3 ms·

> Also I bet there's someone unethical who's right now going through all Redis hosting services trying to repro this and get some data. There are basically peo

> Also I bet there's someone unethical who's right now going through all Redis hosting services trying to repro this and get some data. There are basically people doing this continuously in a loop. Open up port 3306 and watch people trying to connect to your MySQL instance with common passwords. IPv4 addresses are easily enumerable and the bad guys already thought of everything. (I put a real MySQL there once; they deleted all the tables and created a new one asking for bitcoin to get them back.) I know MySQL is not Redis but the same principle applies; someone is scanning you for open services right now.

WrtCdEvrydy 7y ago
> I put a real MySQL there once; they deleted all the tables and created a new one asking for bitcoin to get them back. Database ransomware: Are you vulnerable - Next year on Scareware Conference.
ungawatkt 7y ago
I had that happen to a test redis instance on aws (my bad for missing the port auto-routing in the cloudformation script I was trying out). About 24 hours and a bot had placed what I think was a Bitcoin mining program on it through the redis persistence mechanism.
Nextgrid 7y ago
I once put an (intentionally) bad root password on a machine to be able to log in to the physical console, then configured the machine (it was supposed to be a router) and put it on the Internet, forgetting the bad password. I remembered a few hours later, gone back to rebuild the machine as I assumed it would be compromised, and sure enough, there was some crypto miner on it. Sadly for them, the machine didn't have anywhere enough processing power to make it worth it and they should've instead been smarter and made better use of it (it had a very beefy network connection so plenty of potential for DoS attacks or hosting malicious content, as well as being in a privileged position to capture potentially sensitive unencrypted traffic).
- tetha 7y ago
  Yup. I recently setup a new VM on a new cloud provider at work and that poor thing got hammered with 2-4 authentication requests per minute from the get-go. By the time the UI of the cloud provider displayed the VM as running, there'd been 23 failed login requests already. I guess this means: if you're not careful, you might lose the VM before you can even login. Our base image now comes with a hardened sshd and raised firewalls so the first provisioning-run of the configuration management actually has to reduce the firewall protection.

WrtCdEvrydy 7y ago

> I put a real MySQL there once; they deleted all the tables and created a new one asking for bitcoin to get them back. Database ransomware: Are you vulnerable - Next year on Scareware Conference.

ungawatkt 7y ago

I had that happen to a test redis instance on aws (my bad for missing the port auto-routing in the cloudformation script I was trying out). About 24 hours and a bot had placed what I think was a Bitcoin mining program on it through the redis persistence mechanism.

Nextgrid 7y ago

I once put an (intentionally) bad root password on a machine to be able to log in to the physical console, then configured the machine (it was supposed to be a router) and put it on the Internet, forgetting the bad password. I remembered a few hours later, gone back to rebuild the machine as I assumed it would be compromised, and sure enough, there was some crypto miner on it. Sadly for them, the machine didn't have anywhere enough processing power to make it worth it and they should've instead been smarter and made better use of it (it had a very beefy network connection so plenty of potential for DoS attacks or hosting malicious content, as well as being in a privileged position to capture potentially sensitive unencrypted traffic).

tetha 7y ago
Yup. I recently setup a new VM on a new cloud provider at work and that poor thing got hammered with 2-4 authentication requests per minute from the get-go. By the time the UI of the cloud provider displayed the VM as running, there'd been 23 failed login requests already. I guess this means: if you're not careful, you might lose the VM before you can even login. Our base image now comes with a hardened sshd and raised firewalls so the first provisioning-run of the configuration management actually has to reduce the firewall protection.