Tens of thousands of unpatched, misconfigured database management systems found

The IT world comes with its own language and syntax that sometimes gets in the way of communicating what it means — platform, architecture, terminators, syslogs, GUIs — and mangled English only makes things worse.

So while this blog on research from Swiss security startup BinaryEdge on the dangers of misconfigured database platforms might be informative had it been proofread, we should all be grateful for the translation by Security Week writer Eduard Kovacs, which shines a better light on a serious subject.

BinaryEdge looked at the Internet exposure and the impact of default configurations in the case of four popular database management systems: Redis, an open source key-value cache and store; MongoDB, a NoSQL database; Memcached, general-purpose distributed memory caching system, and ElasticSearch, search server based on Apache Lucene.

The result: 1,175 terabytes (roughly 1.1 petabytes) of data were found exposed online due to misconfigured installations housed by various organizations, from small firms to Fortune 500 companies. For example, 35,330 Redis instances were discovered that didn’t have any type of authentication, possibly exposing more than 13 terabytes of data.

Also, many of the versions of these platforms were old and hadn’t been updated, which, as the BinaryEdge blog notes, means that, in some cases, not only is data exposed but even servers can be compromised. “Companies are still figuring out how to use these technologies,” researchers believe.

Not only that but because some of these products are used as cache servers the data constantly changes so not only personal or corporate data can be exposed, so might authentication sessions.

I’m not sure who’s at fault here: database administrators or IT security teams. But it seems likely that CISOs ought to be looking more carefully at their database management oversight.

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@]

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web