5 ms·
150,000,000+ database passwords, of which 99.9999%+ are from local development servers.
by mahouse 11y ago
150,000,000+ database passwords, of which 99.9999%+ are from local development servers.
- rocky1138 11y agoHow many of those change when they go live?
- cstuder 11y agoAnd how many of those MySQL passwords are also used by the WordPress admin account? Even if it's just 0.1%, that would be still 150'000 valid passwords.
- mattgibson 11y agoExcluding localhost and some obvious cases where the values are in a local config file still leaves around 111,000: https://github.com/search?p=1&q=filename%3Awp-config.php+DB_HOST++NOT+localhost+NOT+127.0.0.1+NOT+getenv%28%27DB_HOST%27%29+NOT+%24_ENV%5B%27DB_HOST%27%5D+NOT+%24env%5B%27db_host%27%5D&ref=searchresults&type=Code&utf8=%E2%9C%93 https://github.com/search?p=1&q=filename%3Awp-config.php+DB_...
- sarciszewski 11y agoExcluding localhost will exclude a lot of legitimate installs.
- austenallred 11y agoMost wordpress devs support multiple environments in their .wpadmin (dev -> localhost, prod -> some server). So this is creating a lot of false negatives.
- onion2k 11y agolocalhost in the case of Wordpress just means the database is running on the same machine as the web server. Practically every WP instance is set up that way.
- panopticon 11y ago> localhost in the case of Wordpress Uh, the concept of localhost is not unique to Wordpress in the slightest.
- erikb 11y agoThat's not what he meant. What he meant was reading that the database is on localhost doesn't mean it's a development system. Many production instances of Wordpress run the database on the same host. Therefore localhost can also mean production. That might not be true for other services, but for Wordpress that's common. This is what he meant.
- bdcravens 11y agoWhich would be 99.99926% :-)
- hobs 11y agoKeep clicking, because I found what appear to be two valid passwords in 5 different config files (with public hosts.) Obviously I didnt test them, so you might be right that they change or are in dev mode, but that smells like a lot more than 6 9s.
- JosephRedfern 11y agoHow can you tell that? Just because it specifies "localhost" doesn't necessarily mean it's a dev box.
- ishener 11y agoExactly. Also remember that on many many wordpress servers you also have phpMyAdmin. You can use the username + password to login, and you'll get access even when it's restricted to localhost.
- 0x0 11y agoIt's pretty scary to have phpMyAdmin public facing. IIRC some older versions of mysql-server even had a bug where it'd let you in with a random password in 1/256 chance!
- leni536 11y agoIt should be really bad, since phpmyadmin get attempts are the most frequent on my home webserver and I don't even have it installed. Maybe older vulnerable versions are still around though.
- userbinator 11y agoI'd guess that a large portion of those which aren't localhost are also firewalled or otherwise inaccessible from the public Internet.
- 0xffffabcd 11y agoFound several working username+password for FTP accounts.
- ins0 11y agoI agree with mahouse and of course are some of these password legit. But this is nothing new, don't store sensitive data in git. Everyone know you can search this stuff on GitHub and if we look back - Google was a nice password search engine too (and still today)
- reustle 11y agoDon't store sensitive data in git, or don't store sensitive data on public github repos?
- archimedespi 11y agoDon't even store sensitive data in git, it can be a bad idea: http://www.jamiembrown.com/blog/one-in-every-600-websites-has-git-exposed/ http://www.jamiembrown.com/blog/one-in-every-600-websites-ha... Store credentials in environment variables.
- jessaustin 11y agoThat link is talking about a problem with e.g. .htaccess and basic directory permissions, not a problem using git per se. But yeah, put that stuff in envars.
- Huggernaut 11y agoHow would you go about making a repeatable, automated deployment if you don't store configuration information in source control to load into the environment variables?
- aaronbasssett 11y agoDepends on what you're using for your deployments, for example if you were using Puppet you might use something like https://github.com/TomPoulton/hiera-eyaml https://github.com/TomPoulton/hiera-eyaml
- 11y ago
- onion2k 11y agoIf you're the sort of developer who puts a wp-config.php file in a git repo (eg no proper deploy process.. otherwise that file wouldn't exist in the repo, or no reference to the config file in .git-ignore), you're probably the sort of developer who'll use the same password on your local dev machine and your live site because "setting up MySQL users is hard."
- Cthulhu_ 11y agoAnd the other 95% doesn't allow external connections.
- deleted 11y ago[deleted]