News for hackers. Stuff that matters.

A comment on Elsevier Left Users’ Passwords Exposed Online. Parent comment

Re:Elsevier Left Users’ Passwords Exposed Online by cjbprime on Monday March 18, 2019 @04:00PM (#19424612)
Kibana's a monitoring system, so the article makes it sound like the passwords were ingested into logs on their way to presumably sit hashed at rest for the systems that they were intended for.

Which means there are really three red flags: internal tools deployed to the public internet, internal tools without any user access control, and allowing passwords to hit the logging infrastructure.

[ Parent | on HN ]
Re:Elsevier Left Users’ Passwords Exposed Online by adossi on Tuesday March 19, 2019 @10:26AM (#19431092)
>allowing passwords to hit the logging infrastructure.

This is the most ridiculous of the three in my opinion. When logging to elasticsearch you programmatically have to say what data to put in the document before its indexed (and thus viewable via Kibana). This means that the developer actually put the password as a parameter in the document object.

[ Parent | on HN ]
Re:Elsevier Left Users’ Passwords Exposed Online by cjbprime on Tuesday March 19, 2019 @11:48AM (#19431945)
Not necessarily, it could just be total and indiscriminate logging of HTTP requests.
[ Parent | on HN ]