2 ms·

SSH worms are a completely different subject, MS does not get orders of magnitude more scan traffic than you do. Services like greynoise provide an easy answer

SSH worms are a completely different subject, MS does not get orders of magnitude more scan traffic than you do. Services like greynoise provide an easy answer to “who’s scanning for elasticsearch?”, although most of those are trying to RCE and not exfil data. It’s certainly possible that someone else found this ES and dumped the data during the few hours it was exposed, but I certainly wouldn’t call that likely.

pbhjpbhj 7y ago
The company reporting it found the breach, so we know someone found it. What's your background? I'd be surprised to find corporate IPs were only scanned at the rate of domestic non-fixed IPs. If a black hat cracker finds data they can exfiltrate do you think they'd just leave it; especially data like this that has obvious value to phishers/fraudsters?
- ryanlol 7y ago
  > What's your background? I'd be surprised to find corporate IPs were only scanned at the rate of domestic non-fixed IPs. I scan for a living, have been doing so for a better part of the last 10 years. I spend lots of time keeping up with what other people are scanning for. > If a black hat cracker finds data they can exfiltrate do you think they'd just leave it Yeah sure, if a malicious hacker had access and knew what they had access to they wouldn’t just leave the data there. Odds are this would just be discovered by scripts trying to drop malware for DDoS, or ransomware. As a black hat hacker scanning for things like this I always had the problem that I was finding way more data than I could realistically store and process, I’m sure I missed hundreds of things like this in my results because of that. The criminals doing this stuff don’t have teams of people working for them analyzing the data. Then there’s the fact that a very significant chunk of blackhat hackers just won’t be working in late december. I understand that this may not sound like such an convincing argument at first, but this’ll almost certainly exclude at least half of the malicious actors who could’ve possibly found it. I’m not saying it’s impossible, I just don’t think it’s particularly likely.

pbhjpbhj 7y ago

The company reporting it found the breach, so we know someone found it. What's your background? I'd be surprised to find corporate IPs were only scanned at the rate of domestic non-fixed IPs. If a black hat cracker finds data they can exfiltrate do you think they'd just leave it; especially data like this that has obvious value to phishers/fraudsters?

ryanlol 7y ago
> What's your background? I'd be surprised to find corporate IPs were only scanned at the rate of domestic non-fixed IPs. I scan for a living, have been doing so for a better part of the last 10 years. I spend lots of time keeping up with what other people are scanning for. > If a black hat cracker finds data they can exfiltrate do you think they'd just leave it Yeah sure, if a malicious hacker had access and knew what they had access to they wouldn’t just leave the data there. Odds are this would just be discovered by scripts trying to drop malware for DDoS, or ransomware. As a black hat hacker scanning for things like this I always had the problem that I was finding way more data than I could realistically store and process, I’m sure I missed hundreds of things like this in my results because of that. The criminals doing this stuff don’t have teams of people working for them analyzing the data. Then there’s the fact that a very significant chunk of blackhat hackers just won’t be working in late december. I understand that this may not sound like such an convincing argument at first, but this’ll almost certainly exclude at least half of the malicious actors who could’ve possibly found it. I’m not saying it’s impossible, I just don’t think it’s particularly likely.