• United States
Unix Dweeb

Ransomware takes a nasty turn

News Analysis
Jan 19, 20172 mins
Big DataCyberattacksData Center

Another open source database has been targeted for attack. Only this time, paying the ransom isn’t even an option. Instead, the perpetrators just destroy the database, sometimes leaving a nasty message before moving on. This makes these attacks a very odd subcategory of “ransomware.”

Only weeks after the attacks began on MongoDB, the new attacks were reported by Fidelis Cybersecurity just last week. Fidelis is estimating that 8,000-10,000 installations worldwide might be affected.

What is Hadoop?

Hadoop is a framework managed by the Apache Software Foundation that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It can scale up to thousands of systems — providing an extreme level of availability. But, like MongoDB, its default security configuration leaves much responsibility to those implementing it.

Help for implementing and securing Hadoop is available at a number of sites such as these:

  • Implementation guidance for Hadoop is available from SAS.
  • Guidance on securing Hadoop from Securosis.

Undoubtedly because of its ability to handle huge collections of data, it was named after an elephant — actually a toy elephant. And that elephant still seems to be around.

Nature of the attacks

In one case, database directories were attacked and a single directory named “NODATA4U_SECUREYOURSHIT” was left in their place. The motivation for the attacks seems unclear except to cause problems for the targeted sites.

The reasons the attacks are working seem to be painfully familiar.

  • Minimal security by default and implementors not taking the time to implement proper security — access without authentication being a dominant problem
  • Mandatory exposure via the platform-as-a-service model
  • A denial of access attack approach

Refer to the details on ThreatGeek for more details.

Unix Dweeb

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she's chasing the bears away from her bird feeders.

The opinions expressed in this blog are those of Sandra Henry-Stocker and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.

More from this author