Security researchers who this month issued alerts on ransomware attacks on insecure MongoDB and Elasticsearch clusters are now warning organizations running Hadoop their clusters may be the next targets of attackers.

Why? Because they’re easy to get at.

“It looks like 2017 is the year the all low-hanging fruit (open systems) will be saved just in time or perish by ransom attacks,” Victor Gevers of the GDI Foundation, a Dutch non-profit working for an open and secure Internet, said in an email.

An open source distributed file system designed to  store very large files across multiple servers that comes with an analysis engine, Hadoop has been adopted by cost-conscious organizations to handle Big Data problems. Two of the biggest distributions come from Cloudera and Hortonworks. Amazon runs its own version, Elastic MapReduce (EMR), on its Elastic Cloud Compute (EC2) infrastructure. 

But not all enterprise implementations are secure. In fact, a warning note released by Gevers and his colleagues reminds administrators that Hadoop’s default Web interface settings have security and safemode turned off.

“The default installation for HDFS Admin binds to the IP address and allows any unauthenticated user to perform super user functions to a Hadoop cluster,” says the warning. “These functions can be performed via a web browser, and do not prevent an attacker from destructive actions. This may include destroying data nodes, data volumes, or snapshots with TBs of data in seconds.”

As a recent article on pointed out, some organizations just dump log data into Hadoop data lakes for analysis without thinking whether it could include sensitive information. That’s why some experts quoted believe improving the security of a long-term data storage, including data classification, encryption and obfuscation, will increase in 2017.

Gevers estimates there are just over 5,300 Internet-facing Hadoop implementations. It isn’t known how many aren’t secure.

The GDI Foundation offers this advice for securing Hadoop, largely pulled from Apache:

  1. Ensure Security is on.
  2. Turn Hadoop Safemode on.
  3. Turn of service level authentication.
  4. Apply network filtering for or let firewall rules block port 50070 to untrusted IPs.
  5. Add a free IAM control and network segmentation with an OpenVPN solution.
  6. Implement a reverse proxy, such as Knox, to aid in preventing unauthorized access and manage connectivity to Hadoop.



Related Download
Security Training Resource Kit Sponsor: ITWC
Security Training Resource Kit
Want to reduce your security incidents? Experts say that training can reduce security incidents by anywhere from 45% to 70%. But how do you train your employees effectively? Yes, you can send memos and do courses, but who reads this stuff? That's why we took a different approach.
Download Now