[HN Gopher] Thousands of unauthenticated databases exposed on th...
       ___________________________________________________________________
        
       Thousands of unauthenticated databases exposed on the internet -
       study
        
       Author : rhlresearcher
       Score  : 51 points
       Date   : 2021-07-02 07:38 UTC (15 hours ago)
        
 (HTM) web link (redhuntlabs.com)
 (TXT) w3m dump (redhuntlabs.com)
        
       | seventytwo wrote:
       | Only two of these database types have any presence on the US west
       | coast?? Seems odd...
        
         | frankfrankfrank wrote:
         | It's just the map image that does not show any of the exposed
         | DBs west of the Mississippi for several of the DB types.
        
         | achillean wrote:
         | There definitely are instances of those databases on the west
         | coast. For example:
         | https://www.shodan.io/search?query=product%3Aelastic+state%3...
        
       | 29athrowaway wrote:
       | Using shodan.io you can search for Internet-facing db servers
       | without authentication. Shodan has been around for 12 years
       | already.
        
         | unstatusthequo wrote:
         | Shodan is great. I've used it quite a lot for my work.
        
           | thinkingemote wrote:
           | Could you explain a bit more? Are you looking for public
           | vulns in your work machines/networks?
        
         | batch12 wrote:
         | Yeah, this feels like a thinly-veiled advertisement for their
         | service.
        
       | akudha wrote:
       | This can be mitigated (at least to some extent) if database
       | vendors forced requirement of passwords (at least semi strong)
       | during installation, no? Is there a reason why I should be
       | allowed to access a database (even if it is local, on my laptop)
       | without a password?
        
         | foobiekr wrote:
         | This is the correct answer. Literally every equipment vendor
         | does this.
         | 
         | Why must we reinvent everything? Even obvious things...
        
       | easytiger wrote:
       | I was googling someone's email address the other day and was able
       | to access the admin panel of a corporate mailing list management
       | software where I was able to view their data and accessed every
       | email they had, including notes about them.
       | 
       | Totally messed up. I didn't try but knowing the slugs now I recon
       | not too hard to find similar instances
        
         | Scoundreller wrote:
         | I did that too with an old home address. Contacted an admin
         | (easy to find obviously), and they took it down pretty fast.
         | 
         | Of course this only happens if you fail to exclude this in
         | robots.txt, so there's probably plenty more wide open but not
         | indexed.
        
         | 29athrowaway wrote:
         | There is a talk from a security researcher about visiting
         | random HTTP servers exposed to the internet.
         | 
         | He found the control panel for a power plant, an ice skating
         | rink, traffic lights, etc.
         | 
         | There was even a button that you could press to put the traffic
         | lights on test mode, that had a message saying "Warning: injury
         | or death can occur".
         | 
         | No authentication was required for any of those systems. Why?
         | because some people wrongly believe that not being behind a
         | domain name and not being on a search engine (other than
         | shodan, of course), makes their shit secure.
         | 
         | That's why sometimes I think working in IT or software should
         | require a license.
        
           | [deleted]
        
           | DyslexicAtheist wrote:
           | > That's why sometimes I think working in IT or software
           | should require a license.
           | 
           | IMO the problem isn't lack of training or another licensing
           | scheme but the lack of budget companies allocate to QA &
           | Security.
        
             | jimktrains2 wrote:
             | And a license and code of ethics would be a concrete way to
             | push back against employers cutting coats or time.
        
             | 29athrowaway wrote:
             | Licenses can be revoked.
             | 
             | When you know you can lose your license, being a duct tape
             | programmer becomes a liability.
             | 
             | People will want to understand what they do, and be
             | reluctant to work for tech debt mills.
             | 
             | As a result, tech debt mills would die and be forbidden
             | from making software. It would be a wonderful world.
        
           | achillean wrote:
           | It was probably one of @Viss's talks. Here's one he did at
           | DEFCON: https://www.youtube.com/watch?v=-T-3buBwMEQ
        
             | 29athrowaway wrote:
             | Thank you, this was the talk I was referring to. I had
             | forgotten the exact name. Entertaining yet worrying.
        
           | heurisko wrote:
           | Until then, it would be helpful if projects prompted during
           | installation to setup authentication (and didn't continue
           | without) and were bound to localhost.
           | 
           | I wonder why MySQL and postgresql databases don't show up on
           | these lists.
        
       | tyingq wrote:
       | >We chose to keep this very non-intrusive by making use of a
       | uniform single packet scan across the entire IPv4 space
       | 
       | Heh.
        
       | frankfrankfrank wrote:
       | It is a bit odd that only Mongo and Rethink are showing any of
       | the exposed DBs west of the Mississippi in the map image of the
       | article.
        
       ___________________________________________________________________
       (page generated 2021-07-02 23:02 UTC)