Half a Million Database Servers 'Have no Firewall' 322
An anonymous reader writes "There are nearly half a million database servers exposed on the Internet, without firewall protection according to UK-based security researcher David Litchfield."
Have i missed something? (Score:3, Informative)
Re: (Score:2)
Re:Have i missed something? (Score:5, Informative)
That's not true.
For example, you may have a stand-alone java app at multiple locations that can query the database directly, so you'd definitely open up the port.
This is just another example of "OMFG LOOK AT ME!!! I FOUND TEH SECURITY HOLE!" bullshit. Same as "your computer is broadcasting its IP address."
Not everything has to go through a bloody web server.
Their "idea" of a vulnerability was if the port was open - not if they could gain access.
Web Services? (Score:5, Informative)
Re:Web Services? (Score:5, Insightful)
The same argument could be made about ANY service/port, including http, ftp, etc. The premise of the article - that "port open == bad all by itself" - is junk.
And as we have repeatedly seen, accessing your db through a web server gives 2 different attack vectors - flaws in the web server, and flaws in the middleware.
Nothing except an unplugged box with the hard drive removed will ever be 100% secure.
Good Point, but... (Score:5, Insightful)
Re: (Score:3, Funny)
Ahem...I think we were talking about real databases here.....
I say its FUD because (Score:5, Insightful)
Re:Web Services? (Score:4, Interesting)
The same argument could be made about ANY service/port, including http, ftp, etc. The premise of the article - that "port open == bad all by itself" - is junk.
If you don't take any precaution with your data, you're going to lose, no matter how many layers -- but somehow I can't find myself agreeing that giving the raw DB socket and passing all necessary authentication info to the world at large within the applet I'm sending out is a good way either. (of course, you can try and lock down the DB user so that the user within the DB can't do much damage, but you're still opening a hole through which you might also try and hack for other DB accounts with more permissions).
Re: (Score:2)
Your protest that this just moves the attack vector is a bit of a red herring, IMO. If you have a web app
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
If you're talking more about a consumer app that talks to a database, that should be routed through ssl, etc, and well authenticated.
I do agree, however, most databases can be "exposed" without too much risk, and that risk is justifiable for certain types of applications. Lock down your high-access user accounts to local-only access, and allow authenticated connections. There is always
Re: (Score:2)
Re: (Score:3, Insightful)
Re:Have i missed something? (Score:5, Informative)
I have mentioned this several times on slashdot but there is a severe lack of actual professionals in control of networks out there. I would say that there are all too many who have never even thought about security at this level, they just make sure that they have control of their users and pat themselves on their back for being able to make two servers talk across a WAN.
This all derives from the misconception that you have to be 40+ to be a seasoned professional in the business world. The IT security field is a very new one relatively, some of the best security personnel are much younger than I am but never get considered because even with 5 years experience, a degree and several certifications, they are only 24 and therefore not worthy of note. (no I am not ranting about myself, I ahve a wonderful position for someone my age, but I know many IT geeks who get passed over because of their age, although no one would ever admit it.) Get the 40 year old guy who was a sociology major and did data entry for 10 years before being asked to take over NT environments. This way you get a 'seasoned' guy because he has a few more wrinkles and that makes him a better 'fit' and definitely must make him more capable.
Re: (Score:2)
Well, don't forget the story this weekend about the guy who was a 26-year-old IT professional working for an IT security company who pled guilty to using a botnet of 250,000 PCs - customer machines - to do numerous frauds.
Ethics has nothing to do with age.
My point was that the basic premise of the article - that the presence of the open port in and of itself was a sufficient metric to be able to say "OMG INSECURE" - is not valid in and of itself.
One good example - we have an app that sits on port 80.
Re: (Score:3, Interesting)
Funny thing is, where I'm working, the bias is against older people. "We tried a half-dozen, and they all had issues." Since then, we've gone through I don't know how many people in the 20-to-40 age bracket, but I'm still here :-)
In the last year, the bias has shifted back to the over-50 group in larger businesses, because, IF they've been in the field for a couple of decades, they're worth it, and generally don't have the "need" to get into "pissing contests" about who knows what - they've had a couple
Re:Have i missed something? (Score:5, Funny)
Re: (Score:2)
For example, you may have a stand-alone java app at multiple locations that can query the database directly, so you'd definitely open up the port.
No, at the very least I would use IP-based rules to restrict access to all but the hosts running the java app. It's a technique known as defense in depth [wikipedia.org]. You never rely on a single point of failure, such as the authentication system of your database server, to protect yourself.
Exploits (Score:2)
That said, I agree with everyone who says that you should also se
Re: (Score:2)
Re: (Score:3, Informative)
The more logical (and secure) solution would be
{internet}
|
app-servers
| (internal network)
db-servers
You missed something too (Score:2, Informative)
the proper setup looks like this
{internet}
|
firewall
|
app-servers
|
db-servers
Re:You missed something too (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
There is (to my knowledge) a requirement that each discrete firewall set be hosted on a different piece of equipment.
Re: (Score:2)
My mistake (should have previewed)
Re:You missed something too (Score:5, Funny)
You are not a lawyer, you are a hairball?
(sorry, couldn't resist)
Re: (Score:3, Insightful)
Nope nope nopity nope.
The issue is not with a secure (or otherwise) port being exposed to the internet, the real security issue is the question of where has business logic just been moved?
REGARDLESS of whether the database server listenes on port 35530, has super duper extra strength nine fafillion bit crypto (now with more caffiene!!! (tm) ) and only accepts co
Chicago (Score:5, Funny)
what? (Score:2, Funny)
Re:what? (Score:5, Insightful)
If you secure your server correctly in the first place.
Close up, secure and encrypt ports that consume passwords and serve data.
You don't have a problem! Within reason of course.
I that gets breached, a firewall won't protect you from an attack either.
Du...
I wonder how many people know that firewalls don't actually do anything.
Accept keep useless network fanboys employed.
Re:what? (Score:5, Insightful)
Firewalls are good for:
- Helping to limit access to services which don't have built in access limits (think tcp-wrappers++)
- Helping to protect a pile of machines over which you have little to no control (a bunch of desktops in the office, for example).
When talking about servers, if you sufficiently harden your machine, a firewall does very little, especially if the service being compromised is one which the firewall allows pretty much anyone access to...
Re:what? (Score:5, Interesting)
Now, sure, you can say "It's open source, it's got all kinds of people looking at it, of course it is secure." But face it: people make mistakes, and the more subtle the screwup, the more people it will take to find it. Eventually there will be a screwup too subtle for all the people looking to find. Then you have potential setup errors, something was missing in the documentation or overlooked by the individual doing the install/test, etc. You now have a vulnerability. Yes, none of these mistakes *should* exist, and having a firewall *shouldn't* be used as the *primary* method of protecting your system, but extra defense is good. The more software you run, the wider the variety of operating systems you run, the more likely one of these errors is to happen. A firewall is cheap (usually), and it happens to block this kind of attack.
Yes, relying on a firewall as your only means of defense is stupid, and there is a lot it doesn't protect, but a door lock doesn't defend against all means of entrance - it doesn't mean you shouldn't lock your doors. A firewall *is* a nice backup to have in case of human error in the programming or setup of an application.
Re: (Score:2)
Now, if you're talking something like "allow from 192.168.0.0/24" having a hole in it, you're right. Such a rule implemented at the service level + at the firewall level does help protect against a bug in either, giving you an element of
Re: (Score:2)
Router ACLs can protect you against OS bugs and rouge applications opening up ports you don't expect. While routers are not bug free, they are simpler and more hardened than a firewall appliance.
But firewalls are part of that hardening. (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2, Interesting)
Your post read as the extreme of "firewalls are useless and you shouldn't bother with them", which is just as bad as "firewalls are the [last|best]+ line of defense". Both tend to ignore various types of problem.
From most to least effective:
1) Educate your users
2) Harden your systems + have regular updates
3) Firewall
Depending on the situation, 1 and 2 may flip.
Re: (Score:3, Insightful)
To be human is to err, and every Application/OS I've seen is programmed by humans. An extra layer of security doesn't hurt, especially against the bugs we don't know about yet - most bugs/security flaws weren't know about/understood prior to being fixed, and prior to fixing, they could have been exposed.
Also, consider that you might have a server with several ports open, some which by nature must be intranet only, others which must be in
Not Suprising (Score:5, Informative)
This isn't so suprising:
The world at large is uninterested and/or unaware of security when it comes to computers.
Re:Not Suprising (Score:5, Insightful)
I've seen a number of things cobbled together just to get a department or company through something that suddenly become available to a lot more people than the original target audience. It's a good argument for never taking short cuts when you're programming, but I'm sure there are a lot of people that have gotten something out on a deadline only to turn around and look at it later and say "What came over me to do it that way?"
Re: (Score:2)
Re:Not Suprising (Score:5, Funny)
If you can't correct it, you needn't detect it.
Re: (Score:2)
And what exactly are you supposed to do when printf() returns false? Display an error message?
If you can't correct it, you needn't detect it.
Well, to answer another poster - yes I was being insufficiently precise when I used the term system call. printf() is a C library call.
To answer the quote above: in C and C++ printf() [including fprintf() and sprintf()] returns an int, representing the number of characters formatted and written out - and not including any null byte appended as a string terminator.
In C, an error message and potentially an exit was in order.
In C++, in an exceptional situation then an exception may be appropriate to
Re: (Score:2, Insightful)
Not necessarily rubbish if it is justifiable. In state machine construction, there are two choices to make for invalid events: ignore or can't happen. Can't happen events should be handled as exceptions, but ignore events can be ignored. There are cases where it is perfectly valid to ignore the return event of a printf.
Managers/companies who can't be flexible where log
Re: (Score:2)
This may be true, but failure to printf() is not an invalid event. It's an entirely possible outcome of calling printf(), one that is documented in the manual page. You need to design your state machine so that there is an appropriate state and transitions for the 'output failed' case.
Failure to write a file is not something that 'cannot happen'. And usually, it is not something you want to 'ignore'.
Re:Not Suprising (Score:5, Funny)
Insufficiently precise? Holy weasel words batman. You were wrong.
Re: (Score:3, Insightful)
To answer the quote above: in C and C++ printf() [including fprintf() and sprintf()] returns an int, representing the number of characters formatted and written out - and not including any null byte appended as a string terminator.
So, it's an error when printf() doesn't output the expected number of bytes. Check.
Ummm, how do you determine exactly how many bytes it should have written so that you can compare the values? I can't really think of any way you could correctly do that in a locale-sensitive manner without re-implementing printf() in the first place, at which point the whole think is moot and you're fired for dicking around too much on the job.
Re: (Score:3, Insightful)
For 'almost impossible' conditions, dying immediately with an error message is maybe not ideal, but still a hundred times better than silently ignoring the error and reporting success.
Re:Not Suprising (Score:5, Insightful)
I've worked and volunteered for several non-profit, NGOs and small businesses. And worked in B2B sales selling computer equipment to them. Generally the IT staff is an outside consultant who does a few things (whatever they're able to afford). Setting up of complex computer equipment and software is often left to someone who's able to understand the instruction manual but no IT training (so it could be the receptionist, the director or somewhere in-between). Setting up a firewall is expensive and doesn't fit into many budgets of small organizations. Someone with no IT training may also think a DB server or networked printer needs no firewall.
Let me put it this way: as a non-IT worker, I haven't put 100% of my resources behind studying I.T. (software, hardware) etc. I've programmed computers and used computers since I was born. Despite being somewhat knowledgeable in TCP/IP and reading firewall and comp. security books (mostly for self-interest), I'm not confident I can even configure an adequate firewall for my home computer. Things like FreeBSD's IPFW are supposed to be "easy" to setup. Not my experience. Its sheer confusion. MS, Apple and some OSS firewalls are supposed to make it even easier. Block this port, block that port and that's it??? don't think so. I'm not even 50% confident this solution provides adequate protection esp for a NGO, non-profit, SMB or home computer. So how is someone not as well-read supposed to setup a firewall on a limited budget? But a pre-built hardware solution? Still that needs to be setup and configured too. And even then, you still have to be knowledgeable enough to *test* whatever solution you're using to actually make sure it works and keeps your system well protected.
Not a trivial or inexpensive task. But people with no training or knowledge are often asked to do this.
Re: (Score:2)
Indeed not. What you do is to first block everything, then unblock only what's needed.
This is really not all that hard to setup. It runs a web server? Ok, open port 80. It needs to run SSH? Open port 22, if possible restricted to the ip addresses the admin uses (this can backfire if the admin needs to administrate using a PDA in the middle of nowhere though)
Firewalling is really quite easy on that level. Now if you want to do things manually with iptables the
Re: (Score:2)
True that people with no training or experience are asked to do this task, but i mean, honestly it is not such a great problem. Most things are working ok.
Re: (Score:3, Insightful)
The world at large is uninterested and/or unaware of security when it comes to computers.
I would lean towards the 'unaware' part of your statement. I have no numbers to back up my opinion, but I am thinking that the vast majority of computer users don't have a clue about what they are using. Most know just enough to be dangerous to themselves and their PC. I see this at work where a user has been using a PC for the last 10 years, but still effectively knows nothing about it. To them, it is just a tool.
I believe that wide spread knowledge of security and privacy practices won't come into
Re: (Score:2)
So what? Do you really think the number of characters written is important, interesting, or vital to security in some way? More importantly, what will you do if you find that not all characters were written? Or that too many were written, and your buffer has overflown (this means the catastrophe has already happened, so chances of actually detecting that condition are slim).
Re: (Score:2)
So you are saying that the reason many databases are unprotected is because many systems are unprotected? That's some stellar reasoning there, Captain Obvious!
No. That's not what I'm saying. If that had been what I was saying then your titling me as Captain Obvious would not have been as silly as it was.
I was pointing out something that about 2 people understood by their posts: Most "experts" aren't.
I've written most types of software at one time or another, and for the most part people are only interested in how to do "the job" well enough to get paid and then go on to the next hack.
And yet, what they should be doing is learning h
Exception throwing! (Score:2)
Most C programmers don't bother to check the return of system calls like printf()
Most things shouldn't be written in C.
Don't know if printf() was the best example, but this is really the reason you want a language that throws exceptions when things go wrong. That either forces programmers to write error handling code (if the compiler requires you to catch a certain exception), or gives the runtime a chance to present a stack trace when an exception is thrown.
Instant maintainability improvement.
Re: (Score:2)
Don't know if printf() was the best example, but this is really the reason you want a language that throws exceptions when things go wrong. That either forces programmers to write error handling code (if the compiler requires you to catch a certain exception), or gives the runtime a chance to present a stack trace when an exception is thrown.
C++ exceptions don't carry a stack trace with them - Java does.
In C++, we'd cover the code with unit tests and use exceptions to illustrate (via the unit tests) which sorts of uses would break the code. Using that feedback, we make the code bulletproof.
To be more precise - somewhere between the external interfaces and the core code there should be a line across which once you cross, all inputs are trusted. On the "outside" we can't trust the data, but we can once inside that line. Obvious
Re: (Score:2)
Maybe a more sensible think to do is to check the amount of free disk space and give a warning.
Re: (Score:2)
Only SQL server and Oracle? (Score:4, Interesting)
Questions (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
It kills me the number of decisions that are made at the business level by simply watching commercials or reading articles. If I have another business person ask me if they should have "SAP", I think I am going
What difference does it make? (Score:2)
But furthermore, how many of those development servers contain slightly-stale copies of "real" production data?
Yawn (Score:5, Insightful)
1. Because everyone knows that a firewall is the end all and be all of security.
2. How do they know they don't have a firewall and not just an open port?
3. Open port != DB server
5. Maybe some of them actually need/want to have remote people access them (and they don't know about VPNs(lolz))
6. Yeah some people should get their shit together
Did Mr. Litchfield crash his BMW and wants a new one? This just smacks of "ZOMG!!! Ur ports are open, give me ur monies and I will fix u!" His company is even linked in the fourth paragraph. Next please.
Re: (Score:2)
nmap can tell you that kind of stuff, you know. Anyway, most of those servers are probably already compromised too. I've recently seen one try to spam a phpBB board (it ran sql server, IIS and some kind of ldap thing).
Re: (Score:3, Interesting)
I still think he's just trying to grab attention to drum up business.
I'm not going to disagree with you on that. That's pretty much what most security researchers do ;-). There are probably non-fearmongering security researchers, but they don't get headlines...
Anyway, not having a firewall doesn't make you unsafe automatically (as long as you have strong passwords, and everything is patched, and something like fail2ban is stopping bruteforce attempts, and you actually know what you're doing), but it wouldn't surprise me if a lot of them were set up by clueless admins.
Re: (Score:2)
2. Ok, if they *do* have a firewall, then the implication is that the firewall admins are incompetent. Better? I find it difficult to believe that that many databases *need* to be exposed to the random Internet.
3. Open port != DB Server, agreed. But if you connect to the p
Half a million? (Score:2)
Corporate Data? (Score:4, Insightful)
Also, the sample of 1 million is very small to be drawing these conclusions.
In short, "Nothing to see here - move along."
Declaration of interest (Score:5, Insightful)
Re: (Score:2)
If this had been an academic study or with no vested interest, it might have had credibility, instead it just comes over as FUD. Ignore.
Oracle's listener on port 1521 (Score:5, Insightful)
I wish he had known what he was writing about before he actually wrote the damn article.
Re: (Score:2, Informative)
So? (Score:2, Insightful)
And the default combination of "root" and no password isn't as insecure as you think, because you still need to originate queries on the machine itself. You would have to get a web hosting account on the server (or find some idiot who wasn't chmod-ing uploaded files non-executable) in order to muck about. Or rather, giving each hosting customer their own database username and password and only GRANTing them permissions on their own data
Re: (Score:2)
Rather than using built-in modules in the httpd daemon it can launch the interpreter for the respective scripts as the user in question
I can see how this would work (Score:2)
And ... (Score:2, Insightful)
Accountability is lacking (Score:3, Insightful)
No it isn't. Now, if there were some penalty to losing half a million identities that was borne by the database owner instead of the poor schmucks whose identities were stolen, then it would be amazing.
But when your data is stolen, I'm the one who has to pay. Why should you care? You're not paying.
Well... (Score:5, Interesting)
Since my home is on cable, there isn't any static IP address to put in the server's iptables rules, and so I need to leave the mysql port on the server open. For security I use MySQL grant tables to specify that from outside only the restricted 'replication' user can have password access. Even if someone managed to guess the password for that user, the grants say that all they can do is replicate (and then they'd have issues because they wouldn't have any initial copy of the database). Since I don't store passwords in the db at all, it's fairly secure. Sure, it's not bulletproof, but as long as you're aware of the issues and take reasonable steps, it's very possible to have a database server intentionally open to the internet.
Even better, run the replication over ssl, then nobody can sniff anything from the stream. I haven't done that yet (until recently I was running an older version that didn't support ssl) but it is on my to-do list.
Another small thing you can do is to change the port that MySQL is listening on, but haven't bothered to go that far yet - the existing security seems to have been pretty solid.
Re: (Score:3, Informative)
Might I introduce you to SSH (Score:5, Informative)
A webserver needs at most three ports open, 80, for obvious reasons, 443 for https and 22 for ssh. That is it.
If you need to connect remotely to another service you do it via SSH.
Mysql is a database. Let it do databases. Let SSH do its job.
When I see people use your logic you make my jaw drop. SSH for live. EVERYTHING over ssh. ALWAYS. Full stop, end of story. No argument.
Exposing your database like this is insanity and you are asking for trouble. Mysql authentication is a joke and considering you are doing it this way, you probably have it setup wrong. Because what you are doing is wrong.
Tunnel over SSH. It is a most basic tool. Read up on it, NOW! Google: mysql tunnel ssh
Offcourse, next thing he will say is that he uses telnet for remote access, some admins would make ghandi loose his temper
Re:Might I introduce you to SSH (Score:4, Interesting)
Here's a clue: You don't convince people by shouting at them, telling them they are completely, utterly, totally wrong (especially when the world really isn't as black and white as you are suggesting). I'm guessing you might the the type of person who would also try to tell me I'm completely, utterly wrong for using MySQL at all. I've long given up trying to reason with zealots.
In point of fact, your post is a good example of why I don't post all that much on slashdot or reddit any more. It seems that many people who "debate" online have given up on civilized discussion and instead jump straight to the kind of cut-throat, over-the-top, spittle-flying shouting match that typifies television "news" these days.
See, we could be talking about the technical merits of your argument, but instead you got me going on how you come across like a total dick.
Could the job be done using ssh tunneling? Probably, undoubtedly so. Does my setup work just fine for what it's doing? Absolutely, for the last eight years in fact. For me, the MySQL security model works just fine. As I said, I'll be using the SSL feature anyway as soon as I can get around to rebuilding MySQL with SSL enabled.
And incidentally, it's "lose", not "loose".
Bye now.
Disable mysql external access with skip-networking (Score:3, Interesting)
Disable mysql external access by adding this line to /etc/my.cnf :
skip-networking
This will prevent external access to MySQL, firewall or no firewall. All access will go through Unix sockets or named pipes. Restart mysql with /etc/init.d/mysql restart For me, no other configuration was required for several mysql-consuming apps, including php custom scripts, phpbb, phorum, and sympoll.
Doesn't surprise me (Score:4, Interesting)
Third, you have things like Windows Firewall where for some things it's just easier to run without the firewall than with it (not that I'd do it, but I've seen it happen). Even something simple like OpenVPN over Windows Firewall in udp mode (the only decent performing mode in OpenVPN) is next-to-impossible to get running properly - the time you take to make it work is better spent installing a real firewall that can do the job (even ZA "just handles it"). A lot of servers are open but "hide behind" an external or hardware firewall on which necessary ports are then just opened. I remember trying to get my last workplace to install at least Windows firewall on clients and servers alike - the exceptions were already in place, the systems worked perfectly with it turned on, but they still wouldn't do it. Fortunately, they were behind an external firewall not configured by them - however a single virus could run rampant across the client PC's in a matter of minutes.
Fourth, most people have no idea what packets their networks send out to the world, or what ports are open - and they don't care until the day they notice that someone is accessing their system, which can be years after it was first compromised.
It's quite simple. If you can see it from outside your network, so can anyone in the world. If they can see it, they can attack it (and even sometimes if they CAN'T see it but know it's likely to be there!). If they can attack it and you don't update it, you could be in serious trouble. And even if you are firewalled off to the maximum, have up-to-date patches and proper security procedures attackers can still sometimes get through, but making their life as difficult as possible is not only fun but also productive.
Some people just don't care though. It's not going to change any time soon. Viruses and attacks are so common you hear things like "yeah, my laptop had a virus on it but I can't afford the subscription so I didn't bother clearing it up - made my computer a bit slow, though". Most people are just far too casual. You can even over-do the dramatics and explain possible dire consequences in exquisite detail. People go "Oh, really." and then carry on as they always have. Unfortunately, these people then go on to make websites for their friends, install servers for that charity down the road etc. and you end up with much worse problems.
Nobody cares anymore. Anyone serious will laugh at you if you're really that stupid to leave a server open to the world. The average joe doesn't know enough to see what you're laughing at and most people want things that work and sod the consequences. If that means running as admin with no firewall in order to save them having to learn about proper security permissions etc. then that's what happens - I know that every one of my users would make themselves admin given half the chance.
Hell, even my ISP blocks internet access to you if they see you have ports 137-139 open to the Internet and they take an awful lot of flak for it. They just redirect all your web traffic to a holding page that tells users how to fix the problem until they either a) fix it or b) tell the ISP to take it off. Guess which option is used the most?
what about MSDE? (Score:2)
pretty sure most of these are just the lite versions of these databases on people's desktops or laptops while they are on broadband. a lot of devs also have dev versions of db servers. SQL 2005 Dev edition is basically the enterprise edition that lets you install it on XP and no limits other
Clueless researcher? (Score:2)
And this is always a problem? (Score:2, Interesting)
How many of those are small, MySQL driven LAMP-3 setups -- you know, the kind that power millions of websites? Where a decent amount of care setting up Linux, Apache, MySQL, and the final P [whether that is Perl, Php or Python -- the three in the acronym above] good coding practices make the necessity of a separate firewall basically moot.
Oracle is partly to blame (Score:2)
Oracle is mostly to blame with their idiotic processes that n
Re: (Score:2)
IP Addresses (Score:2)
The IP addresses in the experiment were randomly created.
This means that their test could have hit some old woman's PC who happened to be dialled up over her phone line at the time, and using the IP address assigned to her by her ISP.
If she doesn't have a firewall, then of course the Oracle port could be open. Is this a security risk? Well if she only uses her computer for email then no.
Was an Oracle DB with customer's credit card details exposed to the world? Absolutely not!
Links please... (Score:2)
Links please. thx
Um... Not exactly. (Score:5, Insightful)
Let's read the article and see what that headline really means.
He found open ports on just over 200 servers, which correspond to the ports used by two popular database servers. That's all. The article doesn't say that he actually connected to them, confirmed that there were real databases running there, or even identified the owners. He found two hundred open ports out of a million randomly chosen addresses on the Internet. But "0.02% of Internet Connected Computers May Or May Not Be Running Database Software" just isn't the kind of headline that grabs attention.
Unless there is a lot more detail, preferably from someone who isn't in the business of selling firewalls for databases [ngssoftware.com], then you'll have to forgive me for not being terribly concerned about this revelation.
So what? (Score:2)
Hopefully the DBMS supports SSL or other encrypted connections so outsiders can't eavesdrop or hijack sessions.
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)