5 ms·

> The technical support response was: everything is ok. Oh my, I can already see storm the provider will get on social media once we find out who's such a moro

> The technical support response was: everything is ok. Oh my, I can already see storm the provider will get on social media once we find out who's such a moron. Also I bet there's someone unethical who's right now going through all Redis hosting services trying to repro this and get some data.

Nextgrid 7y ago
Part of the fault is on the customers who are putting their data into what is essentially a publicly-available Redis provided by accident, instead of paying for the real, private Redis. I wouldn't blame the hosting provider alone unless they explicitly marketed that shared Redis as something being available. Presumably it's just there because of a misconfiguration and since it doesn't hurt anyone nobody noticed or bothered to turn it off.
- luckylion 7y ago
  This. It's essentially "hey, I can see other users' data in /tmp". Don't write to public directories if you care about privacy. I don't know why they'd offer a publicly accessible redis other than for testing maybe, but if they communicate it, it's on the user.
  - hombre_fatal 7y ago
    On the other hand, sometimes I see this sort of thing on LowEndBox.com's forums, you realize OP is paying like $0.50/mo, and I'm wondering what they expected. "Is it normal?" is kind of a nonsensical question without any further context.
wolco 7y ago
I hope they don't go crazy looking. BEGET.RU is the hosting provider. It took two minutes to find on a phone.
- phyzome 7y ago
  And how did you arrive at that conclusion? Reverse image lookup to find other things written by the same person seemed the most promising, but I did not find anything within 2 minutes. :-)
  - wolco 7y ago
    Lookup the person not the image.
- gotts 7y ago
  beget.ru seems to have Redis as a service product indeed - https://beget.com/en/news/2015/redis https://beget.com/en/news/2015/redis (it's in Russian)
pirate_dev 7y ago
I almost fell out of my chair when I saw this.
jrockway 7y ago
> Also I bet there's someone unethical who's right now going through all Redis hosting services trying to repro this and get some data. There are basically people doing this continuously in a loop. Open up port 3306 and watch people trying to connect to your MySQL instance with common passwords. IPv4 addresses are easily enumerable and the bad guys already thought of everything. (I put a real MySQL there once; they deleted all the tables and created a new one asking for bitcoin to get them back.) I know MySQL is not Redis but the same principle applies; someone is scanning you for open services right now.
- WrtCdEvrydy 7y ago
  > I put a real MySQL there once; they deleted all the tables and created a new one asking for bitcoin to get them back. Database ransomware: Are you vulnerable - Next year on Scareware Conference.
- ungawatkt 7y ago
  I had that happen to a test redis instance on aws (my bad for missing the port auto-routing in the cloudformation script I was trying out). About 24 hours and a bot had placed what I think was a Bitcoin mining program on it through the redis persistence mechanism.
- Nextgrid 7y ago
  I once put an (intentionally) bad root password on a machine to be able to log in to the physical console, then configured the machine (it was supposed to be a router) and put it on the Internet, forgetting the bad password. I remembered a few hours later, gone back to rebuild the machine as I assumed it would be compromised, and sure enough, there was some crypto miner on it. Sadly for them, the machine didn't have anywhere enough processing power to make it worth it and they should've instead been smarter and made better use of it (it had a very beefy network connection so plenty of potential for DoS attacks or hosting malicious content, as well as being in a privileged position to capture potentially sensitive unencrypted traffic).
  - tetha 7y ago

Nextgrid 7y ago

Part of the fault is on the customers who are putting their data into what is essentially a publicly-available Redis provided by accident, instead of paying for the real, private Redis. I wouldn't blame the hosting provider alone unless they explicitly marketed that shared Redis as something being available. Presumably it's just there because of a misconfiguration and since it doesn't hurt anyone nobody noticed or bothered to turn it off.

luckylion 7y ago
This. It's essentially "hey, I can see other users' data in /tmp". Don't write to public directories if you care about privacy. I don't know why they'd offer a publicly accessible redis other than for testing maybe, but if they communicate it, it's on the user.
- hombre_fatal 7y ago
  On the other hand, sometimes I see this sort of thing on LowEndBox.com's forums, you realize OP is paying like $0.50/mo, and I'm wondering what they expected. "Is it normal?" is kind of a nonsensical question without any further context.

wolco 7y ago

I hope they don't go crazy looking. BEGET.RU is the hosting provider. It took two minutes to find on a phone.

phyzome 7y ago
And how did you arrive at that conclusion? Reverse image lookup to find other things written by the same person seemed the most promising, but I did not find anything within 2 minutes. :-)
- wolco 7y ago
  Lookup the person not the image.
gotts 7y ago
beget.ru seems to have Redis as a service product indeed - https://beget.com/en/news/2015/redis https://beget.com/en/news/2015/redis (it's in Russian)

pirate_dev 7y ago

I almost fell out of my chair when I saw this.

jrockway 7y ago

> Also I bet there's someone unethical who's right now going through all Redis hosting services trying to repro this and get some data. There are basically people doing this continuously in a loop. Open up port 3306 and watch people trying to connect to your MySQL instance with common passwords. IPv4 addresses are easily enumerable and the bad guys already thought of everything. (I put a real MySQL there once; they deleted all the tables and created a new one asking for bitcoin to get them back.) I know MySQL is not Redis but the same principle applies; someone is scanning you for open services right now.

WrtCdEvrydy 7y ago
> I put a real MySQL there once; they deleted all the tables and created a new one asking for bitcoin to get them back. Database ransomware: Are you vulnerable - Next year on Scareware Conference.
ungawatkt 7y ago
I had that happen to a test redis instance on aws (my bad for missing the port auto-routing in the cloudformation script I was trying out). About 24 hours and a bot had placed what I think was a Bitcoin mining program on it through the redis persistence mechanism.
Nextgrid 7y ago
I once put an (intentionally) bad root password on a machine to be able to log in to the physical console, then configured the machine (it was supposed to be a router) and put it on the Internet, forgetting the bad password. I remembered a few hours later, gone back to rebuild the machine as I assumed it would be compromised, and sure enough, there was some crypto miner on it. Sadly for them, the machine didn't have anywhere enough processing power to make it worth it and they should've instead been smarter and made better use of it (it had a very beefy network connection so plenty of potential for DoS attacks or hosting malicious content, as well as being in a privileged position to capture potentially sensitive unencrypted traffic).
- tetha 7y ago