines, the speeches, the bursting-with-indignation resolutions in Congress...
I am sure that there are many other solipsists out there.
It's always the Dutch.
Very simple.
This is Russia, everyone has two or three sets of books: One for Owner, one for the Mafia boss and one for the Tax service. Obviously nobody cares about the Tax service books.
The government probably doesn't do much hacking
in old Soviet Russia, Kremlin leave front door open.
"Governments should/must NOT allowed back door access to any computers, because governments are not good @ keeping access credentials secure!!! SO LET'S TURN WHOLE INTERNET TO DARK WEB (so governments cannot catch any criminals anymore)!!!"
IMHO: You know who also are not good at keeping access credentials secure? Pretty much EVERYBODY!!!
Instead of complaining, how about creating rules/standards for keeping access credentials secure for everybody to follow, including governments?
Then you have not seen the Russian tax collectors. They carry more firepower than SWAT
Victor posted on his Twitter feed that a bunch of his accounts were compromised and they tried to blackmail him or they would release all the data they found. I wonder who would want to do that? I wonder... https://twitter.com/0xDUDE/sta...
Unlike the countless NSA mandated backdoors. They never ever resulted in any vulnerability or security risk whatsoever... ever!
LOCk em both up.
It's so damn simple and stupid it smells of BS and something that would only work in a really bad Hollywood hacker movie.
I'm not sure I'm getting your point. A typical US-based web site will see about 5 attacks per day originating from Russia. Times 40 million web sites = 200 million attack attempts per day.
You're saying Congress should do something about this?
Anything in particular they should do? I'm guessing "ignore it and play silly political games repeating the words 'Russia' and your political opponent's name over and over" isn't what you have in mind. Can you think of anything useful they can do?
When people combine caps and bold in a post, nothing they write is ever worth reading.
The ease of corruption is staggering! Man that's crazy
Times of Israel is the only paper to report on the Jews who caused the US housing crash of 2007, the billions they reaped and the 500 million pitance of a fine they paid.
The US is a joke.
You just turn it on and it scales right up.
You don't get a "medal" for your spelling & it's MEDDLE dolt + learn to ACCEPT your side (the "AbNoRmaL OnEz") lost, ok? It's reality.
* Additionally - I don't see Stone "folding under pressure" from what I think's a LINE OF UTTER BULLSHIT being put his way - but, we'll see on that note (my guess is we'll see like "the RUSSIANS" & "collusion" on President Trump stuck (it didn't because it's BULLSHIT TOO, lol)).
4++ yrs. & the Brownshirt MINION cannonfodder of SOROS can't accept they lost - & you'd think they'd FIGURE IT OUT - they're LOSERS (it's ALL THEY KNOW HOW TO DO THEIR ENTIRE WASTED USELESS WELFARE SUCKING LEECH LIVES).
Like ALL "your kind"?
You're DESPERATELY TRYING TO "HIDE" MY POST with ABUSED DOWNMODS vs. TRUTH/FACT I POSTED LAST 3x TIMES ON THIS VERY POST losers https://yro.slashdot.org/comme... https://yro.slashdot.org/comme... https://yro.slashdot.org/comme...
(... & JUST to SPITE YOUR LYING ASSES? AGAIN: YOU Keep 'downmodding' & I'll repost AGAIN & RUN YOU DRY of that bullshit, lol - as always).
APK
P.S.=> Loved Joy Behar ADMITTING they F'D UP on the COVINGTON Catholic school LIES they told too https://yro.slashdot.org/comme... saying "We're just so desperate" lol - damn right - LIES from "your kind" PROVE it (the desperation of LYING f'ing LOSERS)... apk
See subject & you also STALK me by UNIDENTIFIABLE anonymous posts, you're not worth reading & you KNOW it, troll!
* :)
APK
P.S.=> Now, I've no time for you other than that - So, it's onwards & UPWARDS (or perhaps 'downwards' is better for this) to "CONTINUUM" on NETFLIX this time... apk
Conspiring(and lying) to mess with the election with foreign entities is illegal. Not to mention, illegal campaign expenditures for which his lawyer is headed to jail. The investigation is nowhere near over and the orange turd is already an unindicted co-conspirator to felonies that already have guilty pleas.
Ask yourself why Trump lied for years about not having business dealings in Russia, if you are capable of rational thought.
numbnuts
This should be a lesson to anyone in a democratic government that requiring back doors to encrypted or authenticated services or communications will inevitably result in catastrophic, long-term damages to the governed population -- financially and with regard to safety.