2.9k VIEWS
Pinterest LinkedIn LINE

Apparently, many companies’ “big data” is leaking everywhere. According to BinaryEdge[1], a security company in Zurich, Switzerland, the results of its study[2] show that vast amounts of data are exposed directly to the internet. The total is an astonishing 1.1 petabytes.

The company’s study scanned internet-exposed hosts belonging to a wide range of organizations, from Fortune 500 companies to startups, and extracted metadata from publicly accessible MongoDB, Memcached, Elasticsearch, Redis Cache, and similar systems. The company states explicitly that it did not obtain the data itself.

According to the findings:

  • 35,330 Redis Cache instances,
  • 39,134 MongoDB instances,
  • 118,574 Memcached instances, and
  • 8,990 Elasticsearch instances

were apparently exposing data to the entire world without authentication or authorization[3]. Many were also running old versions, including some versions that reportedly allow attackers to take over the server.

The Register investigated the study further and published an article[4]. According to that article, the metadata showed that the exposed fields included:

  1. “usernames,” “passwords,” “session tokens,” and similar items;
  2. “patients,” “doctor lists,” and similar items at medical institutions;
  3. “coin,” “money,” and similar items at banks; and
  4. “blueprints,” “project names,” and similar items at robot manufacturers.

Items 1 and 2 may be of particular interest to readers of this blog. Leaking passwords is beyond the pale, and session tokens also seem usable for session hijacking. Fields such as “patients” suggest that medical data may be exposed. This creates a risk of serious privacy violations.

Economically, however, item 4 may be the most serious. Exposing “blueprints”… Well, perhaps it is open-source hardware…

BinaryEdge says it notifies the relevant companies about problems it discovers. At the same time, it reportedly offers a continuous monitoring service.

What these findings suggest is that the people using these technologies may not even recognize the importance of securing them. It is much like the way Japanese companies apparently had no awareness of the grave impact of discharging polluted water until the first half of the Showa 40s. Education would take too long, so perhaps some form of regulation or taxation is necessary after all.

[1] BinaryEdge https://binaryedge.io/

[2] Binary Edge: Data, Technologies and Security – Part 1 (2015-08-17), http://blog.binaryedge.io/2015/08/10/data-technologies-and-security-part-1/

[3] The results above reportedly exclude companies that asked not to have their IP ranges scanned, so even more servers are probably exposing data in reality.

[4] Leyden, John: Misconfigured Big Data apps are leaking data like sieves, The Register (2015-08-13), http://www.theregister.co.uk/2015/08/13/big_data_apps_expose_data/

 

Related posts