9 ms·
After understanding how much this attack was used, I modified the blog post in order to prevent script kiddies from using it without a few changes, but still it
by antirez 11y ago
After understanding how much this attack was used, I modified the blog post in order to prevent script kiddies from using it without a few changes, but still it caused a lot more harm than I expected. Before Redis 3.2 I'll add security features to prevent this from happening, while adding them in a form that should prevent also people from getting annoyed by the security features. It's an hard mix to get right.
- Jgrubb 11y agoI was wondering about that when I read that post ;)
- tombrossman 11y agoThe original is still archived at http://web.archive.org/web/20151103154949/http://antirez.com/news/96 http://web.archive.org/web/20151103154949/http://antirez.com..., so if the goal is to make the script kiddies work for it you need to add this to your robots.txt: User-agent: ia_archiver Disallow: / Unfortunately that excludes your whole site from the Wayback Machine, but you might try modifying the Disallow. (I haven't a clue if their rules are granular or strictly site-wide.)
- mulander 11y agoOne person wrote and linked an automatic tool exploiting the attack you detailed in the original blog posts comment section. [1] - https://github.com/matiasinsaurralde/evilredis https://github.com/matiasinsaurralde/evilredis
- tedivm 11y agoYou posted a tutorial describing how to use your software to exploit servers, and you're surprised that people used it? I really hope this was a one time lapse in judgement and not indicative of how the redis team thinks about security.
- johnmaguire2013 11y agoThis is the full disclosure vs antisec debate... if they posted it after they had a patched version out, the best thing to do is explain the issue and get people to upgrade, in my opinion. Granted, I didn't read the original blog post. Were they distributing tools to make it easy? Or were they explaining how it worked? In any case, if he hadn't written the blog post, someone else would have.
- andrewchambers 11y agoThe only fault lies with those who put the service on the open internet.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]