Re:NordVPN confirms it was hacked
by _wldu on Monday October 21, 2019 @11:37AM
(#21313495)
User root, password calvin. That's the default. And, if I had a dime for every time I've seen one of these in a data center, I'd be a rich man. I have literally begged sys admins to change the default password, but they say, "Why... we're behind a firewall using RFC 1918 addresses. No one can get to these." The rest, as they say, is history.
[ Parent
| on HN ]
Re:NordVPN confirms it was hacked
by WrtCdEvrydy on Monday October 21, 2019 @08:55PM
(#21319293)
> we're behind a firewall
This is the dumbest thing I've ever seen... unless your firewall is between your host versus every other host and there's no multi-tenancy, this will suck.
In well maintained networks the management interface (IDRAC, etc.) for each server is placed on a separate VLAN which the servers cannot access. This isn't to say that cheap providers actually do this, or that the VLAN can't be accessed by a compromised technician's workstation/laptop.
So it's a fail-open design, given the rarity of well maintained networks, and the lability and inobservability of said state.
Never trust the network.
Yes, this kind of firewall is always supposed to be between the management hosts and everything else. Only the sysadmins at the data center a very limited set of applications is supposed to be able to access it. The very real risk is misconfiguration.