3 ms·

it doesn't say so explicitly in the article, but the screenshots points towards an open elasticsearch instance that seems to be part of k8s logging infrastructu

• alias_neo 6y ago
  I blame elasticsearch. I've spun up elasticsearch containers in the past on VPSs to have Meow hit them almost instantly. It takes longer to read the docs and figure out that if you're not paying, security isn't default. In fact, it's a fair bit of configuration and reading to enable security properly if it's the first time you're using it. Coupled with Docker popping holes all over your firewall, it's an easy way for a non-security aware operations engineer to leave data all over the internet. If I'm not mistaken, Meow was created to delete data in instances like this to help protect against misconfigured instances.
  • vorpalhex 6y ago
    I had totally forgotten Meow was even a thing. Talk about a purrfect example of a greyhat attack - pointing out the flaws and removing PII without demanding bitcoins or engaging in ransoms. Obviously, treat all attacks as if they are serious.. but wow.
  • UweSchmidt 6y ago
    Happened to me while doing a Docker tutorial. The practice dockerfile contained an elasticsearch container which I put on that Hetzer instance. Shortly after I received an email from the BSI (German Federal Office for Information Security), warning me about it. Aparently all kinds of entities scan around for vulnerabilities. I had noticed elasticsearch being the culprit in security advisories and reports of breaches, but it's easy to miss when you're busy with something else. Security has to be the default!