<story><title>I discovered thousands of open databases on AWS</title><url>https://infosecwriteups.com/how-i-discovered-thousands-of-open-databases-on-aws-764729aa7f32?gi=af55b7c4e39f</url></story><parent_chain><item><author>rmetzler</author><text>&amp;gt; DevOps, Developers, and IT practitioners often misconfigure some of the following:
Binding the socket on the wrong network interfaces.
For example, listening to connections from 0.0.0.0&amp;#x2F;* — So it is visible to all network interfaces, instead of only the inner-network interface IP address (172.x.x.x)&lt;p&gt;Binding to 0.0.0.0 is unfortunately the default for Docker. I wish it would have been different.</text></item></parent_chain><comment><author>dspillett</author><text>&lt;i&gt;&amp;gt; Binding to 0.0.0.0 is unfortunately the default for Docker.&lt;/i&gt;&lt;p&gt;That isn&amp;#x27;t just a docker thing, though a few notable accidents with docker have shone a light on the issue in recent times, and is one of the reasons I much prefer to keep my firewall away from where things are running, between them and the unwashed masses on the public network.&lt;p&gt;Even at home I have a separate small firewall box between the server that hosts things (and the rest of my network) instead of trusting that host to manage its own security in that way. If I run a service via docker or anything else on there, the outside world doesn&amp;#x27;t see it unless I open a way in elsewhere. For extra paranoia, the network leg that others can connect to (wireless AP &amp;amp; wired network ports in the guest room) is also separate and only sees parts of the server(s) I explicitly want it to (you can do this with vlans and such depending on your kit, I&amp;#x27;ve actually just got an extra NIC on the router).&lt;p&gt;Never assume a process&amp;#x2F;service&amp;#x2F;container&amp;#x2F;etc is at all locked down, unless you have checked it out yourself or have it sufficiently wrapped in things you have locked off.</text></comment>
<story><title>I discovered thousands of open databases on AWS</title><url>https://infosecwriteups.com/how-i-discovered-thousands-of-open-databases-on-aws-764729aa7f32?gi=af55b7c4e39f</url></story><parent_chain><item><author>rmetzler</author><text>&amp;gt; DevOps, Developers, and IT practitioners often misconfigure some of the following:
Binding the socket on the wrong network interfaces.
For example, listening to connections from 0.0.0.0&amp;#x2F;* — So it is visible to all network interfaces, instead of only the inner-network interface IP address (172.x.x.x)&lt;p&gt;Binding to 0.0.0.0 is unfortunately the default for Docker. I wish it would have been different.</text></item></parent_chain><comment><author>Cthulhu_</author><text>It&amp;#x27;s the kind of example that would make me uncomfortable to work with Docker &amp;#x2F; cloud things; I&amp;#x27;m sure I could set up stuff within a day, but there&amp;#x27;s a lot of Things That You Should Happen To Know like this example that are easily missed - especially when you&amp;#x27;re in an environment where there&amp;#x27;s pressure on you to deliver, instead of a focus on doing things right.</text></comment>