{"id":89993,"date":"2020-07-28T01:42:19","date_gmt":"2020-07-27T23:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb"},"modified":"2020-07-28T01:42:19","modified_gmt":"2020-07-27T23:42:19","slug":"v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","title":{"rendered":"Under attack, Meow has removed around 4000 publicly available Elasticsearch and MongoDB databases.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Attacken forts\u00e4tter att \u00f6kaMeow<\/a><\/noindex>, d\u00e4r ok\u00e4nda g\u00e4rningspersoner f\u00f6rst\u00f6r data i offentligt tillg\u00e4ngliga, oskyddade installationer av Elasticsearch och MongoDB. Enstaka fall av radering (totalt omkring 3% av alla offer) har ocks\u00e5 registrerats f\u00f6r oskyddade databaser baserade p\u00e5 Apache Cassandra, CouchDB, Redis, Hadoop och Apache ZooKeeper. Attacken genomf\u00f6rs via en bot som genoms\u00f6ker standard n\u00e4tverksportar f\u00f6r databashanterare. Unders\u00f6kning av attacken p\u00e5 en falsk honeypot-server visade att botens anslutning is established<\/a><\/noindex> via ProtonVPN. While on July 22, around 1000 remote databases were recorded, by July 23, the number of affected systems increased<\/a><\/noindex> to approximately 2500, and yesterday exceeded<\/a><\/noindex> the mark of 3800, but today it has decreased to 3750.<\/p>\n

The cause of the problems is the opening of public access to the database without proper authentication configuration. By mistake or negligence, the request handler is bound not to the internal address 127.0.0.1 (localhost) but to all network interfaces, including external ones. In MongoDB, this behavior is supported by default settings, while in Elasticsearch, access restriction tools were not supported at all in the free version. 6.8<\/a><\/noindex> Noteworthy<\/p>\n

is the story with the VPN provider UFO, which had a publicly accessible Elasticsearch database of 894GB. The provider positioned itself as caring about user privacy and not keeping logs. Contrary to the claim, the exposed database contained logs, including information about IP addresses, session bindings to time, user location tags, information about the operating system and user device, and lists of domains for ad placement in unprotected HTTP traffic. Moreover, the database contained access passwords in plain text and session keys that allowed the decryption of intercepted sessions.<\/a><\/noindex> med VPN-leverant\u00f6ren UFO, som hade en offentligt tillg\u00e4nglig Elasticsearch-databas av en storlek p\u00e5 894 GB. Leverant\u00f6ren positionerade sig som en som bryr sig om anv\u00e4ndarnas integritet och inte sparar loggar. Trots detta inneh\u00f6ll den l\u00e4ckta databasen loggar som inkluderade information om IP-adresser, kopplingar mellan sessioner och tid, anv\u00e4ndarens platsdata, information om operativsystem och enhet, samt listor \u00f6ver dom\u00e4ner f\u00f6r reklaminjicering i os\u00e4ker HTTP-trafik. Dessutom fanns det l\u00f6senord som var synliga i klartext och sessionsnycklar som m\u00f6jliggjorde dekryptering av avlyssnade sessioner.<\/p>\n

Leverant\u00f6ren UFO informerades om problemet den 1 juli, men under tv\u00e5 veckor f\u00f6rblev meddelandet obesvarat och den 14 juli skickades en annan f\u00f6rfr\u00e5gan till webbhotellleverant\u00f6ren, varefter databasen skyddades den 15 juli. Den 20 juli d\u00f6k denna databas \u00e5terigen upp i offentlig tillg\u00e5ng p\u00e5 en annan IP. Inom n\u00e5gra timmar raderades n\u00e4stan all data i databasen. Analysen av denna radering visade att den var kopplad till en massattack, som f\u00e5tt namnet Meow efter namnen p\u00e5 index som l\u00e4mnades kvar i databasen efter raderingen. S\u00f6kningen genom Shodan-tj\u00e4nsten att det \u00e4r enkelt att f\u00e5 ett EV-certifikat i namn av 'Stripe, Inc' (ett popul\u00e4rt betalsystem) bara genom att registrera ett f\u00f6retag med samma namn i en annan stat. F\u00f6r att uppt\u00e4cka skillnaden m\u00e5ste man i alla fall se \u00f6ver detaljerna om webbplatsen \u2013 informationen fr\u00e5n adressf\u00e4ltet \u00e4r otillr\u00e4cklig. En annan forskare, James Burton, fick certifikatet i namn av sitt registrerade f\u00f6retag 'Identity Verified', vilket ocks\u00e5 l\u00e4tt kan vilseleda anv\u00e4ndare.<\/a><\/noindex>, vilket avsl\u00f6jar att \u00e4ven flera hundra servrar blev offer f\u00f6r raderingen. Antalet raderade databaser ligger nu n\u00e4ra 4000.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 «Meow«, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 Elasticsearch \u0438 MongoDB. \u0415\u0434\u0438\u043d\u0438\u0447\u043d\u044b\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 (\u0432 \u0441\u0443\u043c\u043c\u0435 \u043e\u043a\u043e\u043b\u043e 3% \u043e\u0442 \u0432\u0441\u0435\u0445 \u0436\u0435\u0440\u0442\u0432) \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0411\u0414 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Apache Cassandra, CouchDB, Redis, Hadoop \u0438 Apache ZooKeeper. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0431\u043e\u0442\u0430, \u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u044e\u0449\u0435\u0433\u043e \u0442\u0438\u043f\u043e\u0432\u044b\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u0440\u0442\u044b \u0421\u0423\u0411\u0414. \u0418\u0437\u0443\u0447\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-89993","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Under Meow-attacken har cirka 4000 offentligt tillg\u00e4ngliga databaser Elasticsearch och MongoDB raderats | ProHoster","description":"Attacken \"Meow\" forts\u00e4tter att intensifieras, d\u00e4r ok\u00e4nda g\u00e4rningspersoner f\u00f6rst\u00f6ker data i.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 Meow \u0443\u0434\u0430\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 4000 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0411\u0414 Elasticsearch \u0438 MongoDB | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u043d\u0430\u0431\u0438\u0440\u0430\u0442\u044c \u043e\u0431\u043e\u0440\u043e\u0442\u044b \u0430\u0442\u0430\u043a\u0430 "Meow", \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-hode-ataki-meow-udaleno-okolo-4000-obshhedostupnyh-bd-elasticsearch-i-mongodb","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-27T23:42:19+00:00","article:modified_time":"2020-07-27T23:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89993","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:30","updated":"2022-09-27 20:24:44","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/89993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=89993"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/89993\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=89993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=89993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=89993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}