Pierluigi Paganini June 03, 2017

According to Shodan search, unprotected Hadoop Distributed File System installations expose 5 PB of data.

Hadoop servers that are not securely configured expose vast amounts of data, according to an analysis conducted using the Internet search engine Shodan.

A study conducted by Shodan revealed that nearly 4,500 servers with the Hadoop Distributed File System (HDFS) were found to expose 5,120 TB (5.12 PB) of data.

The overall volume of data exposed by HDFS system is greater than the one related to MongoDB installs.

“However, in terms of data volume it turns out that HDFS is the real juggernaut.” reads the analysis published by Shodan. “To give you a better idea here’s a quick comparison between MongoDB and HDFS:”

“Even though there are more MongoDB databases connected to the Internet without authentication in terms of data exposure it is dwarfed by HDFS clusters (25 TB vs 5 PB).”

Most of the servers with the Hadoop Distributed File System are located in the United States (1,900) and China (1,426), followed by Germany and South Korea with 129 and 115 servers, respectively.

The majority of the HDFS install are hosted in the cloud, mainly Amazon (1,059 instances) and Alibaba (507).

In 2016, security experts observed ransom attacks aimed at unsecured MongoDB database installs exposed online.

According to the researchers, the hackers were implementing an extortion mechanism copying and deleting data from vulnerable databases.

Crooks requested the payment of a ransom in order to return data and help the company to fix the flaw they exploited.

Similar ransom attacks later began targeting Elasticsearch, CouchDB and Hadoop servers, such kind of attacks still target Hadoop and MongoDB installations. and a majority of the Internet-exposed MongoDB servers appear to have already been compromised.

According to Shodan founder John Matherly, a majority of the MongoDB servers exposed on the Internet have already been already compromised.

First attacks observed by the experts targeting HDFS installs erased most directories and created a directory named “NODATA4U_SECUREYOURSHIT.”  no ransom was asked to the victims.

Querying Shodan for “NODATA4U_SECUREYOURSHIT” string, the popular search engine retrieves more than 200 Hadoop Distributed File System installs.

The blog post published by Shodan includes instructions on how to search Hadoop Distributed File System installs exposed online.

Pierluigi Paganini

(Security Affairs – Hadoop Distributed File System, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]