Today I found that all indices on our Test ES cluster was removed and one new index "warning" was created there. And I found following text from the raw index data: SEND 0.2 BTC TO THIS WALLET: 1DAsGY4Kt1a4LCTPMH5vm5PqX32eZmot4r IF YOU WANT RECOVER YOUR DATABASE! SEND TO THIS EMAIL YOUR SERVER IP …

No sensitive data on our test cluster. Anyway this post is to remind others to be careful on their ES security :slight_smile:

Yeah. Thanks for sharing this. That can help others for sure. Fortunately no one probably: uses elasticsearch as the single source of truth for the data (single datastore) exposes critical data directly on internet with no security with no backup Well... let's hope that is true...

[image] dadoonet: Well... let's hope that is true... You can check on public IoT search engines like https://www.shodan.io/ Last time I looked there were thousands of open Elasticsearch servers reported. People never learn.

For anyone interested, I wrote a blog post on how your clusters can and should be protected: http://code972.com/blog/2017/01/107-dont-be-ransacked-securing-your-elasticsearch-cluster-properly

just curious, anyone know how does they hack? use script in query DSL?

If the cluster is open to the internet and not secured in any way, you can simply read/modify/delete the data through the REST interface. No need for scripts of any kind.

Yup, and then probably port scanning or using tools like https://www.shodan.io

Our ES cluster is also hacked . All the indices were removed and a warning message is shown . please suggest some security measures . Thanks

Read https://www.elastic.co/blog/protecting-against-attacks-that-hold-your-data-for-ransom

Discuss the Elastic Stack

Ransom attack on Elasticsearch cluster?

Elastic Stack Elasticsearch

warkolm (Mark Walkom) January 12, 2017, 5:39am 4

You don't care about your data?

Topic		Replies	Views
ES security measures? Elasticsearch	4	421	November 27, 2014
Index keeps getting deleted and new index created called read-me-to-recover-data is created Elastic Security	5	914	August 2, 2023
Is it safe to expose Elasticsearch to the Internet? Elasticsearch elastic-stack-security	4	5591	August 30, 2020
Securing ElasticSearch Cluster Elasticsearch	2	986	September 22, 2014
Security of ES Elasticsearch	4	465	April 30, 2014

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Ransom attack on Elasticsearch cluster?

Related topics