3 ms·
Kibana's a monitoring system, so the article makes it sound like the passwords were ingested into logs on their way to presumably sit hashed at rest for the sys
by cjbprime 8y ago
Kibana's a monitoring system, so the article makes it sound like the passwords were ingested into logs on their way to presumably sit hashed at rest for the systems that they were intended for.
Which means there are really three red flags: internal tools deployed to the public internet, internal tools without any user access control, and allowing passwords to hit the logging infrastructure.
- adossi 8y ago>allowing passwords to hit the logging infrastructure. This is the most ridiculous of the three in my opinion. When logging to elasticsearch you programmatically have to say what data to put in the document before its indexed (and thus viewable via Kibana). This means that the developer actually put the password as a parameter in the document object.
- cjbprime 8y agoNot necessarily, it could just be total and indiscriminate logging of HTTP requests.