4 ms·

Yet another Elasticsearch server wide open. This is going to make the flurry of open mongodb servers look trivial.

by kitotik 7y ago

toomuchtodo 7y ago
They're everywhere. Just ask Shodan.
- BrianHenryIE 7y ago
  > Shodan is a search engine that lets the user find specific types of computers connected to the internet using a variety of filters. Some have also described it as a search engine of service banners, which are metadata that the server sends back to the client. Interesting.
  - deleted 7y ago
    [deleted]
- dclusin 7y ago
  I remember there was some brewhaha a while back about how Shodan was able to discover services on IPv6 since the address space was so sparse. Apparently they were running enough of their own NTP servers to reliably map out lots of devices on IPv6.
  - DarthGhandi 7y ago
    Not being able to map ipv6 space is a myth. There's plenty of workarounds.
    - dclusin 7y ago
      Such as? Not too familiar with the subject, would love to know how.
      - DarthGhandi 7y ago
        It's pretty old news these days, guessing it's mostly what's leaked out of private to public sector stuff, is probably just the beginning really. Would suggest starting at arxiv. This is not a hidden field for the active and/or keen researcher.
- hobofan 7y ago
  Since I learned about Shodan, I'm convinced that the (subjectively) increase in reported data breaches is just due to an increasing amount of people looking through Shodan results, and doesn't have anything to do with any trends in security. Security standards at any company have always been low, but now it's easy even for a layman to find leaked data.
dmarlow 7y ago
It's not hard to secure ES. If people need help, please just ask, happy to help.
d33 7y ago
I wouldn't be surprised if the starting point for this vulnerability wasn't ES, but Docker. Docker by default modifies iptables and if you hack together a system that uses both software running directly on the host and in containers, it's going to expose the forwarded containers to the Internet - which you might not be expecting, since a bind to localhost would be enough to expose a service. It's always a good idea to have a separate firewall running outside of the your system - this is the one Docker can't fool.
- briffle 7y ago
  They mentioned this is google cloud, which blocks almost all incoming ports by default. they had to have chose to expose this through the project firewall, and not put in a source filter.
- atonse 7y ago
  I had this issue last week. I was pulling my hair out as to how my brand new Linode got hacked even though I had setup ufw within minutes. It is downright ridiculous that this was ever approved as a default behavior.
- kitotik 7y ago
  Great point. Depressing how such large profile projects can have such insane defaults.
- arpa 7y ago
  No. It's not dockers' fault you did not read the manual and expose the ports wrong: you can bind the port to specific ips for export and tjat address should be 127.0.0.1
  - d33 7y ago
    I see where you're coming from, but I disagree. I believe that good software and abstractions should take little training to use - everything unintuitive is a design failure and should be fixed. "Reasonably secure" should be the implicit default, not something you need to explicitly added. E.g., it's better to force authentication and force the administrator to add an account than let everyone in by default. Or it's better to bind to 127.0.0.1 than to 0.0.0.0 by default, like most web servers built into frameworks I saw do. Unfortunately, instead of good intuition, Docker is built on caveats, be it networking, storage, caching, image sharing, container/image distinction, authentication, deployment or building a cluster. Every subsystem I experimented with "works", but fails in weird ways in some situations. In my opinion, that means that Docker is a good idea, but has terrible UX/functionality/error handling. I kind of think the same way of Git.
psychometry 7y ago
Not sure about Google Cloud, but Elasticsearch on AWS doesn't support x-pack security. You can only secure your instance via IP restriction, otherwise you have to sign your requests, which is not always supported on Elasticsearch DSL libraries that are commonly used.
user_50123890 7y ago
I believe Elasticsearch doesn't allow restricting access by requiring login unless you pay for the enterprise version, which is just straight up stupid.
- jerrac 7y ago
  The basic license is free now, so you can get basic authentication. But I still wonder why that isn't part of the open source version, and why it isn't turned on by default....

Yet another Elasticsearch server wide open. This is going to make the flurry of open mongodb servers look trivial.

toomuchtodo 7y ago

They're everywhere. Just ask Shodan.

BrianHenryIE 7y ago
> Shodan is a search engine that lets the user find specific types of computers connected to the internet using a variety of filters. Some have also described it as a search engine of service banners, which are metadata that the server sends back to the client. Interesting.
- deleted 7y ago
  [deleted]
dclusin 7y ago
I remember there was some brewhaha a while back about how Shodan was able to discover services on IPv6 since the address space was so sparse. Apparently they were running enough of their own NTP servers to reliably map out lots of devices on IPv6.
- DarthGhandi 7y ago
  Not being able to map ipv6 space is a myth. There's plenty of workarounds.
  - dclusin 7y ago
    Such as? Not too familiar with the subject, would love to know how.
    - DarthGhandi 7y ago
      It's pretty old news these days, guessing it's mostly what's leaked out of private to public sector stuff, is probably just the beginning really. Would suggest starting at arxiv. This is not a hidden field for the active and/or keen researcher.
hobofan 7y ago
Since I learned about Shodan, I'm convinced that the (subjectively) increase in reported data breaches is just due to an increasing amount of people looking through Shodan results, and doesn't have anything to do with any trends in security. Security standards at any company have always been low, but now it's easy even for a layman to find leaked data.

dmarlow 7y ago

It's not hard to secure ES. If people need help, please just ask, happy to help.

d33 7y ago

I wouldn't be surprised if the starting point for this vulnerability wasn't ES, but Docker. Docker by default modifies iptables and if you hack together a system that uses both software running directly on the host and in containers, it's going to expose the forwarded containers to the Internet - which you might not be expecting, since a bind to localhost would be enough to expose a service. It's always a good idea to have a separate firewall running outside of the your system - this is the one Docker can't fool.

briffle 7y ago
They mentioned this is google cloud, which blocks almost all incoming ports by default. they had to have chose to expose this through the project firewall, and not put in a source filter.
atonse 7y ago
I had this issue last week. I was pulling my hair out as to how my brand new Linode got hacked even though I had setup ufw within minutes. It is downright ridiculous that this was ever approved as a default behavior.
kitotik 7y ago
Great point. Depressing how such large profile projects can have such insane defaults.
arpa 7y ago
No. It's not dockers' fault you did not read the manual and expose the ports wrong: you can bind the port to specific ips for export and tjat address should be 127.0.0.1
- d33 7y ago
  I see where you're coming from, but I disagree. I believe that good software and abstractions should take little training to use - everything unintuitive is a design failure and should be fixed. "Reasonably secure" should be the implicit default, not something you need to explicitly added. E.g., it's better to force authentication and force the administrator to add an account than let everyone in by default. Or it's better to bind to 127.0.0.1 than to 0.0.0.0 by default, like most web servers built into frameworks I saw do. Unfortunately, instead of good intuition, Docker is built on caveats, be it networking, storage, caching, image sharing, container/image distinction, authentication, deployment or building a cluster. Every subsystem I experimented with "works", but fails in weird ways in some situations. In my opinion, that means that Docker is a good idea, but has terrible UX/functionality/error handling. I kind of think the same way of Git.

psychometry 7y ago

Not sure about Google Cloud, but Elasticsearch on AWS doesn't support x-pack security. You can only secure your instance via IP restriction, otherwise you have to sign your requests, which is not always supported on Elasticsearch DSL libraries that are commonly used.

user_50123890 7y ago

I believe Elasticsearch doesn't allow restricting access by requiring login unless you pay for the enterprise version, which is just straight up stupid.

jerrac 7y ago
The basic license is free now, so you can get basic authentication. But I still wonder why that isn't part of the open source version, and why it isn't turned on by default....