- UpGuard finds unprotected Elasticsearch instance belonging to Leak Zone
- The instance contained millions of IP addresses
- Leak Zone is a known underground forum with a large number of users
In a moment of poetic irony, an underground “leaking and cracking forum” exposed the IP addresses of all its logged-in users, essentially doxxing them to everyone – security researchers, rival criminals – and most notably, law enforcement.
Security researchers from UpGuard found an exposed Elasticsearch database, available to anyone who knew where to look. Deeper analysis determined that the database belonged to Leak Zone, an underground forum where cybercriminals advertise and share stolen archives, credentials, and software.
It contained more than 22 million records – IP addresses and precise timestamps of when the user logged in. The database is also quite fresh, with the archive is apparently being updated in real time, as well as indicating if there is a chance a user logged in using an anonymization tool such as a proxy or a VPN.
Exposed instances – everywhere
It is impossible to say for how long the archive remained open, and if anyone discovered it before UpGuard did.
We also don’t know how many people were exposed in this incident but allegedly, the forum has roughly 100,000 members. In any case, it has since been locked down and is no longer accessible.
The researchers also could not determine the cause of the database being left exposed.
Usually, it is down to human error – admins simply forgetting to set a password, or otherwise encrypt it. In fact, exposed databases continue to be the leading cause of data leaks – among legitimate and illegal organizations alike.
For years, researchers have been warning that cloud works on a shared responsibility model – something many IT teams don’t seem to be aware of.
Some businesses believe securing the cloud infrastructure is the service provider’s task – leaving the back door wide open for cybercriminals.
Via TechCrunch
