{"id":89993,"date":"2020-07-28T01:42:19","date_gmt":"2020-07-27T23:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb"},"modified":"2020-07-28T01:42:19","modified_gmt":"2020-07-27T23:42:19","slug":"v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","title":{"rendered":"Under angrebet Meow blev cirka 4000 offentligt tilg\u00e6ngelige Elasticsearch- og MongoDB-databaser fjernet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Angrebet forts\u00e6tter med at tage fart &#171;<noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/MayhemDayOne\/status\/1285303164116389890\">Meow<\/a><\/noindex>&#171;, hvor ukendte angribere \u00f8del\u00e6gger data i offentligt tilg\u00e6ngelige, ubeskyttede installationer af Elasticsearch og MongoDB. Enkeltst\u00e5ende tilf\u00e6lde af sletning (i alt omkring 3% af alle ofre) er ogs\u00e5 blevet registreret for ubeskyttede databaser baseret p\u00e5 Apache Cassandra, CouchDB, Redis, Hadoop og Apache ZooKeeper. Angrebet udf\u00f8res via en bot, der scanner typiske netv\u00e6rksporte for databasesystemer. Unders\u00f8gelsen af angrebet p\u00e5 en falsk honeypot-server viste, at botten kunne forbindes <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/MayhemDayOne\/status\/1286577695946608640\">udf\u00f8res<\/a><\/noindex> skete via ProtonVPN. Hvis der den 22. juli blev registreret omkring 1000 fjernede databaser, s\u00e5 steg antallet af ber\u00f8rte systemer <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/MayhemDayOne\/status\/1286577695946608640\">\u00f8gedes<\/a><\/noindex> til cirka 2500 den 23. juli, og i g\u00e5r <noindex><a rel=\"nofollow\" href=\"https:\/\/www.shodan.io\/search?query=meow+indices\">overskredet<\/a><\/noindex> n\u00e5ede det op p\u00e5 3800, men er faldet til 3750 i dag.<\/p>\n<p>\u00c5rsagen til problemerne er, at offentlig adgang til databaserne er blevet \u00e5bnet uden ordentlig autentifikationskonfiguration. Ved en fejl eller uforsigtighed tilknyttes anmodningsbehandleren ikke til den interne adresse 127.0.0.1 (localhost), men til alle netv\u00e6rksgr\u00e6nseflader, inklusive den eksterne. I MongoDB fremmes en s\u00e5dan adf\u00e6rd af eksempler p\u00e5 standardindstillinger, og i Elasticsearch blev adgangsbegr\u00e6nsningsmidler slet ikke underst\u00f8ttet i den gratis version. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50750\">6.8<\/a><\/noindex> Bem\u00e6rkelsesv\u00e6rdig<\/p>\n<p>er historien <noindex><a rel=\"nofollow\" href=\"https:\/\/www.comparitech.com\/blog\/vpn-privacy\/ufo-vpn-data-exposure\/\">om VPN-udbyderen UFO, der havde en offentligt tilg\u00e6ngelig Elasticsearch-database p\u00e5 894 GB. Udbyderen pr\u00e6senterede sig selv som en, der tager hensyn til brugernes privatliv og ikke f\u00f8rer logfiler. P\u00e5 trods af denne p\u00e5stand indeholdt den eksponerede database logfiler, der inkluderede oplysninger om IP-adresser, sessioner knyttet til tid, placeringstags, oplysninger om operativsystemet og brugerens enhed, samt lister over dom\u00e6ner til reklamesubstitution i usikret HTTP-trafik. Endda var der adgangskoder i klartekst og sessionstokens, der muligg\u00f8r dekryptering af opsnappede sessioner i databasen.<\/a><\/noindex> UFO-udbyderen blev informeret om problemet den 1. juli, men to uger forblev meddelelsen ubesvarede, og den 14. juli blev der sendt en anden anmodning til hostingudbyderen, hvorefter databasen blev beskyttet den 15. juli. Den 20. juli dukkede denne database igen op offentligt tilg\u00e6ngeligt p\u00e5 en anden IP. P\u00e5 blot f\u00e5 timer blev n\u00e6sten alle data i databasen slettet. Unders\u00f8gelsen af denne sletning viste, at det var relateret til et massivt angreb, der fik navnet Meow efter navnet p\u00e5 de indekser, der blev efterladt i databasen efter sletningen. S\u00f8gningen via Shodan<\/p>\n<p>UFO-udbyderen blev informeret om problemet den 1. juli, men i to uger forblev meddelelsen ubesvaret, og den 14. juli blev der sendt en anden anmodning til hostingudbyderen, hvorefter databasen blev sikret den 15. juli. Den 20. juli dukkede denne database igen op i offentligheden p\u00e5 en anden IP. Inden for f\u00e5 timer blev n\u00e6sten alle data i databasen slettet. Unders\u00f8gelsen af denne sletning viste, at den var relateret til en masseangreb, der fik navnet Meow efter de indekser, der blev efterladt i databasen efter sletningen. S\u00f8gning via Shodan-tjenesten. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.shodan.io\/search?query=meow+indices\">hvordan det er let at f\u00e5 et EV-certifikat i navnet \"Stripe, Inc\" (et popul\u00e6rt betalingssystem) blot ved at registrere et selskab med samme navn i en anden stat. For at opdage forskellen skal man under alle omst\u00e6ndigheder se n\u00e6rmere p\u00e5 detaljer om hjemmesiden - oplysninger fra adresselinjen er ikke tilstr\u00e6kkelige. En anden forsker, James Burton, fik et certifikat i navnet p\u00e5 sit registrerede selskab \"Identity Verified\", hvilket ogs\u00e5 let kan forvirre brugerne.<\/a><\/noindex>, at offer of deletion also several hundred servers were affected. Currently, the number of deleted databases is approaching 4000.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Kilde: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53438\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 &#171;Meow&#171;, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 Elasticsearch \u0438 MongoDB. \u0415\u0434\u0438\u043d\u0438\u0447\u043d\u044b\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 (\u0432 \u0441\u0443\u043c\u043c\u0435 \u043e\u043a\u043e\u043b\u043e 3% \u043e\u0442 \u0432\u0441\u0435\u0445 \u0436\u0435\u0440\u0442\u0432) \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0411\u0414 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Apache Cassandra, CouchDB, Redis, Hadoop \u0438 Apache ZooKeeper. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0431\u043e\u0442\u0430, \u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u044e\u0449\u0435\u0433\u043e \u0442\u0438\u043f\u043e\u0432\u044b\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u0440\u0442\u044b \u0421\u0423\u0411\u0414. \u0418\u0437\u0443\u0447\u0435\u043d\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-89993","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 &quot;Meow&quot;, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 Meow \u0443\u0434\u0430\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 4000 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0411\u0414 Elasticsearch \u0438 MongoDB | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 &quot;Meow&quot;, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-27T23:42:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-27T23:42:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Under angrebet Meow er cirka 4000 offentligt tilg\u00e6ngelige databaser Elasticsearch og MongoDB blevet slettet | ProHoster","description":"Angrebet \"Meow\" forts\u00e6tter med at vinde frem, hvor ukendte gerningsm\u00e6nd \u00f8del\u00e6gger data i.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 Meow \u0443\u0434\u0430\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 4000 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0411\u0414 Elasticsearch \u0438 MongoDB | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 &quot;Meow&quot;, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-27T23:42:19+00:00","article:modified_time":"2020-07-27T23:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89993","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:30","updated":"2022-09-27 20:24:44","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/89993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=89993"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/89993\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=89993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=89993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=89993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}