5 ms·

Thousands of unauthenticated databases exposed on the internet – study

58 points by rhlresearcher 5y ago

29athrowaway 5y ago
Using shodan.io you can search for Internet-facing db servers without authentication. Shodan has been around for 12 years already.
- batch12 5y ago
  Yeah, this feels like a thinly-veiled advertisement for their service.
- unstatusthequo 5y ago
  Shodan is great. I’ve used it quite a lot for my work.
  - thinkingemote 5y ago
    Could you explain a bit more? Are you looking for public vulns in your work machines/networks?
easytiger 5y ago
I was googling someone's email address the other day and was able to access the admin panel of a corporate mailing list management software where I was able to view their data and accessed every email they had, including notes about them. Totally messed up. I didn't try but knowing the slugs now I recon not too hard to find similar instances
- Scoundreller 5y ago
  I did that too with an old home address. Contacted an admin (easy to find obviously), and they took it down pretty fast. Of course this only happens if you fail to exclude this in robots.txt, so there’s probably plenty more wide open but not indexed.
- 29athrowaway 5y ago
  There is a talk from a security researcher about visiting random HTTP servers exposed to the internet. He found the control panel for a power plant, an ice skating rink, traffic lights, etc. There was even a button that you could press to put the traffic lights on test mode, that had a message saying "Warning: injury or death can occur". No authentication was required for any of those systems. Why? because some people wrongly believe that not being behind a domain name and not being on a search engine (other than shodan, of course), makes their shit secure. That's why sometimes I think working in IT or software should require a license.
  - achillean 5y ago
    It was probably one of @Viss's talks. Here's one he did at DEFCON: https://www.youtube.com/watch?v=-T-3buBwMEQ https://www.youtube.com/watch?v=-T-3buBwMEQ
    - 29athrowaway 5y ago
      Thank you, this was the talk I was referring to. I had forgotten the exact name. Entertaining yet worrying.
  - heurisko 5y ago
    Until then, it would be helpful if projects prompted during installation to setup authentication (and didn't continue without) and were bound to localhost. I wonder why MySQL and postgresql databases don't show up on these lists.
    - rhlresearcher 5y ago
      We majorly focused on NoSQL databases
  - DyslexicAtheist 5y ago
    > That's why sometimes I think working in IT or software should require a license. IMO the problem isn't lack of training or another licensing scheme but the lack of budget companies allocate to QA & Security.
tyingq 5y ago
>We chose to keep this very non-intrusive by making use of a uniform single packet scan across the entire IPv4 space Heh.
seventytwo 5y ago
Only two of these database types have any presence on the US west coast?? Seems odd…
- achillean 5y ago
  There definitely are instances of those databases on the west coast. For example: https://www.shodan.io/search?query=product%3Aelastic+state%3ACA%2COR%2CWA https://www.shodan.io/search?query=product%3Aelastic+state%3...
- frankfrankfrank 5y ago
  It's just the map image that does not show any of the exposed DBs west of the Mississippi for several of the DB types.
- 0xInfection 5y ago
  The idea was not to detect how many databases are there on the internet, but rather unauthenticated/vulnerable ones. It is possible that the databases exist on US west coast, but aren't vulnerable. The maps were generated using ipinfo.io (linked in the article).
frankfrankfrank 5y ago
It is a bit odd that only Mongo and Rethink are showing any of the exposed DBs west of the Mississippi in the map image of the article.
akudha 5y ago
This can be mitigated (at least to some extent) if database vendors forced requirement of passwords (at least semi strong) during installation, no? Is there a reason why I should be allowed to access a database (even if it is local, on my laptop) without a password?
- foobiekr 5y ago
  This is the correct answer. Literally every equipment vendor does this. Why must we reinvent everything? Even obvious things…
ArcturianDeath 5y ago
https://ewasion.github.io/opendirectory-finder/ https://ewasion.github.io/opendirectory-finder/ https://www.eyeofjustice.com/od/ https://www.eyeofjustice.com/od/ https://opendirsearch.abifog.com/ https://opendirsearch.abifog.com/

58 points by rhlresearcher 5y ago

Using shodan.io you can search for Internet-facing db servers without authentication. Shodan has been around for 12 years already.

batch12 5y ago
Yeah, this feels like a thinly-veiled advertisement for their service.
unstatusthequo 5y ago
Shodan is great. I’ve used it quite a lot for my work.
- thinkingemote 5y ago
  Could you explain a bit more? Are you looking for public vulns in your work machines/networks?

easytiger 5y ago

I was googling someone's email address the other day and was able to access the admin panel of a corporate mailing list management software where I was able to view their data and accessed every email they had, including notes about them. Totally messed up. I didn't try but knowing the slugs now I recon not too hard to find similar instances

Scoundreller 5y ago
I did that too with an old home address. Contacted an admin (easy to find obviously), and they took it down pretty fast. Of course this only happens if you fail to exclude this in robots.txt, so there’s probably plenty more wide open but not indexed.
29athrowaway 5y ago
There is a talk from a security researcher about visiting random HTTP servers exposed to the internet. He found the control panel for a power plant, an ice skating rink, traffic lights, etc. There was even a button that you could press to put the traffic lights on test mode, that had a message saying "Warning: injury or death can occur". No authentication was required for any of those systems. Why? because some people wrongly believe that not being behind a domain name and not being on a search engine (other than shodan, of course), makes their shit secure. That's why sometimes I think working in IT or software should require a license.
- achillean 5y ago
  It was probably one of @Viss's talks. Here's one he did at DEFCON: https://www.youtube.com/watch?v=-T-3buBwMEQ https://www.youtube.com/watch?v=-T-3buBwMEQ
  - 29athrowaway 5y ago
    Thank you, this was the talk I was referring to. I had forgotten the exact name. Entertaining yet worrying.
- heurisko 5y ago
  Until then, it would be helpful if projects prompted during installation to setup authentication (and didn't continue without) and were bound to localhost. I wonder why MySQL and postgresql databases don't show up on these lists.
  - rhlresearcher 5y ago
    We majorly focused on NoSQL databases
- DyslexicAtheist 5y ago
  > That's why sometimes I think working in IT or software should require a license. IMO the problem isn't lack of training or another licensing scheme but the lack of budget companies allocate to QA & Security.

tyingq 5y ago

>We chose to keep this very non-intrusive by making use of a uniform single packet scan across the entire IPv4 space Heh.

seventytwo 5y ago

Only two of these database types have any presence on the US west coast?? Seems odd…

achillean 5y ago
There definitely are instances of those databases on the west coast. For example: https://www.shodan.io/search?query=product%3Aelastic+state%3ACA%2COR%2CWA https://www.shodan.io/search?query=product%3Aelastic+state%3...
frankfrankfrank 5y ago
It's just the map image that does not show any of the exposed DBs west of the Mississippi for several of the DB types.
0xInfection 5y ago
The idea was not to detect how many databases are there on the internet, but rather unauthenticated/vulnerable ones. It is possible that the databases exist on US west coast, but aren't vulnerable. The maps were generated using ipinfo.io (linked in the article).

frankfrankfrank 5y ago

It is a bit odd that only Mongo and Rethink are showing any of the exposed DBs west of the Mississippi in the map image of the article.

akudha 5y ago

This can be mitigated (at least to some extent) if database vendors forced requirement of passwords (at least semi strong) during installation, no? Is there a reason why I should be allowed to access a database (even if it is local, on my laptop) without a password?

foobiekr 5y ago
This is the correct answer. Literally every equipment vendor does this. Why must we reinvent everything? Even obvious things…

ArcturianDeath 5y ago

https://ewasion.github.io/opendirectory-finder/ https://ewasion.github.io/opendirectory-finder/ https://www.eyeofjustice.com/od/ https://www.eyeofjustice.com/od/ https://opendirsearch.abifog.com/ https://opendirsearch.abifog.com/