# Ransom attack on Elasticsearch cluster? **URL:** \ **Category:** Elasticsearch\ **Created:** [January 12, 2017, 4:47am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310 "2017-01-12T04:47:27Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Youxu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youxu/32/117375_2.png) [@Youxu](https://discuss.elastic.co/u/Youxu)\ **Post date:** [January 12, 2017, 4:47am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/1 "2017-01-12T04:47:28Z")
Today I found that all indices on our Test ES cluster was removed and one new index "warning" was created there. And I found following text from the raw index data: SEND 0.2 BTC TO THIS WALLET: 1DAsGY4Kt1a4LCTPMH5vm5PqX32eZmot4r IF YOU WANT RECOVER YOUR DATABASE! SEND TO THIS EMAIL YOUR SERVER IP AFTER SENDING THE BITCOINS... It is a tipical ransom attack on MongoDB recently: [https://www.bleepingcomputer.com/news/security/number-of-hijacked-mongodb-databases-is-going-up-as-more-hackers-are-flocking-in/](https://www.bleepingcomputer.com/news/security/number-of-hijacked-mongodb-databases-is-going-up-as-more-hackers-are-flocking-in/) Anyone met same attack? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 12, 2017, 5:32am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/2 "2017-01-12T05:32:50Z")
I know our Security product is comemrcial, but why would you place any datastore on the public internet? Do you have backups? ---
**Author:** ![Youxu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youxu/32/117375_2.png) [@Youxu](https://discuss.elastic.co/u/Youxu)\ **Post date:** [January 12, 2017, 5:39am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/3 "2017-01-12T05:39:22Z")
It is a testing cluster for practicing and learning, so we simply allow internet access to endpoint. We will definitely consider security on PROD cluster. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 12, 2017, 5:39am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/4 "2017-01-12T05:39:46Z")
You don't care about your data? ---
**Author:** ![Youxu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youxu/32/117375_2.png) [@Youxu](https://discuss.elastic.co/u/Youxu)\ **Post date:** [January 12, 2017, 5:41am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/5 "2017-01-12T05:41:57Z")
No sensitive data on our test cluster. Anyway this post is to remind others to be careful on their ES security 🙂 ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 12, 2017, 6:12am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/6 "2017-01-12T06:12:41Z")
Yeah. Thanks for sharing this. That can help others for sure. Fortunately no one probably: - uses elasticsearch as the single source of truth for the data (single datastore) - exposes critical data directly on internet - with no security - with no backup Well... let's hope that is true... ---
**Author:** ![jprante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jprante/32/44941_2.png) [@jprante](https://discuss.elastic.co/u/jprante)\ **Post date:** [January 12, 2017, 10:14am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/7 "2017-01-12T10:14:54Z")
> [@dadoonet](#): > > Well... let's hope that is true... You can check on public IoT search engines like [https://www.shodan.io/](https://www.shodan.io/) Last time I looked there were thousands of open Elasticsearch servers reported. People never learn. ---
**Author:** ![Itamar\_Syn\_Hershko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/itamar_syn_hershko/32/725_2.png) [@Itamar\_Syn\_Hershko](https://discuss.elastic.co/u/Itamar_Syn_Hershko)\ **Post date:** [January 12, 2017, 10:42pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/8 "2017-01-12T22:42:07Z")
For anyone interested, I wrote a blog post on how your clusters can and should be protected: [http://code972.com/blog/2017/01/107-dont-be-ransacked-securing-your-elasticsearch-cluster-properly](http://code972.com/blog/2017/01/107-dont-be-ransacked-securing-your-elasticsearch-cluster-properly) ---
**Author:** ![Youxu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/youxu/32/117375_2.png) [@Youxu](https://discuss.elastic.co/u/Youxu)\ **Post date:** [January 13, 2017, 7:34am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/10 "2017-01-13T07:34:59Z")
just curious, anyone know how does they hack? use script in query DSL? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 13, 2017, 7:44am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/11 "2017-01-13T07:44:18Z")
If the cluster is open to the internet and not secured in any way, you can simply read/modify/delete the data through the REST interface. No need for scripts of any kind. ---
**Author:** ![Itamar\_Syn\_Hershko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/itamar_syn_hershko/32/725_2.png) [@Itamar\_Syn\_Hershko](https://discuss.elastic.co/u/Itamar_Syn_Hershko)\ **Post date:** [January 13, 2017, 8:57am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/12 "2017-01-13T08:57:18Z")
Yup, and then probably port scanning or using tools like [https://www.shodan.io](https://www.shodan.io) ---
**Author:** ![Bhavana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavana/32/12221_2.png) [@Bhavana](https://discuss.elastic.co/u/Bhavana)\ **Post date:** [January 13, 2017, 1:47pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/13 "2017-01-13T13:47:32Z")
Our ES cluster is also hacked . All the indices were removed and a warning message is shown . please suggest some security measures . Thanks ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 13, 2017, 2:27pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/14 "2017-01-13T14:27:06Z")
Read [https://www.elastic.co/blog/protecting-against-attacks-that-hold-your-data-for-ransom](https://www.elastic.co/blog/protecting-against-attacks-that-hold-your-data-for-ransom) ---
**Author:** ![askids](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/askids/32/22252_2.png) [@askids](https://discuss.elastic.co/u/askids)\ **Post date:** [January 13, 2017, 6:41pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/15 "2017-01-13T18:41:13Z")
It's a shame that Elastic thinks data security is optional and doesn't include security modules as part of the default bundle. I understand that as an commercial entity, they have to generate revenue and shield is one of them. But most free to use products do not consider security as such. Before anyone says, stop cribbing, it's a free product, blah, blah and pay for it already, I will shut up 🙂 ---
**Author:** ![LOSApevo](https://avatars.discourse-cdn.com/v4/letter/l/ee7513/32.png) [@LOSApevo](https://discuss.elastic.co/u/LOSApevo)\ **Post date:** [January 14, 2017, 8:26am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/16 "2017-01-14T08:26:28Z")
Shield is now replaced by X-Pack. But I cannot understand if it is free or I have to pay for it. Does anyone know something more about X-Pack? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 14, 2017, 8:40am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/17 "2017-01-14T08:40:41Z")
The Security part of X-Pack is a commercial offering. ---
**Author:** ![TheFish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thefish/32/116225_2.png) [@TheFish](https://discuss.elastic.co/u/TheFish)\ **Post date:** [January 14, 2017, 11:41am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/18 "2017-01-14T11:41:28Z")
Here's the problem: 1. User finds out ES doesn't do authentication out of the box. 2. User googles ES auth, finds X-Pack 3. User installs X-Pack, auth starts to work. 4. Trial license expires, user gets a free basic license 5. Warning states that "some features" are subject to payment and not included in the basic license. 6. ES is public again. I appreciate that you guys put in an acknowledge mechanism so users have to ack that some features are not included in the basic license. I do not appreciate that you do not mention clearly in your documentation that this pertains ALL AUTHENTICATION. Here's what the documentation states: [https://www.elastic.co/guide/en/x-pack/current/license-expiration.html](https://www.elastic.co/guide/en/x-pack/current/license-expiration.html) ```auto # License [will expire] on [Friday, December 30, 2016]. If you have a new license, please update it. # Otherwise, please reach out to your support contact. # # Commercial plugins operate with reduced functionality on license expiration: # - security # -- Cluster health, cluster stats and indices stats operations are blocked # -- All data operations (read and write) continue to work # - watcher # -- PUT / GET watch APIs are disabled, DELETE watch API continues to work # -- Watches execute and write to the history # -- The actions of the watches don't execute # - monitoring # -- The agent will stop collecting cluster and indices metrics # -- The agent will stop automatically cleaning indices older than [xpack.monitoring.history.duration] # - graph # -- Graph explore APIs are disabled ``` Notice the indentation underneath "- security"? (I added two dashes because the post formatter eats the extra space) This indentation means "security" is listed as a category of items to be listed underneath. The two items ("Cluster health, cluster stats and indices stats operations are blocked", "All data operations (read and write) continue to work") do NOT adequately transport the message that this main feature of X-Pack is actually not working anymore. Here's how you fix this: Either a) Put up a big notice that makes it absolutely clear that authentication is not included in the free basic license, or b) Consider adding auth to the free license tier. It is not something you can reasonably expect to charge money for. It is easily achieved via other means, so why not aim for robustness instead and offer everyone the benefits of a basic functionality like this. You may think it's a smart business idea, but to people outside your company it just looks like a cash grab. We've been hit by this as well, but our data was easily reindexed. However, this just makes ES look immature. This would be an awesome time to turn this into a PR advantage, and react by adding auth support to either the free x-pack license, or even just include it in the main program. ---
**Author:** ![danielgc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielgc/32/13501_2.png) [@danielgc](https://discuss.elastic.co/u/danielgc)\ **Post date:** [January 17, 2017, 6:56am UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/19 "2017-01-17T06:56:31Z")
My client has been hacked too, I'm reading your guide, thx Itamar! ---
**Author:** ![djmcgreal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djmcgreal/32/52956_2.png) [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\ **Post date:** [January 18, 2017, 12:21pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/20 "2017-01-18T12:21:09Z")
- Reverse proxy to ES and do authentication there. - Setup firewall rules to only allow traffic from trusted IP addresses. - Tunnel via SSH - ...? I don't see how anyone could miss that ES doesn't authenticate requests by itself. If you've put an ES endpoint on the public internet you only have yourself to blame when someone else accesses it. I'm suspicious of your conclusion that licence expiry disables all authentication. It certainly doesn't seem to here, but I'm a little outdated in versions. ---
**Author:** ![TheFish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thefish/32/116225_2.png) [@TheFish](https://discuss.elastic.co/u/TheFish)\ **Post date:** [January 18, 2017, 4:34pm UTC](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/21 "2017-01-18T16:34:34Z")
dmjcgreal: Indeed, anyone putting up an ES instance without authentication on a public IP has to face the risk of someone else deleting stuff from it. But do go ahead and try the latest version, install X-Pack (auth will work then), then install a basic license. You will have to acknowledge but it is easy to miss. Thankfully, several solutions exist: There's an open source plugin for authentication which does not cost money, and you can also use nginx or haproxy to add basic auth to an ES instance. In general it's safest to not expose ES at all if you can help it. And again, while there is a page buried somewhere that lists authentication as a paid feature, I would be helpful to include this information in the documentation as well - because that's the page you get if you google ES auth. [Next page](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310.md?page=2)