A hacker has wiped, defaced more than 15,000 Elasticsearch servers

guest · Apr 3, 2020

A hacker has wiped, defaced more than 15,000 Elasticsearch servers
Hacker tries to pin the blame on Night Lion Securty, a US cyber-security firm
April 3, 2020
https://www.zdnet.com/article/a-hacker-has-wiped-defaced-more-than-15000-elasticsearch-servers/

For the past two weeks, a hacker has been breaking into Elasticsearch servers that have been left open on the internet without a password and attempting to wipe their content, while also leaving the name of a cyber-security firm behind, trying to divert blame.

According to British security researcher John Wethington, one of the people who saw this campaign unfolding and who aided ZDNet in this report, the first intrusions began around March 24.
The attacks appear to be carried with the help of an automated script that scans the internet for ElasticSearch systems left unprotected, connects to the databases, attempts to wipe their content, and then creates a new empty index called nightlionsecurity.com.

Furthermore, while looking into this issue, Wethington also identified a second hacker who is also targeting Elasticsearch servers.
Click to expand...

Log in or Sign up

A hacker has wiped, defaced more than 15,000 Elasticsearch servers

guest Guest

Log in or Sign up

A hacker has wiped, defaced more than 15,000 Elasticsearch servers

guest Guest

Useful Searches