{"id":89993,"date":"2020-07-28T01:42:19","date_gmt":"2020-07-27T23:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb"},"modified":"2020-07-28T01:42:19","modified_gmt":"2020-07-27T23:42:19","slug":"v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","title":{"rendered":"R\u00fcnnaku k\u00e4igus on eemaldatud umbes 4000 avalikult k\u00e4ttesaadavat Elasticsearchi ja MongoDB andmebaasi.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

R\u00fcnnak j\u00e4tkab hoogu «Meow<\/a><\/noindex>«, mille k\u00e4igus teadmata kurjategijad h\u00e4vitavad andmeid avalikult kergesti ligip\u00e4\u00e4setavates kaitsetuttes Elasticsearchi ja MongoDB installeeringutes. \u00dcksikud puhastamise juhud (kokku umbes 3% k\u00f5igist ohvritest) on samuti registreeritud kaitsetute andmebaaside puhul, mis p\u00f5hinevad Apache Cassandra, CouchDB, Redis, Hadoop ja Apache ZooKeeper. R\u00fcnnak toimub boti kaudu, mis leiab andmebaaside t\u00fc\u00fcpilised v\u00f5rguportid. R\u00fcnnaku uurimine katsetamisserveris n\u00e4itas, et boti \u00fchendamine teostatakse<\/a><\/noindex> ProtonVPN kaudu. Kui 22. juulil registreeriti umbes 1000 eemaldate andmebaasi, siis 23. juulil kasvas m\u00f5jutatud s\u00fcsteemide arv umbes 2500-ni, ja eile<\/a><\/noindex> \u00fcletas 3800 piiri, kuid t\u00e4na on see langenud 3750-ni.<\/a><\/noindex> Probleemide tekkimise p\u00f5hjuseks on avaliku juurdep\u00e4\u00e4su avamine andmebaasidele ilma n\u00f5uetekohase autentimise seadistamiseta. Ekslikult v\u00f5i hooletuse t\u00f5ttu \u00fchendatakse p\u00e4ringute t\u00f6\u00f6tleja mitte sisemise aadressiga 127.0.0.1 (localhost), vaid k\u00f5igi v\u00f5rguliideste juurde, sealhulgas v\u00e4lise juurde. MongoDB-s soosib sellist k\u00e4itumist vaikimisi pakutavate seadete n\u00e4ide, ja Elasticsearchis ei toetatud \u00f5iguste haldamise vahendeid \u00fcldse tasuta versioonis.<\/p>\n

N\u00e4idatakse 6.8<\/a><\/noindex> lugu<\/p>\n

VPN-teenusepakkujast UFO, kellelt avastati avalikult k\u00e4ttesaadav Elasticsearchi andmebaas, mille suurus oli 894 GB. Teenusepakkuja positsioneeris end kui kasutajate privaatsuse eest hoolitsev ja logisid mitte salvestav. Vastupidiselt v\u00e4itele sisaldis \u00e4ssitatud andmebaasis logisid, mis sisaldasid teavet IP-aadresside, seansside sidumise ajaga, asukoha m\u00e4rge, kasutaja operatsioonis\u00fcsteemi ja seadme teavet, domeenide loendit reklaami mittekaitstud HTTP-liikluses. Veelgi enam, andmebaasis olid juurdep\u00e4\u00e4su paroolid avatud kujul ja seansik\u00fcsimused, mis v\u00f5imaldasid salvestatud seanssivastuseid dekr\u00fcpteerida. ajalugu<\/a><\/noindex> VPN-teenuse pakkujaga UFO, kellel tuvastati avalikult ligip\u00e4\u00e4setav Elasticsearchi andmebaas, mille suurus on 894 GB. Teenuse pakkuja reklaamis end kasutaja privaatsuse kaitsjana, v\u00e4ites, et ei s\u00e4ilita logisid. Vastupidiselt v\u00e4idetele sisaldas lekkinud andmebaas logisid, mis sisaldasid teavet IP-aadresside, seansside sidumise aja, kasutaja asukoha temaatika, operatsioonis\u00fcsteemi ja seadme kohta, samuti domeenide loetelu reklaami kohandamiseks kaitsmata HTTP-liiklusse. Veelgi enam, andmebaasis olid ligip\u00e4\u00e4sukoodid selges\u00f5naliselt ja seansside v\u00f5tmed, mis v\u00f5imaldasid dekr\u00fcpteerida p\u00fc\u00fctud seansse.<\/p>\n

UFO teenuspakkuja sai probleemist teada 1. juulil, kuid kaks n\u00e4dalat j\u00e4i s\u00f5num vastuseta ja 14. juulil saadeti h\u00e4\u00e4lestusteenuse pakkujale teine p\u00e4ring, mille j\u00e4rel 15. juulil kaitsti andmebaasi. 20. juulil tuli see andmebaas uuesti avalikku k\u00e4tte teisele IP-le. M\u00f5ne tunni jooksul kustutati praktiliselt k\u00f5ik andmed andmebaasist. Selle kustutamise anal\u00fc\u00fcs n\u00e4itas, et see on seotud laialdase r\u00fcnnakuga, mis sai nimeks Meow andmebaasi kustutamise j\u00e4rel j\u00e4tetud indeksite t\u00f5ttu. Otsing teenuses Shodan n\u00e4itas<\/a><\/noindex>, et kustutamise ohvriks langesid veel mitmed sajad serverid. Praegu on kustutatud andmebaaside arv juba l\u00e4henemas 4000-le.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 «Meow«, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 Elasticsearch \u0438 MongoDB. \u0415\u0434\u0438\u043d\u0438\u0447\u043d\u044b\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 (\u0432 \u0441\u0443\u043c\u043c\u0435 \u043e\u043a\u043e\u043b\u043e 3% \u043e\u0442 \u0432\u0441\u0435\u0445 \u0436\u0435\u0440\u0442\u0432) \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0411\u0414 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Apache Cassandra, CouchDB, Redis, Hadoop \u0438 Apache ZooKeeper. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0431\u043e\u0442\u0430, \u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u044e\u0449\u0435\u0433\u043e \u0442\u0438\u043f\u043e\u0432\u044b\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u0440\u0442\u044b \u0421\u0423\u0411\u0414. \u0418\u0437\u0443\u0447\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-89993","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcnnaku Meow k\u00e4igus on kustutatud umbes 4000 avalikku andmebaasi Elasticsearch ja MongoDB | ProHoster","description":"R\u00fcnnak \"Meow\" j\u00e4tkab hoogsalt, mille k\u00e4igus h\u00e4vitavad tundmatud kurjategijad andmeid.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 Meow \u0443\u0434\u0430\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 4000 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0411\u0414 Elasticsearch \u0438 MongoDB | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 "Meow", \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-27T23:42:19+00:00","article:modified_time":"2020-07-27T23:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89993","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:30","updated":"2022-09-27 20:24:44","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/89993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=89993"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/89993\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=89993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=89993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=89993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}