{"id":89993,"date":"2020-07-28T01:42:19","date_gmt":"2020-07-27T23:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb"},"modified":"2020-07-28T01:42:19","modified_gmt":"2020-07-27T23:42:19","slug":"v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","title":{"rendered":"\u00cen timpul atacului Meow, aproximativ 4000 de baze de date Elasticsearch \u0219i MongoDB publice au fost \u0219terse.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Atacul continu\u0103 s\u0103 c\u00e2\u0219tige amploare «Meow<\/a><\/noindex>«, \u00een cadrul c\u0103ruia atacatori necunoscu\u021bi distrug datele din instal\u0103rile Elasticsearch \u0219i MongoDB publice, neprotejate. Cazuri izolate de \u0219tergere (\u00een total aproximativ 3% din toate victimele) au fost, de asemenea, \u00eenregistrate pentru baza de date neprotejat\u0103 bazat\u0103 pe Apache Cassandra, CouchDB, Redis, Hadoop \u0219i Apache ZooKeeper. Atacul este realizat printr-un bot care scaneaz\u0103 porturile standard ale SGBD-urilor. Studiul atacului pe un server honeypot fals a ar\u0103tat c\u0103 botul se conecteaz\u0103 se realizeaz\u0103<\/a><\/noindex> se face prin ProtonVPN. Dac\u0103 pe 22 iulie au fost \u00eenregistrate aproximativ 1000 de baze de date \u0219terse, pe 23 iulie num\u0103rul sistemelor afectate a crescut<\/a><\/noindex> aproximativ la 2500, iar ieri a dep\u0103\u0219it<\/a><\/noindex> a atins 3800, dar a sc\u0103zut ast\u0103zi la 3750.<\/p>\n

Cauza problemelor este deschiderea accesului public la baze de date f\u0103r\u0103 o configurare corespunz\u0103toare a autentific\u0103rii. Din gre\u0219eal\u0103 sau din neglijen\u021b\u0103, procesatorul de cereri se ata\u0219eaz\u0103 nu la adresa intern\u0103 127.0.0.1 (localhost), ci la toate interfe\u021bele re\u021belei, inclusiv cea extern\u0103. \u00cen MongoDB, acest comportament este sprijinit de exemplele de configurare furnizate \u00een mod implicit, iar \u00een Elasticsearch, \u00eenainte de versiunea 6.8<\/a><\/noindex> din versiunea gratuit\u0103, nu au fost sus\u021binute deloc m\u0103suri de delimitare a accesului.<\/p>\n

Impresionant\u0103 este povestea<\/a><\/noindex> cu furnizorul de VPN UFO, care a avut o baz\u0103 de date Elasticsearch public disponibil\u0103, de 894 GB. Furnizorul s-a pozi\u021bionat ca fiind preocupat de confiden\u021bialitatea utilizatorilor \u0219i care nu p\u0103streaz\u0103 jurnale. Contrar afirma\u021biei sale, baza de date expus\u0103 con\u021binea jurnale, incluz\u00e2nd informa\u021bii despre adrese IP, asocierea sesiunilor cu timpul, etichete de localizare a utilizatorului, informa\u021bii despre sistemul de operare \u0219i dispozitivul utilizatorului, liste de domenii pentru inserarea de publicitate \u00een traficul HTTP nesecurizat. Mai mult, \u00een baza de date existau parole de acces \u00een clar \u0219i chei de sesiune care permiteau decriptarea sesiunilor capturate.<\/p>\n

Furnizorul UFO a fost informat despre problem\u0103 pe 1 iulie, dar timp de dou\u0103 s\u0103pt\u0103m\u00e2ni mesajul a r\u0103mas f\u0103r\u0103 r\u0103spuns, iar pe 14 iulie a fost trimis\u0103 o alt\u0103 cerere c\u0103tre furnizorul de hosting, dup\u0103 care pe 15 iulie baza de date a fost protejat\u0103. Pe 20 iulie, aceast\u0103 baz\u0103 de date a reap\u0103rut public pe o alt\u0103 adres\u0103 IP. \u00cen c\u00e2teva ore, aproape toate datele din baza de date au fost \u0219terse. Analiza acestei \u0219tergeri a ar\u0103tat c\u0103 aceasta este legat\u0103 de un atac masiv, denumit Meow, dup\u0103 numele indicilor l\u0103sa\u021bi \u00een baza de date dup\u0103 \u0219tergere. C\u0103utarea prin serviciul Shodan a ar\u0103tat<\/a><\/noindex>, faptul c\u0103 victimele \u0219tergerii au fost \u0219i alte c\u00e2teva sute de servere. \u00cen prezent, num\u0103rul bazelor de date \u0219terse se apropie de 4000.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 «Meow«, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 Elasticsearch \u0438 MongoDB. \u0415\u0434\u0438\u043d\u0438\u0447\u043d\u044b\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 (\u0432 \u0441\u0443\u043c\u043c\u0435 \u043e\u043a\u043e\u043b\u043e 3% \u043e\u0442 \u0432\u0441\u0435\u0445 \u0436\u0435\u0440\u0442\u0432) \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0411\u0414 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Apache Cassandra, CouchDB, Redis, Hadoop \u0438 Apache ZooKeeper. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0431\u043e\u0442\u0430, \u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u044e\u0449\u0435\u0433\u043e \u0442\u0438\u043f\u043e\u0432\u044b\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u0440\u0442\u044b \u0421\u0423\u0411\u0414. \u0418\u0437\u0443\u0447\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-89993","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cen urma atacului Meow, aproximativ 4000 de baze de date Elasticsearch \u0219i MongoDB accesibile public au fost \u0219terse | ProHoster","description":"Atacul \"Meow\" continu\u0103 s\u0103 c\u00e2\u0219tige amploare, \u00een cadrul c\u0103ruia necunoscu\u021bi distrug datele \u00een.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 Meow \u0443\u0434\u0430\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 4000 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0411\u0414 Elasticsearch \u0438 MongoDB | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 "Meow", \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-27T23:42:19+00:00","article:modified_time":"2020-07-27T23:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89993","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:30","updated":"2022-09-27 20:24:44","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/89993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=89993"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/89993\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=89993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=89993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=89993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}