5 ms·
especially for bitcoin miners and unsecured redis instances!
by incomplete 8y ago
especially for bitcoin miners and unsecured redis instances!
- whalesalad 8y agoI’m curious. Elaborate?
- nickthemagicman 8y agoAround 75% of open redis servers are hacked. https://www.bleepingcomputer.com/news/security/around-75-percent-of-open-redis-servers-are-infected-with-malware/ https://www.bleepingcomputer.com/news/security/around-75-per...
- antirez 8y agoRedis safe mode introduced in 3.2 reduced the problem but still folks actively misconfigure Redis before putting it in a public IP... Now there are ACLs in Redis 6 that will mitigate this even more, but it's a lost game, because images are created with installations of Redis that are made completely accessible on purpose.
- nickthemagicman 8y agoOh not blaming Redis in the slightest. Its one of my all time fav tools. Things are only secure as ppl configure them. I don't even want to know how many elasticache Redis servers data are just unsecured on a public IP because it's so easy to configure that way.
- incomplete 8y ago^^^ this exactly.
- Can_Not 8y agoThis happened to me, but it's because our sysadmin left a firewall port open to the whole world without setting a password on redis, which allowed a random drive by port scan to inject a LUA script. They couldn't escalate privileges, only run the miner and make the server mostly unresponsive.
- incomplete 8y agohttps://www.imperva.com/blog/rediswannamine-new-redis-nsa-powered-cryptojacking-attack/ https://www.imperva.com/blog/rediswannamine-new-redis-nsa-po...
- anonimito 8y agoAh yes, the nostalgia