{"id":89993,"date":"2020-07-28T01:42:19","date_gmt":"2020-07-27T23:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb"},"modified":"2020-07-28T01:42:19","modified_gmt":"2020-07-27T23:42:19","slug":"v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","title":{"rendered":"Gjat\u00eb sulmit Meow jan\u00eb fshir\u00eb rreth 4000 bazave t\u00eb dh\u00ebnash Elasticsearch dhe MongoDB q\u00eb jan\u00eb n\u00eb dispozicion publik.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Sulmimi vazhdon t\u00eb rritet «Meow<\/a><\/noindex>«, gjat\u00eb s\u00eb cil\u00ebs sulmues t\u00eb panjohur po shkat\u00ebrrojn\u00eb t\u00eb dh\u00ebnat n\u00eb instalime publike t\u00eb papragjireshme Elasticsearch dhe MongoDB. Raste t\u00eb izoluara t\u00eb pastrimit (n\u00eb total rreth 3% t\u00eb t\u00eb gjitha viktimave) jan\u00eb regjistruar gjithashtu p\u00ebr BD t\u00eb papragjireshme t\u00eb bazuara n\u00eb Apache Cassandra, CouchDB, Redis, Hadoop dhe Apache ZooKeeper. Sulmi kryhet p\u00ebrmes nj\u00eb boti q\u00eb skanon portet standarde t\u00eb rrjetit t\u00eb DB-ve. Studimi i sulmit n\u00eb nj\u00eb server honeypot t\u00eb rrem\u00eb tregoi se lidhja e botit po realizohet<\/a><\/noindex> p\u00ebrmes ProtonVPN. N\u00eb dat\u00ebn 22 korrik ishte regjistruar rreth 1000 bazave t\u00eb dh\u00ebnave t\u00eb fshir\u00eb, nd\u00ebrsa m\u00eb 23 korrik numri i sistemeve t\u00eb prekura u rrit<\/a><\/noindex> n\u00eb rreth 2500, dhe dje kaloi<\/a><\/noindex> shifr\u00ebn 3800, por sot ra n\u00eb 3750.<\/p>\n

Shkaku i problemeve \u00ebsht\u00eb hapja e qasjeve publike n\u00eb bazat e t\u00eb dh\u00ebnave pa konfiguruar si\u00e7 duhet autentifikimin. P\u00ebr shkak t\u00eb gabimeve ose pap\u00ebrgjegjshm\u00ebris\u00eb, p\u00ebrpunuesi i k\u00ebrkesave lidhet jo me adres\u00ebn e brendshme 127.0.0.1 (localhost), por me t\u00eb gjitha nd\u00ebrfaqet e rrjetit, duke p\u00ebrfshir\u00eb at\u00eb t\u00eb jashtme. N\u00eb MongoDB, nj\u00eb sjellje t\u00eb till\u00eb e nxit nj\u00eb shembuj konfigurimesh q\u00eb ofrohen si default, nd\u00ebrsa n\u00eb Elasticsearch deri te l\u00ebshimi 6.8<\/a><\/noindex> n\u00eb versionin falas, nuk mb\u00ebshteteshin fare mjetet p\u00ebr ndarjen e aksesit.<\/p>\n

Treguese historia<\/a><\/noindex> me ofruesin e VPN-s\u00eb UFO, i cili kishte zbuluar nj\u00eb baz\u00eb t\u00eb dh\u00ebnash Elasticsearch t\u00eb aksesueshme publikisht, e cila kishte madh\u00ebsin\u00eb 894 GB. Ofruesi e poziciononte veten si nj\u00eb kompani q\u00eb kujdeset p\u00ebr privat\u00ebsin\u00eb e p\u00ebrdoruesve dhe q\u00eb nuk mban regjistrime. N\u00eb kund\u00ebrshtim me k\u00ebt\u00eb deklarat\u00eb, n\u00eb baz\u00ebn e dh\u00ebnash t\u00eb dal\u00eb ishin regjistrime q\u00eb p\u00ebrfshinin informacione p\u00ebr adresat IP, lidhjet e seancave me koha, sh\u00ebnimet p\u00ebr vendndodhjen e p\u00ebrdoruesit, informacionin p\u00ebr sistemin operativ dhe pajisjen e p\u00ebrdoruesit, lista t\u00eb domain-eve p\u00ebr reklamim n\u00eb trafik HTTP t\u00eb pasigurt. P\u00ebr m\u00eb tep\u00ebr, n\u00eb DB ishin t\u00eb pranishme fjal\u00ebkalimet e aksesit n\u00eb form\u00eb t\u00eb qart\u00eb dhe \u00e7el\u00ebsat e seancave, t\u00eb cil\u00ebt lejonin p\u00ebrkthimin e seancave t\u00eb kapura.<\/p>\n

ProProvider UFO u njoftua p\u00ebr problemin m\u00eb 1 korrik, por mesazhi mbeti pa p\u00ebrgjigje p\u00ebr dy jav\u00eb. M\u00eb 14 korrik u d\u00ebrgua nj\u00eb tjet\u00ebr k\u00ebrkes\u00eb p\u00ebr hosting provider, pas s\u00eb cil\u00ebs m\u00eb 15 korrik baza e t\u00eb dh\u00ebnave u mbrojt. M\u00eb 20 korrik, kjo baz\u00eb e t\u00eb dh\u00ebnash u shfaq p\u00ebrs\u00ebri n\u00eb akses publik n\u00eb nj\u00eb IP tjet\u00ebr. Brenda disa or\u00ebsh, pothuajse t\u00eb gjitha t\u00eb dh\u00ebnat n\u00eb baz\u00eb t\u00eb t\u00eb dh\u00ebnave u fshin\u00eb. Analiza e k\u00ebtij fshirjeje tregoi se ajo lidhet me nj\u00eb sulm masiv, i njohur si Meow, sipas emrit t\u00eb indekseve t\u00eb l\u00ebna n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave pas fshirjes. K\u00ebrkimi p\u00ebrmes sh\u00ebrbimit Shodan tregoi<\/a><\/noindex>, \u00e7ka tregon se viktima t\u00eb fshirjes ishin edhe disa qindra server\u00eb t\u00eb tjer\u00eb. Tani, numri i bazave t\u00eb t\u00eb dh\u00ebnave t\u00eb fshira afrohet n\u00eb 4000.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 «Meow«, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 Elasticsearch \u0438 MongoDB. \u0415\u0434\u0438\u043d\u0438\u0447\u043d\u044b\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 (\u0432 \u0441\u0443\u043c\u043c\u0435 \u043e\u043a\u043e\u043b\u043e 3% \u043e\u0442 \u0432\u0441\u0435\u0445 \u0436\u0435\u0440\u0442\u0432) \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0411\u0414 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Apache Cassandra, CouchDB, Redis, Hadoop \u0438 Apache ZooKeeper. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0431\u043e\u0442\u0430, \u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u044e\u0449\u0435\u0433\u043e \u0442\u0438\u043f\u043e\u0432\u044b\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u0440\u0442\u044b \u0421\u0423\u0411\u0414. \u0418\u0437\u0443\u0447\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-89993","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 gjat\u00eb sulmit Meow u fshin\u00eb rreth 4000 bazat e t\u00eb dh\u00ebnave Elasticsearch dhe MongoDB t\u00eb aksesueshme publikisht | ProHoster","description":"Sulmi \"Meow\" vazhdon t\u00eb forcohet, gjat\u00eb t\u00eb cilit sulmues t\u00eb panjohur shkat\u00ebrrojn\u00eb t\u00eb dh\u00ebnat n\u00eb instalimet publike t\u00eb pa mbrojtura t\u00eb Elasticsearch dhe MongoDB. Raste t\u00eb izoluar t\u00eb pastrimit (n\u00eb t\u00ebr\u00ebsi rreth 3% t\u00eb t\u00eb gjitha viktimave) jan\u00eb dokumentuar gjithashtu p\u00ebr bazat e t\u00eb dh\u00ebnave t\u00eb pa mbrojtura t\u00eb bazuar n\u00eb Apache Cassandra, CouchDB, Redis, Hadoop dhe Apache ZooKeeper. Sulmi kryhet p\u00ebrmes nj\u00eb boti q\u00eb skanon portet standarde t\u00eb rrjetit t\u00eb DB. Studimi","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 Meow \u0443\u0434\u0430\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 4000 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0411\u0414 Elasticsearch \u0438 MongoDB | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 "Meow", \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 Elasticsearch \u0438 MongoDB. \u0415\u0434\u0438\u043d\u0438\u0447\u043d\u044b\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 (\u0432 \u0441\u0443\u043c\u043c\u0435 \u043e\u043a\u043e\u043b\u043e 3% \u043e\u0442 \u0432\u0441\u0435\u0445 \u0436\u0435\u0440\u0442\u0432) \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0411\u0414 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Apache Cassandra, CouchDB, Redis, Hadoop \u0438 Apache ZooKeeper. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0431\u043e\u0442\u0430, \u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u044e\u0449\u0435\u0433\u043e \u0442\u0438\u043f\u043e\u0432\u044b\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u0440\u0442\u044b \u0421\u0423\u0411\u0414. \u0418\u0437\u0443\u0447\u0435\u043d\u0438\u0435","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-27T23:42:19+00:00","article:modified_time":"2020-07-27T23:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89993","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:30","updated":"2022-09-27 20:24:44"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/89993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=89993"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/89993\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=89993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=89993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=89993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}