{"id":865,"date":"2018-03-25T15:06:40","date_gmt":"2018-03-25T19:06:40","guid":{"rendered":"https:\/\/www.baronsoftware.com\/Blog\/?p=865"},"modified":"2018-03-25T15:06:40","modified_gmt":"2018-03-25T19:06:40","slug":"thousands-of-servers-found-leaking-750mb-worth-of-passwords-and-keys","status":"publish","type":"post","link":"https:\/\/www.baronsoftware.com\/Blog\/thousands-of-servers-found-leaking-750mb-worth-of-passwords-and-keys\/","title":{"rendered":"Vast amount of Servers are leaking huge amounts of passwords and keys"},"content":{"rendered":"

\"\"<\/p>\n

Vast amount of Servers are leaking huge amounts of passwords and keys<\/h3>\n

Thousands of servers operated by businesses and other organizations are openly sharing credentials that may allow anyone on the Internet to log in and read or modify potentially sensitive data stored online.<\/p>\n

In a\u00a0blog post published late last week<\/a>, researcher Giovanni Collazo said a quick query on the Shodan search engine returned almost 2,300 Internet-exposed servers running\u00a0etcd<\/a>, a type of database that computing clusters and other types of networks use to store and distribute passwords and configuration settings needed by various servers and applications. etcd comes with a programming interface that responds to simple queries that by default return administrative login credentials without first requiring authentication. The passwords, encryption keys, and other forms of credentials are used to access MySQL and PostgreSQL databases, content management systems, and other types of production servers.<\/p>\n

Collazo said he wrote a simple script that ran through the 2,284 etcd servers found in his Shodan search. Using the query\u00a0GET http:\/\/:2379\/v2\/keys\/?recursive=true<\/code>, the script was designed to return all credentials stored on the servers in a format that would be easy for hackers to use. Collazo stopped the script after it collected about 750 megabytes of data from almost 1,500 of the servers. The haul included:<\/p>\n