NoSQL Means No Security?

A presentation at I T.A.K.E. Unconference in June 2018 in Bucharest, Romania by Philipp Krenn

Slide 1

Slide 1

NoSQL MEANS No SECURITY? Philipp Kre ! 444 @xer "

Slide 2

Slide 2

DEVELOPER !

Slide 3

Slide 3

https://db-engines.com/en/ranking

Slide 4

Slide 4

Slide 5

Slide 5

Slide 6

Slide 6

Slide 7

Slide 7

Slide 8

Slide 8

Slide 9

Slide 9

Slide 10

Slide 10

Injections

Slide 11

Slide 11

JavaScript Injection HTTP://WWW.KALZUMEUS.COM/2010/09/22/SECURITY-LESSONS-LEARNED-FROM-THE-DIASPORA-LAUNCH/ def self.search (query) Person.all( '$where' => "function() { return this.diaspora_handle.match(/^#{query}/i) || this.profile.first_name.match(/^#{query}/i) || this.profile.last_name.match(/^#{query}/i); }" ) end

Slide 12

Slide 12

Problem JS Evaluation $where db.eval() db.runCommand( { mapReduce : db.collection.group()

Slide 13

Slide 13

Solution JS Evaluation --noscripting OR security.javascriptEnabled: false

Slide 14

Slide 14

S ! rbrücker Cybersicherheits-Studenten entdecken bis zu 40.000 ungesicherte Datenbanken im Internet — http://www.uni-saarland.de/nc/aktuelles/artikel/nr/12173.html , Feb 2015

Slide 15

Slide 15

Ma ! ive ransomware a " ack takes out 27,000 MongoDB servers — http://www.techrepublic.com/article/massive-ransomware-attack- takes-out-27000-mongodb-servers/ , Jan 2017

Slide 16

Slide 16

Bound to a ! interfaces by default?

Slide 17

Slide 17

Slide 18

Slide 18

Authentication enabled by default?

Slide 19

Slide 19

Authentication & Authorization

Slide 20

Slide 20

Enable auth=true

Slide 21

Slide 21

<3.0 MONGODB CHALLENGE RESPONSE ( MONGODB-CR )

Slide 22

Slide 22

=3.0 IETF RFC 5802 ( SCRAM-SHA-1 ) =4.0

SCRAM-SHA-256

Slide 23

Slide 23

SCRAM-SHA-1 CONFIGURABLE iterationCount SALT PER USER INSTEAD OF SERVER SHA-1 INSTEAD OF MD5 SERVER AUTHENTICATES AGAINST THE CLIENT AS WELL

Slide 24

Slide 24

Predefined Roles read / readAnyDatabase readWrite / readWriteAnyDatabase dbAdmin / dbAdminAnyDatabase userAdmin / userAdminAnyDatabase dbOwner BACKUP, RESTORE, CLUSTER MANAGEMENT,...

Slide 25

Slide 25

Slide 26

Slide 26

$ mongod --noauth --port 27017 --dbpath test/ --logpath testlog $ mongo localhost/admin

db.createUser({

user : "philipp" ,

pwd : "password" ,

roles : [ {

role : "root" ,

db : "admin" } ] })

db.system.users.find() exit

Slide 27

Slide 27

$ mongod --auth --port 27017 --dbpath test/ --logpath testlog $ mongo localhost/admin

show dbs exit

Slide 28

Slide 28

$ mongo localhost/admin -u philipp -p --authenticationDatabase admin

show dbs db.createUser({

user : "alice" ,

pwd : "password" ,

roles : [ { role : "read" , db : "testA" }, { role : "readWrite" , db : "testB" } ] })

db.system.users.find() exit

Slide 29

Slide 29

$ mongo localhost/testA -u alice -p --authenticationDatabase admin

db.test.insert({ foo : "bar" }) db.test.find() use testB db.test.insert({ foo : "bar" }) db.test.find() use testC db.test.find() exit

Slide 30

Slide 30

=3.0 SSL INCLUDED (ALMOST) EVERYWHERE

Slide 31

Slide 31

Slide 32

Slide 32

Research shows 75% of ‘open’ Redis servers infected — https://www.incapsula.com/blog/report-75-of-open-redis-servers- are-infected.html , May 2018

Slide 33

Slide 33

Let’s crack Redis for fun and no profit at a ! given I’m the developer of this thing — http://antirez.com/news/96 , Nov 2015

Slide 34

Slide 34

Bound to a ! interfaces by default?

Slide 35

Slide 35

Protected Mode

Slide 36

Slide 36

=3.2.0 ANSWER LOCAL QUERIES RESPOND WITH AN ERROR FOR REMOTE

Slide 37

Slide 37

Authentication & Authorization

Slide 38

Slide 38

a tiny layer of authentication — http://redis.io/topics/security

Slide 39

Slide 39

AUTH <password> COMMAND PLAIN-TEXT PASSWORD IN REDIS.CONF NO (BUILT-IN) SSL OR RATE LIMITS

Slide 40

Slide 40

Hiding Co ! ands

Slide 41

Slide 41

SET IN REDIS.CONF RESET AFTER RESTART

Slide 42

Slide 42

rename-command CONFIG mysecretconfigname

Slide 43

Slide 43

rename-command CONFIG ""

Slide 44

Slide 44

PS: Don't Pa ! in Random Lua Scripts

Slide 45

Slide 45

Redis EVAL co ! and a " ows execution of Lua scripts, and such feature should be a " owed by default since is a fundamental Redis feature. — http://antirez.com/news/118 , Jun 2018

Slide 46

Slide 46

Future

Slide 47

Slide 47

REDIS 6 ACL & TLS HTTP://ANTIREZ.COM/NEWS/118 , JUN 2018

Slide 48

Slide 48

Slide 49

Slide 49

Bound to a ! interfaces by default?

Slide 50

Slide 50

Broadcasting on the local subnet?

Slide 51

Slide 51

Ru ! ing as r " t?

Slide 52

Slide 52

Scripting

Slide 53

Slide 53

ELASTICSEARCH HTTPS://WWW.ELASTIC.CO/COMMUNITY/SECURITY CVE-2014-3120 (6.8): Dynamic scripting CVE-2014-6439 (4.3): CORS misconfiguration CVE-2015-1427 (6.8): Groovy sandbox escape CVE-2015-3337 (4.3): Directory traversal CVE-2015-4165 (3.3): File modifications CVE-2015-5377 (5.1): RCE related to Groovy CVE-2015-5531 (5.0): Directory traversal

Slide 54

Slide 54

ELASTICSEARCH HTTPS://WWW.ELASTIC.CO/COMMUNITY/SECURITY CVE-2014-3120 (6.8): Dynamic scripting CVE-2014-6439 (4.3): CORS misconfiguration CVE-2015-1427 (6.8): Groovy sandbox escape CVE-2015-3337 (4.3): Directory traversal CVE-2015-4165 (3.3): File modifications CVE-2015-5377 (5.1): RCE related to Groovy CVE-2015-5531 (5.0): Directory traversal

Slide 55

Slide 55

Painle !

Slide 56

Slide 56

HIRED DEVELOPER 1 YEAR DEVELOPMENT

Slide 57

Slide 57

Why build a brand new language when there are already so many to ch ! se from? — https://www.elastic.co/blog/painless-a-new-scripting-language

Slide 58

Slide 58

Goal SECURE & PERFORMANT

Slide 59

Slide 59

POST posts/doc/1/_update { "script": { "lang": "painless", "source": """ if(ctx._source.details.containsKey("plus_ones")) { ctx._source.details.plus_ones++; } else { ctx._source.details.plus_ones = 1; } """ } }

Slide 60

Slide 60

Painle ! DEFAULT GROOVY, PYTHON, JAVASCRIPT REMOVED IN 6.X

Slide 61

Slide 61

Authentication & Authorization

Slide 62

Slide 62

Slide 63

Slide 63

$ curl -XGET 'http://67.205.153.88:9200/_cat/indices' yellow open goal12 5 1 9397 0 27mb 27mb yellow open please_read 5 1 1 0 4.9kb 4.9kb yellow open un-webhose 5 1 2294 1 25.4mb 25.4mb yellow open goal11 5 1 4828 0 13.3mb 13.3mb

Slide 64

Slide 64

$ curl -XGET 'http://67.205.153.88:9200/please_read/_search?pretty' {

"took" : 1,

"timed_out" : false ,

"_shards" : {

"total" : 5,

"successful" : 5,

"failed" : 0 },

"hits" : {

"total" : 1,

"max_score" : 1.0,

"hits" : [ {

"_index" : "please_read" ,

"_type" : "info" ,

"_id" : "AVm3qmXeus_FduwRD54v" ,

"_score" : 1.0,

"_source" : {

"Info" : "Your DB is Backed up at our servers, to restore send 0.5 BTC to the Bitcoin Address then send an email with your server ip" ,

"Bitcoin Address" : "12JNfaS2Gzic2vqzGMvDEo38MQSX1kDQrx" ,

"Email" : "elasticsearch@mail2tor.com" } } ] } }

Slide 65

Slide 65

Slide 66

Slide 66

Slide 67

Slide 67

Slide 68

Slide 68

Network Security BY DEFAULT localhost

Slide 69

Slide 69

Network Security PRIVATE NETWORK ONLY

Slide 70

Slide 70

Network Security FIREWALL

Slide 71

Slide 71

Network Security RANDOM PORT

Slide 72

Slide 72

Authentication & Authorization PROXY

Slide 73

Slide 73

Authentication & Authorization X-PACK: SECURITY

Slide 74

Slide 74

Restore SNAPSHOT

Slide 75

Slide 75

Conclusion

Slide 76

Slide 76

Injections Are Sti ! a Thing

Slide 77

Slide 77

Enable Security by Default

Slide 78

Slide 78

Be Creative — Or Not

Slide 79

Slide 79

Custom Scripting Can Make Sense

Slide 80

Slide 80

Security Takes Time

Slide 81

Slide 81

Thanks! QUESTIONS? Philipp Kre ! 444 @xer "