Hacker News Reader

Comment by kitotik | Hacker News Reader

Yet another Elasticsearch server wide open. This is going to make the flurry of open mongodb servers look trivial.

I wouldn't be surprised if the starting point for this vulnerability wasn't ES, but Docker. Docker by default modifies iptables and if you hack together a system that uses both software running directly on the host and in containers, it's going to expose the forwarded containers to the Internet - which you might not be expecting, since a bind to localhost would be enough to expose a service. It's always a good idea to have a separate firewall running outside of the your system - this is the one Docker can't fool.

I had this issue last week. I was pulling my hair out as to how my brand new Linode got hacked even though I had setup ufw within minutes.

It is downright ridiculous that this was ever approved as a default behavior.

They mentioned this is google cloud, which blocks almost all incoming ports by default. they had to have chose to expose this through the project firewall, and not put in a source filter.

No. It's not dockers' fault you did not read the manual and expose the ports wrong: you can bind the port to specific ips for export and tjat address should be 127.0.0.1

I see where you're coming from, but I disagree. I believe that good software and abstractions should take little training to use - everything unintuitive is a design failure and should be fixed. "Reasonably secure" should be the implicit default, not something you need to explicitly added. E.g., it's better to force authentication and force the administrator to add an account than let everyone in by default. Or it's better to bind to 127.0.0.1 than to 0.0.0.0 by default, like most web servers built into frameworks I saw do.

Unfortunately, instead of good intuition, Docker is built on caveats, be it networking, storage, caching, image sharing, container/image distinction, authentication, deployment or building a cluster. Every subsystem I experimented with "works", but fails in weird ways in some situations. In my opinion, that means that Docker is a good idea, but has terrible UX/functionality/error handling. I kind of think the same way of Git.

Great point. Depressing how such large profile projects can have such insane defaults.

I believe Elasticsearch doesn't allow restricting access by requiring login unless you pay for the enterprise version, which is just straight up stupid.

The basic license is free now, so you can get basic authentication.

But I still wonder why that isn't part of the open source version, and why it isn't turned on by default....

They're everywhere. Just ask Shodan.

I remember there was some brewhaha a while back about how Shodan was able to discover services on IPv6 since the address space was so sparse. Apparently they were running enough of their own NTP servers to reliably map out lots of devices on IPv6.

Not being able to map ipv6 space is a myth. There's plenty of workarounds.

Such as? Not too familiar with the subject, would love to know how.

It's pretty old news these days, guessing it's mostly what's leaked out of private to public sector stuff, is probably just the beginning really.

Would suggest starting at arxiv. This is not a hidden field for the active and/or keen researcher.

> Shodan is a search engine that lets the user find specific types of computers connected to the internet using a variety of filters. Some have also described it as a search engine of service banners, which are metadata that the server sends back to the client.

Interesting.

Since I learned about Shodan, I'm convinced that the (subjectively) increase in reported data breaches is just due to an increasing amount of people looking through Shodan results, and doesn't have anything to do with any trends in security.

Security standards at any company have always been low, but now it's easy even for a layman to find leaked data.

Not sure about Google Cloud, but Elasticsearch on AWS doesn't support x-pack security. You can only secure your instance via IP restriction, otherwise you have to sign your requests, which is not always supported on Elasticsearch DSL libraries that are commonly used.

It's not hard to secure ES. If people need help, please just ask, happy to help.

Reply on news.ycombinator.com