8 ms·

How I found a data leak of a company during a college lecture

142 points by achillean 10y ago

opaque 10y ago
In the words of Phineas Fisher: "NoSQL, or rather NoAuthentication, has been a huge gift to the hacker community. Just when I was worried that they'd finally patched all of the authentication bypass bugs in MySQL, new databases came into style that lack authentication by design." From his account of the Hacking Team Hack, worth a read if you missed it. http://pastebin.com/raw/0SNSvyjJ http://pastebin.com/raw/0SNSvyjJ
- ethbro 10y ago
  Step 1) Bemoan how {OldSoftwarePackage} doesn't do X, Y, Z Step 2) Write {NewSoftwarePackage} that does most of what {OldSoftwarePackage} did + X Step 3) Spend an order of magnitude more time than expected finishing Y, which turns out to actually be rather hard because {Messy Real World Engineering Details} Step 4) Never get to Z & eventually come up with a narrative about how Z was stupid anyway
  - Karunamon 10y ago
    Heh, sounds like how software is improved. Then when the next guy who wants Z comes along...
    - monksy 10y ago
      Don't worry .. it's Agile! We'll just keep pushing that feature back until we loose business. Later: "Remember people that was an MVP"
  - MichaelGG 10y ago
    Not sure what exactly you mean wrt NoAuth DBs, but having a simple on-connect password would be an improvement to all those databases. Things like Elasticsearch not having even a basic password (esp since it's HTTP so it's trivial) is simply silly. And it's probably not a good idea to support no-auth connections at all - if it's really a hassle, just set the user/pass to the host name.
    - pyre 10y ago
      > Elasticsearch Yea. I found that surprising when it came time to use ElasticSearch for my own purposes. If you want security, you need to setup something between the ElasticSearch server and the clients to moderate.
      - jrgnsd 10y ago
        Setting up nginx to proxy to Elasticsearch with HTTP auth on top is fairly trivial. There's a couple of good articles on the web if you google for it. Also, should you have an Elasticsearch support contract, you get access to the Shield plugin which has extensive access control. But yes, the fact that it is open OOTB is frustrating.
        pyre 10y ago
        This is exactly what I do, but the fact that it's wide open and relies on you to use a different (and de-coupled) service for permissions was surprising to me (at the time).
caseysoftware 10y ago
> On the next screen I just hit the connect button to see what would happen: > Not really sure what it does, but I found several Droisys e-mail addresses in the database and decided to mail them that their database was exposed on the internet. Oh man, this is a bad idea. If you find something out there that you think you can connect to - poor password, no password, etc - you must be very careful. In some cases, just reporting it will cause you problems. At this point, you probably haven't broken the law but some companies are just jackasses. But once you connect, the game changes. It is "unauthorized access" and it's probable that you broke your local laws. At that point, it's not just a jackass company that gets involved, it's local law enforcement too. And then you get data from the database. It's probably going to get even worse for you. When you go a step further and share a howto on the web... this is a bad idea all around. This is not proper disclosure. If I was him, I'd get a good lawyer.
- michiel3 10y ago
  It actually looks like the company was OK with it. The disclosure timeline shows they were responsive and addressed the problem quickly when they were made aware of its existence.
  - cortesoft 10y ago
    Right, but he didn't know this when he originally connected.
- sccxy 10y ago
  Edit: Too much info. Don't want to be google indexed.
  - eugenekolo2 10y ago
    Need more details on how you got a criminal record for that. Did you settle? Did you do more than just that?
    - sccxy 10y ago
0x0 10y ago
Wouldn't it be better and easier to do a WHOIS lookup on the actual IP address, and email whoever shows up there? Sometimes you'll get the hosting provider (and they can contact the customer for you, maybe even anonymously), and sometimes you'll find the company itself. At least you're not bouncing around domains which can be pointed anywhere
jsumrall 10y ago
>The database had no username and password configured to protect it, so I assumed it was a public database with data for everyone to see ;-) No, a wink won't protect you in court. You illegally accessed someone's data. As they say: just because the house is unlocked doesn't mean you're allowed in. Pray this doesn't get you in trouble. Sjonge jonge jonge...
kba 10y ago
So you do everything you can to hide the IP address, but reveal that the domain is-savvy.nl resolves to it. Either you're not actually that good at IT security or you're just making a huge brain fart. $ dig +short is-savvy.nl 37.59.238.165 So it's not really a mystery what the X.X.238.165 and X.X.238.166 addresses actually refer to.
0x54MUR41 10y ago
For those having a trouble to access the site, this is the archive version: https://web.archive.org/web/20160514214255/http://sijmen.ruwhof.net/weblog/937-how-i-found-a-huge-data-leak-of-a-company-during-a-college-lecture https://web.archive.org/web/20160514214255/http://sijmen.ruw...
microcolonel 10y ago
I don't know why he bothered to blank out the IP address for is-savvy.nl. DNS will tell you that there is literally one A record which matches the last two bytes.
cs2818 10y ago
What kind of laws apply in this locality? In the US I wouldn't be able to connect to their MongoDB server without it being a crime, password or not.
mitm2mitm 10y ago
A few years back I anonymously reported a huge data leak. Weeks later they asked for my name and address so they could "send me a gift". To this day they still haven't fixed the leak. And I took a pass on that "gift".

142 points by achillean 10y ago

In the words of Phineas Fisher: "NoSQL, or rather NoAuthentication, has been a huge gift to the hacker community. Just when I was worried that they'd finally patched all of the authentication bypass bugs in MySQL, new databases came into style that lack authentication by design." From his account of the Hacking Team Hack, worth a read if you missed it. http://pastebin.com/raw/0SNSvyjJ http://pastebin.com/raw/0SNSvyjJ

ethbro 10y ago
Step 1) Bemoan how {OldSoftwarePackage} doesn't do X, Y, Z Step 2) Write {NewSoftwarePackage} that does most of what {OldSoftwarePackage} did + X Step 3) Spend an order of magnitude more time than expected finishing Y, which turns out to actually be rather hard because {Messy Real World Engineering Details} Step 4) Never get to Z & eventually come up with a narrative about how Z was stupid anyway
- Karunamon 10y ago
  Heh, sounds like how software is improved. Then when the next guy who wants Z comes along...
  - monksy 10y ago
    Don't worry .. it's Agile! We'll just keep pushing that feature back until we loose business. Later: "Remember people that was an MVP"
- MichaelGG 10y ago
  Not sure what exactly you mean wrt NoAuth DBs, but having a simple on-connect password would be an improvement to all those databases. Things like Elasticsearch not having even a basic password (esp since it's HTTP so it's trivial) is simply silly. And it's probably not a good idea to support no-auth connections at all - if it's really a hassle, just set the user/pass to the host name.
  - pyre 10y ago
    > Elasticsearch Yea. I found that surprising when it came time to use ElasticSearch for my own purposes. If you want security, you need to setup something between the ElasticSearch server and the clients to moderate.
    - jrgnsd 10y ago
      Setting up nginx to proxy to Elasticsearch with HTTP auth on top is fairly trivial. There's a couple of good articles on the web if you google for it. Also, should you have an Elasticsearch support contract, you get access to the Shield plugin which has extensive access control. But yes, the fact that it is open OOTB is frustrating.
      - pyre 10y ago
        This is exactly what I do, but the fact that it's wide open and relies on you to use a different (and de-coupled) service for permissions was surprising to me (at the time).

caseysoftware 10y ago

> On the next screen I just hit the connect button to see what would happen: > Not really sure what it does, but I found several Droisys e-mail addresses in the database and decided to mail them that their database was exposed on the internet. Oh man, this is a bad idea. If you find something out there that you think you can connect to - poor password, no password, etc - you must be very careful. In some cases, just reporting it will cause you problems. At this point, you probably haven't broken the law but some companies are just jackasses. But once you connect, the game changes. It is "unauthorized access" and it's probable that you broke your local laws. At that point, it's not just a jackass company that gets involved, it's local law enforcement too. And then you get data from the database. It's probably going to get even worse for you. When you go a step further and share a howto on the web... this is a bad idea all around. This is not proper disclosure. If I was him, I'd get a good lawyer.

michiel3 10y ago
It actually looks like the company was OK with it. The disclosure timeline shows they were responsive and addressed the problem quickly when they were made aware of its existence.
- cortesoft 10y ago
  Right, but he didn't know this when he originally connected.
sccxy 10y ago
Edit: Too much info. Don't want to be google indexed.
- eugenekolo2 10y ago
  Need more details on how you got a criminal record for that. Did you settle? Did you do more than just that?
  - sccxy 10y ago

0x0 10y ago

Wouldn't it be better and easier to do a WHOIS lookup on the actual IP address, and email whoever shows up there? Sometimes you'll get the hosting provider (and they can contact the customer for you, maybe even anonymously), and sometimes you'll find the company itself. At least you're not bouncing around domains which can be pointed anywhere

jsumrall 10y ago

>The database had no username and password configured to protect it, so I assumed it was a public database with data for everyone to see ;-) No, a wink won't protect you in court. You illegally accessed someone's data. As they say: just because the house is unlocked doesn't mean you're allowed in. Pray this doesn't get you in trouble. Sjonge jonge jonge...

kba 10y ago

So you do everything you can to hide the IP address, but reveal that the domain is-savvy.nl resolves to it. Either you're not actually that good at IT security or you're just making a huge brain fart. $ dig +short is-savvy.nl 37.59.238.165 So it's not really a mystery what the X.X.238.165 and X.X.238.166 addresses actually refer to.

0x54MUR41 10y ago

For those having a trouble to access the site, this is the archive version: https://web.archive.org/web/20160514214255/http://sijmen.ruwhof.net/weblog/937-how-i-found-a-huge-data-leak-of-a-company-during-a-college-lecture https://web.archive.org/web/20160514214255/http://sijmen.ruw...

microcolonel 10y ago

I don't know why he bothered to blank out the IP address for is-savvy.nl. DNS will tell you that there is literally one A record which matches the last two bytes.

cs2818 10y ago

What kind of laws apply in this locality? In the US I wouldn't be able to connect to their MongoDB server without it being a crime, password or not.

mitm2mitm 10y ago

A few years back I anonymously reported a huge data leak. Weeks later they asked for my name and address so they could "send me a gift". To this day they still haven't fixed the leak. And I took a pass on that "gift".