Hacker News Reader

Comment by OJFord | Hacker News Reader

> a misconfigured and Internet-facing Elasticsearch database without a password." If this wasn't bad enough, a Kibana web-based app, there to make navigating through the data easier, had no password protection.

That's not even really 'exposed in breach', that's just 'exposed'.

View on HN

If the Kibana app wasn't exposed I could surely host my own and connect it to the same exposed Elastic Search.

It's like saying "someone stole my keys ... and if that wasn't bad enough they got the key ring!"

I think in some sense having an admin interface exposed as well as the admin API is 'worse'.

I completely agree that it doesn't make it less secure, but it does make it more.. 'oh come on'. I mean, nobody who was using it legitimately realised?

Or rather I gave copies of my keys to everyone who passed by.

that's not even exposed, that's public indecency.

Maaaybe releasing tools with default unsecured configuration (with paid security addons for Kibana) should be shamed.

Elasticsearch is basically MongoDB in this regard.

If megacorp #246 decide to use a free software I'm inclined to think they have more than enough money to pay engineers to secure it. It's not rocket science.

It's like installing a mysql db and leaving the root password blank because "welp it's the default config".

Im pretty sure the mysql install wont let you set a blank root pw. And it will only listen on localhost by default.

> they have more than enough money to pay engineers to secure it

But they usually don't want to. It usually goes like that: we need some internal tool to do stats. All our people are busy on other projects. Let's get an intern to do that.

In that case you can expect it has also been syncing with other misconfigured es servers around the world.

At least government should mandate all the manufacturers to disable all the default passwords. It's simply a good practice, we're not even talking about security loopholes on the device itself.

Reply on news.ycombinator.com