Slashdot Log In
Half a Million Database Servers 'Have no Firewall'
Posted by
CmdrTaco
on Wed Nov 14, 2007 08:40 AM
from the well-thats-not-so-bad dept.
from the well-thats-not-so-bad dept.
An anonymous reader writes "There are nearly half a million database servers exposed on the Internet, without firewall protection according to UK-based security researcher David Litchfield."
Related Stories
Submission: Half a million database servers 'have no firewall' by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Have i missed something? (Score:3, Informative)
Re: (Score:3, Informative)
The more logical (and secure) solution would be
{internet}
|
app-servers
| (internal network)
db-servers
Re:You missed something too (Score:5, Funny)
Parent
Re:You missed something too (Score:5, Funny)
You are not a lawyer, you are a hairball?
(sorry, couldn't resist)
Parent
Re: (Score:3, Insightful)
Nope nope nopity nope.
The issue is not with a secure (or otherwise) port being exposed to the internet, the real security issue is the question of where has business logic just been moved?
REGARDLESS of whether the database server listenes on port 35530, has super duper extra strength nine fafillion bit crypto (now with more caffiene!!! (tm) ) and only accepts co
Chicago (Score:5, Funny)
Parent
Re:Have i missed something? (Score:5, Informative)
That's not true.
For example, you may have a stand-alone java app at multiple locations that can query the database directly, so you'd definitely open up the port.
This is just another example of "OMFG LOOK AT ME!!! I FOUND TEH SECURITY HOLE!" bullshit. Same as "your computer is broadcasting its IP address."
Not everything has to go through a bloody web server.
Their "idea" of a vulnerability was if the port was open - not if they could gain access.
Parent
Web Services? (Score:5, Informative)
Parent
Re:Web Services? (Score:5, Insightful)
The same argument could be made about ANY service/port, including http, ftp, etc. The premise of the article - that "port open == bad all by itself" - is junk.
And as we have repeatedly seen, accessing your db through a web server gives 2 different attack vectors - flaws in the web server, and flaws in the middleware.
Nothing except an unplugged box with the hard drive removed will ever be 100% secure.
Parent
Good Point, but... (Score:5, Insightful)
Parent
Re: (Score:3, Funny)
Ahem...I think we were talking about real databases here.....
I say its FUD because (Score:5, Insightful)
Parent
Re:Web Services? (Score:4, Interesting)
The same argument could be made about ANY service/port, including http, ftp, etc. The premise of the article - that "port open == bad all by itself" - is junk.
If you don't take any precaution with your data, you're going to lose, no matter how many layers -- but somehow I can't find myself agreeing that giving the raw DB socket and passing all necessary authentication info to the world at large within the applet I'm sending out is a good way either. (of course, you can try and lock down the DB user so that the user within the DB can't do much damage, but you're still opening a hole through which you might also try and hack for other DB accounts with more permissions).
Parent
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re:Have i missed something? (Score:5, Informative)
I have mentioned this several times on slashdot but there is a severe lack of actual professionals in control of networks out there. I would say that there are all too many who have never even thought about security at this level, they just make sure that they have control of their users and pat themselves on their back for being able to make two servers talk across a WAN.
This all derives from the misconception that you have to be 40+ to be a seasoned professional in the business world. The IT security field is a very new one relatively, some of the best security personnel are much younger than I am but never get considered because even with 5 years experience, a degree and several certifications, they are only 24 and therefore not worthy of note. (no I am not ranting about myself, I ahve a wonderful position for someone my age, but I know many IT geeks who get passed over because of their age, although no one would ever admit it.) Get the 40 year old guy who was a sociology major and did data entry for 10 years before being asked to take over NT environments. This way you get a 'seasoned' guy because he has a few more wrinkles and that makes him a better 'fit' and definitely must make him more capable.
Parent
Re:Have i missed something? (Score:5, Funny)
Parent
Re: (Score:3, Interesting)
Funny thing is, where I'm working, the bias is against older people. "We tried a half-dozen, and they all had issues." Since then, we've gone through I don't know how many people in the 20-to-40 age bracket, but I'm still here :-)
In the last year, the bias has shifted back to the over-50 group in larger businesses, because, IF they've been in the field for a couple of decades, they're worth it, and generally don't have the "need" to get into "pissing contests" about who knows what - they've had a couple
Re: (Score:3, Insightful)
what? (Score:2, Funny)
Re:what? (Score:5, Insightful)
If you secure your server correctly in the first place.
Close up, secure and encrypt ports that consume passwords and serve data.
You don't have a problem! Within reason of course.
I that gets breached, a firewall won't protect you from an attack either.
Du...
I wonder how many people know that firewalls don't actually do anything.
Accept keep useless network fanboys employed.
Parent
Re:what? (Score:5, Insightful)
Firewalls are good for:
- Helping to limit access to services which don't have built in access limits (think tcp-wrappers++)
- Helping to protect a pile of machines over which you have little to no control (a bunch of desktops in the office, for example).
When talking about servers, if you sufficiently harden your machine, a firewall does very little, especially if the service being compromised is one which the firewall allows pretty much anyone access to...
Parent
Re:what? (Score:5, Interesting)
Now, sure, you can say "It's open source, it's got all kinds of people looking at it, of course it is secure." But face it: people make mistakes, and the more subtle the screwup, the more people it will take to find it. Eventually there will be a screwup too subtle for all the people looking to find. Then you have potential setup errors, something was missing in the documentation or overlooked by the individual doing the install/test, etc. You now have a vulnerability. Yes, none of these mistakes *should* exist, and having a firewall *shouldn't* be used as the *primary* method of protecting your system, but extra defense is good. The more software you run, the wider the variety of operating systems you run, the more likely one of these errors is to happen. A firewall is cheap (usually), and it happens to block this kind of attack.
Yes, relying on a firewall as your only means of defense is stupid, and there is a lot it doesn't protect, but a door lock doesn't defend against all means of entrance - it doesn't mean you shouldn't lock your doors. A firewall *is* a nice backup to have in case of human error in the programming or setup of an application.
Parent
But firewalls are part of that hardening. (Score:3, Insightful)
Re: (Score:3, Insightful)
To be human is to err, and every Application/OS I've seen is programmed by humans. An extra layer of security doesn't hurt, especially against the bugs we don't know about yet - most bugs/security flaws weren't know about/understood prior to being fixed, and prior to fixing, they could have been exposed.
Also, consider that you might have a server with several ports open, some which by nature must be intranet only, others which must be in
Not Suprising (Score:5, Informative)
This isn't so suprising:
The world at large is uninterested and/or unaware of security when it comes to computers.
Re:Not Suprising (Score:5, Insightful)
I've seen a number of things cobbled together just to get a department or company through something that suddenly become available to a lot more people than the original target audience. It's a good argument for never taking short cuts when you're programming, but I'm sure there are a lot of people that have gotten something out on a deadline only to turn around and look at it later and say "What came over me to do it that way?"
Parent
Re:Not Suprising (Score:5, Funny)
If you can't correct it, you needn't detect it.
Parent
Re: (Score:3, Insightful)
For 'almost impossible' conditions, dying immediately with an error message is maybe not ideal, but still a hundred times better than silently ignoring the error and reporting success.
Re:Not Suprising (Score:5, Funny)
Insufficiently precise? Holy weasel words batman. You were wrong.
Parent
Re: (Score:3, Insightful)
To answer the quote above: in C and C++ printf() [including fprintf() and sprintf()] returns an int, representing the number of characters formatted and written out - and not including any null byte appended as a string terminator.
So, it's an error when printf() doesn't output the expected number of bytes. Check.
Ummm, how do you determine exactly how many bytes it should have written so that you can compare the values? I can't really think of any way you could correctly do that in a locale-sensitive manner without re-implementing printf() in the first place, at which point the whole think is moot and you're fired for dicking around too much on the job.
Re:Not Suprising (Score:5, Insightful)
I've worked and volunteered for several non-profit, NGOs and small businesses. And worked in B2B sales selling computer equipment to them. Generally the IT staff is an outside consultant who does a few things (whatever they're able to afford). Setting up of complex computer equipment and software is often left to someone who's able to understand the instruction manual but no IT training (so it could be the receptionist, the director or somewhere in-between). Setting up a firewall is expensive and doesn't fit into many budgets of small organizations. Someone with no IT training may also think a DB server or networked printer needs no firewall.
Let me put it this way: as a non-IT worker, I haven't put 100% of my resources behind studying I.T. (software, hardware) etc. I've programmed computers and used computers since I was born. Despite being somewhat knowledgeable in TCP/IP and reading firewall and comp. security books (mostly for self-interest), I'm not confident I can even configure an adequate firewall for my home computer. Things like FreeBSD's IPFW are supposed to be "easy" to setup. Not my experience. Its sheer confusion. MS, Apple and some OSS firewalls are supposed to make it even easier. Block this port, block that port and that's it??? don't think so. I'm not even 50% confident this solution provides adequate protection esp for a NGO, non-profit, SMB or home computer. So how is someone not as well-read supposed to setup a firewall on a limited budget? But a pre-built hardware solution? Still that needs to be setup and configured too. And even then, you still have to be knowledgeable enough to *test* whatever solution you're using to actually make sure it works and keeps your system well protected.
Not a trivial or inexpensive task. But people with no training or knowledge are often asked to do this.
Parent
Re: (Score:3, Insightful)
The world at large is uninterested and/or unaware of security when it comes to computers.
I would lean towards the 'unaware' part of your statement. I have no numbers to back up my opinion, but I am thinking that the vast majority of computer users don't have a clue about what they are using. Most know just enough to be dangerous to themselves and their PC. I see this at work where a user has been using a PC for the last 10 years, but still effectively knows nothing about it. To them, it is just a tool.
I believe that wide spread knowledge of security and privacy practices won't come into
Only SQL server and Oracle? (Score:4, Interesting)
Questions (Score:2)
Re: (Score:3, Interesting)
It kills me the number of decisions that are made at the business level by simply watching commercials or reading articles. If I have another business person ask me if they should have "SAP", I think I am going
Yawn (Score:5, Insightful)
1. Because everyone knows that a firewall is the end all and be all of security.
2. How do they know they don't have a firewall and not just an open port?
3. Open port != DB server
5. Maybe some of them actually need/want to have remote people access them (and they don't know about VPNs(lolz))
6. Yeah some people should get their shit together
Did Mr. Litchfield crash his BMW and wants a new one? This just smacks of "ZOMG!!! Ur ports are open, give me ur monies and I will fix u!" His company is even linked in the fourth paragraph. Next please.
Re: (Score:3, Interesting)
I still think he's just trying to grab attention to drum up business.
I'm not going to disagree with you on that. That's pretty much what most security researchers do ;-). There are probably non-fearmongering security researchers, but they don't get headlines...
Anyway, not having a firewall doesn't make you unsafe automatically (as long as you have strong passwords, and everything is patched, and something like fail2ban is stopping bruteforce attempts, and you actually know what you're doing), but it wouldn't surprise me if a lot of them were set up by clueless admins.
Corporate Data? (Score:4, Insightful)
Also, the sample of 1 million is very small to be drawing these conclusions.
In short, "Nothing to see here - move along."
Declaration of interest (Score:5, Insightful)
Oracle's listener on port 1521 (Score:5, Insightful)
I wish he had known what he was writing about before he actually wrote the damn article.
Accountability is lacking (Score:3, Insightful)
No it isn't. Now, if there were some penalty to losing half a million identities that was borne by the database owner instead of the poor schmucks whose identities were stolen, then it would be amazing.
But when your data is stolen, I'm the one who has to pay. Why should you care? You're not paying.
Well... (Score:5, Interesting)
Since my home is on cable, there isn't any static IP address to put in the server's iptables rules, and so I need to leave the mysql port on the server open. For security I use MySQL grant tables to specify that from outside only the restricted 'replication' user can have password access. Even if someone managed to guess the password for that user, the grants say that all they can do is replicate (and then they'd have issues because they wouldn't have any initial copy of the database). Since I don't store passwords in the db at all, it's fairly secure. Sure, it's not bulletproof, but as long as you're aware of the issues and take reasonable steps, it's very possible to have a database server intentionally open to the internet.
Even better, run the replication over ssl, then nobody can sniff anything from the stream. I haven't done that yet (until recently I was running an older version that didn't support ssl) but it is on my to-do list.
Another small thing you can do is to change the port that MySQL is listening on, but haven't bothered to go that far yet - the existing security seems to have been pretty solid.
Re: (Score:3, Informative)
Might I introduce you to SSH (Score:5, Informative)
A webserver needs at most three ports open, 80, for obvious reasons, 443 for https and 22 for ssh. That is it.
If you need to connect remotely to another service you do it via SSH.
Mysql is a database. Let it do databases. Let SSH do its job.
When I see people use your logic you make my jaw drop. SSH for live. EVERYTHING over ssh. ALWAYS. Full stop, end of story. No argument.
Exposing your database like this is insanity and you are asking for trouble. Mysql authentication is a joke and considering you are doing it this way, you probably have it setup wrong. Because what you are doing is wrong.
Tunnel over SSH. It is a most basic tool. Read up on it, NOW! Google: mysql tunnel ssh
Offcourse, next thing he will say is that he uses telnet for remote access, some admins would make ghandi loose his temper
Parent
Re:Might I introduce you to SSH (Score:4, Interesting)
Here's a clue: You don't convince people by shouting at them, telling them they are completely, utterly, totally wrong (especially when the world really isn't as black and white as you are suggesting). I'm guessing you might the the type of person who would also try to tell me I'm completely, utterly wrong for using MySQL at all. I've long given up trying to reason with zealots.
In point of fact, your post is a good example of why I don't post all that much on slashdot or reddit any more. It seems that many people who "debate" online have given up on civilized discussion and instead jump straight to the kind of cut-throat, over-the-top, spittle-flying shouting match that typifies television "news" these days.
See, we could be talking about the technical merits of your argument, but instead you got me going on how you come across like a total dick.
Could the job be done using ssh tunneling? Probably, undoubtedly so. Does my setup work just fine for what it's doing? Absolutely, for the last eight years in fact. For me, the MySQL security model works just fine. As I said, I'll be using the SSL feature anyway as soon as I can get around to rebuilding MySQL with SSL enabled.
And incidentally, it's "lose", not "loose".
Bye now.
Parent
Disable mysql external access with skip-networking (Score:3, Interesting)
Disable mysql external access by adding this line to /etc/my.cnf :
skip-networking
This will prevent external access to MySQL, firewall or no firewall. All access will go through Unix sockets or named pipes. Restart mysql with /etc/init.d/mysql restart For me, no other configuration was required for several mysql-consuming apps, including php custom scripts, phpbb, phorum, and sympoll.
Doesn't surprise me (Score:4, Interesting)
Third, you have things like Windows Firewall where for some things it's just easier to run without the firewall than with it (not that I'd do it, but I've seen it happen). Even something simple like OpenVPN over Windows Firewall in udp mode (the only decent performing mode in OpenVPN) is next-to-impossible to get running properly - the time you take to make it work is better spent installing a real firewall that can do the job (even ZA "just handles it"). A lot of servers are open but "hide behind" an external or hardware firewall on which necessary ports are then just opened. I remember trying to get my last workplace to install at least Windows firewall on clients and servers alike - the exceptions were already in place, the systems worked perfectly with it turned on, but they still wouldn't do it. Fortunately, they were behind an external firewall not configured by them - however a single virus could run rampant across the client PC's in a matter of minutes.
Fourth, most people have no idea what packets their networks send out to the world, or what ports are open - and they don't care until the day they notice that someone is accessing their system, which can be years after it was first compromised.
It's quite simple. If you can see it from outside your network, so can anyone in the world. If they can see it, they can attack it (and even sometimes if they CAN'T see it but know it's likely to be there!). If they can attack it and you don't update it, you could be in serious trouble. And even if you are firewalled off to the maximum, have up-to-date patches and proper security procedures attackers can still sometimes get through, but making their life as difficult as possible is not only fun but also productive.
Some people just don't care though. It's not going to change any time soon. Viruses and attacks are so common you hear things like "yeah, my laptop had a virus on it but I can't afford the subscription so I didn't bother clearing it up - made my computer a bit slow, though". Most people are just far too casual. You can even over-do the dramatics and explain possible dire consequences in exquisite detail. People go "Oh, really." and then carry on as they always have. Unfortunately, these people then go on to make websites for their friends, install servers for that charity down the road etc. and you end up with much worse problems.
Nobody cares anymore. Anyone serious will laugh at you if you're really that stupid to leave a server open to the world. The average joe doesn't know enough to see what you're laughing at and most people want things that work and sod the consequences. If that means running as admin with no firewall in order to save them having to learn about proper security permissions etc. then that's what happens - I know that every one of my users would make themselves admin given half the chance.
Hell, even my ISP blocks internet access to you if they see you have ports 137-139 open to the Internet and they take an awful lot of flak for it. They just redirect all your web traffic to a holding page that tells users how to fix the problem until they either a) fix it or b) tell the ISP to take it off. Guess which option is used the most?
Um... Not exactly. (Score:5, Insightful)
Let's read the article and see what that headline really means.
He found open ports on just over 200 servers, which correspond to the ports used by two popular database servers. That's all. The article doesn't say that he actually connected to them, confirmed that there were real databases running there, or even identified the owners. He found two hundred open ports out of a million randomly chosen addresses on the Internet. But "0.02% of Internet Connected Computers May Or May Not Be Running Database Software" just isn't the kind of headline that grabs attention.
Unless there is a lot more detail, preferably from someone who isn't in the business of selling firewalls for databases [ngssoftware.com], then you'll have to forgive me for not being terribly concerned about this revelation.