{"id":89993,"date":"2020-07-28T01:42:19","date_gmt":"2020-07-27T23:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb"},"modified":"2020-07-28T01:42:19","modified_gmt":"2020-07-27T23:42:19","slug":"v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","title":{"rendered":"B\u011bhem \u00fatoku Meow bylo odstran\u011bno p\u0159ibli\u017en\u011b 4000 ve\u0159ejn\u011b dostupn\u00fdch datab\u00e1z\u00ed Elasticsearch a MongoDB.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00datok « pokra\u010duje v r\u016fstuMeow<\/a><\/noindex>«, b\u011bhem kter\u00e9ho nezn\u00e1m\u00ed \u00fato\u010dn\u00edci ni\u010d\u00ed data v ve\u0159ejn\u011b dostupn\u00fdch nezabezpe\u010den\u00fdch instalac\u00edch Elasticsearch a MongoDB. Byly tak\u00e9 zaznamen\u00e1ny ojedin\u011bl\u00e9 p\u0159\u00edpady vymaz\u00e1n\u00ed (celkem asi 3 % ze v\u0161ech ob\u011bt\u00ed) pro nezabezpe\u010den\u00e9 datab\u00e1ze zalo\u017een\u00e9 na Apache Cassandra, CouchDB, Redis, Hadoop a Apache ZooKeeper. \u00datok je prov\u00e1d\u011bn prost\u0159ednictv\u00edm bota, kter\u00fd proch\u00e1z\u00ed typov\u00e9 s\u00ed\u0165ov\u00e9 porty datab\u00e1zov\u00fdch syst\u00e9m\u016f. Studium \u00fatoku na p\u0159edstaven\u00fd honeypot server uk\u00e1zalo, \u017ee p\u0159ipojen\u00ed bota se prov\u00e1d\u00ed<\/a><\/noindex> p\u0159es ProtonVPN. Pokud 22. \u010dervence bylo zaznamen\u00e1no asi 1000 vzd\u00e1len\u00fdch datab\u00e1z\u00ed, pak 23. \u010dervence po\u010det zasa\u017een\u00fdch syst\u00e9m\u016f vzrostlo<\/a><\/noindex> vzrostl na p\u0159ibli\u017en\u011b 2500, a v\u010dera p\u0159ekro\u010dil<\/a><\/noindex> dos\u00e1hl 3800, ale dnes klesl na 3750.<\/p>\n

P\u0159\u00ed\u010dinou probl\u00e9m\u016f je otev\u0159en\u00ed ve\u0159ejn\u00e9ho p\u0159\u00edstupu k datab\u00e1z\u00edm bez \u0159\u00e1dn\u00e9ho nastaven\u00ed autentizace. Chybn\u011b nebo nedbalost\u00ed se zpracovatel po\u017eadavk\u016f p\u0159ipojuje nikoli k vnit\u0159n\u00ed adrese 127.0.0.1 (localhost), ale ke v\u0161em s\u00ed\u0165ov\u00fdm rozhran\u00edm, v\u010detn\u011b extern\u00edho. V MongoDB toto chov\u00e1n\u00ed podporuje p\u0159\u00edklad nastaven\u00ed nab\u00edzen\u00fdch ve v\u00fdchoz\u00edm nastaven\u00ed, a v Elasticsearch do vyd\u00e1n\u00ed 6.8<\/a><\/noindex> v bezplatn\u00e9 verzi v\u016fbec nebyly podporov\u00e1ny prost\u0159edky pro \u010dlen\u011bn\u00ed p\u0159\u00edstupu.<\/p>\n

V\u00fdznamn\u00e1 historie<\/a><\/noindex> s poskytovatelem VPN UFO, u kter\u00e9ho byla zji\u0161t\u011bna ve\u0159ejn\u011b p\u0159\u00edstupn\u00e1 datab\u00e1ze Elasticsearch o velikosti 894 GB. Poskytovatel se prezentoval jako ten, kdo se star\u00e1 o soukrom\u00ed u\u017eivatel\u016f a nevede logy. Oproti tvrzen\u00ed ve vylo\u017een\u00e9 datab\u00e1zi byly p\u0159\u00edtomny logy obsahuj\u00edc\u00ed informace o IP adres\u00e1ch, p\u0159i\u0159azen\u00ed sezen\u00ed k \u010dasu, zna\u010dk\u00e1ch o lokaci u\u017eivatele, informac\u00edch o opera\u010dn\u00edm syst\u00e9mu a za\u0159\u00edzen\u00ed u\u017eivatele, seznamu dom\u00e9n pro reklamu v nezabezpe\u010den\u00e9m HTTP provozu. Nav\u00edc v datab\u00e1zi byly p\u0159\u00edstupov\u00e9 hesla v otev\u0159en\u00e9 podob\u011b a sezen\u00ed kl\u00ed\u010de, kter\u00e9 umo\u017e\u0148ovaly de\u0161ifrovat zachycen\u00e9 relace.<\/p>\n

Poskytovatel UFO byl o probl\u00e9mu informov\u00e1n 1. \u010dervence, ale po dva t\u00fddny zpr\u00e1va z\u016fst\u00e1vala bez odpov\u011bdi a 14. \u010dervence byla zasl\u00e1na dal\u0161\u00ed \u017e\u00e1dost hostingov\u00e9mu poskytovateli, po kter\u00e9 byla 15. \u010dervence datab\u00e1ze zabezpe\u010dena. 20. \u010dervence se tato datab\u00e1ze znovu objevila ve\u0159ejn\u011b p\u0159\u00edstupn\u00e1 na jin\u00e9m IP. B\u011bhem n\u011bkolika hodin byla t\u00e9m\u011b\u0159 v\u0161echna data v datab\u00e1zi smaz\u00e1na. Anal\u00fdza tohoto vymaz\u00e1n\u00ed uk\u00e1zala, \u017ee je spojena s masivn\u00edm prov\u00e1d\u011bn\u00fdm \u00fatokem, kter\u00fd dostal n\u00e1zev Meow podle n\u00e1zvu index\u016f, kter\u00e9 byly v datab\u00e1zi ponech\u00e1ny po vymaz\u00e1n\u00ed. Vyhled\u00e1v\u00e1n\u00ed prost\u0159ednictv\u00edm slu\u017eby Shodan uk\u00e1zalo<\/a><\/noindex>, \u017ee ob\u011btmi odstran\u011bn\u00ed se stalo tak\u00e9 n\u011bkolik set server\u016f. Aktu\u00e1ln\u011b se po\u010det odstran\u011bn\u00fdch datab\u00e1z\u00ed bl\u00ed\u017e\u00ed 4000.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 «Meow«, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 Elasticsearch \u0438 MongoDB. \u0415\u0434\u0438\u043d\u0438\u0447\u043d\u044b\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 (\u0432 \u0441\u0443\u043c\u043c\u0435 \u043e\u043a\u043e\u043b\u043e 3% \u043e\u0442 \u0432\u0441\u0435\u0445 \u0436\u0435\u0440\u0442\u0432) \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0411\u0414 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Apache Cassandra, CouchDB, Redis, Hadoop \u0438 Apache ZooKeeper. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0431\u043e\u0442\u0430, \u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u044e\u0449\u0435\u0433\u043e \u0442\u0438\u043f\u043e\u0432\u044b\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u0440\u0442\u044b \u0421\u0423\u0411\u0414. \u0418\u0437\u0443\u0447\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-89993","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47B\u011bhem \u00fatoku Meow bylo odstran\u011bno p\u0159ibli\u017en\u011b 4000 ve\u0159ejn\u011b dostupn\u00fdch datab\u00e1z\u00ed Elasticsearch a MongoDB | ProHoster","description":"\u00datok \"Meow\" pokra\u010duje v zesilov\u00e1n\u00ed, b\u011bhem n\u011bho\u017e nezn\u00e1m\u00ed \u00fato\u010dn\u00edci ni\u010d\u00ed data v.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 Meow \u0443\u0434\u0430\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 4000 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0411\u0414 Elasticsearch \u0438 MongoDB | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 "Meow", \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-27T23:42:19+00:00","article:modified_time":"2020-07-27T23:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89993","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:30","updated":"2022-09-27 20:24:44","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/89993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=89993"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/89993\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=89993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=89993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=89993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}