On Sept 4th I have identified an open and unprotected Elasticsearch cluster containing sensitive details of customers of Calcioshop.it, popular online shop in Italy for football accessories.

Database contained 408,995 records with information about Calcioshop customer such as:

• full name
• email
• phone number
• billing/shopping address
• IP address
• tax/VAT number
• order details

I have immediately sent a responsible disclosure notice to the company, but no response received. After a week I got in touch with Italian CERT who contacted the organization and database was pulled offline on Sept 19, almost two weeks after initial notification.

Danger of having exposed Elasticsearch or similar NoSql databases is huge. I have previously reported that the lack of authentication allowed the installation of malware or ransomware on the Elasticsearch servers. The public configuration allows the possibility of cybercriminals to manage the whole system with full administrative privileges. Once the malware is in place criminals could remotely access the server resources and even launch a code execution to steal or completely destroy any saved data the server contains.

***

As we see a never-ending loop of these incidents, we at SecurityDiscovery.com have decided to offer a live educational session (webinar or offline workshop) for raising cyber security awareness within your organization, to prevent potential issues in the future. We use real world examples and promote that data security is important to every employee and at every level inside the organization.

It can be an online webinar session (estimated 1h long), with Q&A session or an offline meeting in your offices, live interaction with your team (master class included).

Proposed content includes:

• Description of tools and techniques we use to identify vulnerabilities, PII and sensitive data online: no hacking, just google-it.
• How to ensure your data / your company’s data is not exposed to the public internet, security tips from professionals
• Recommendations and best practice on main noSQL databases configurations and maintenance (MongoDB, CouchDB, Elasticsearch)
• Case studies: analyzing related data appearance online
• Live search for data and master class

Please feel free to send your requests to alert(at)securitydiscovery.com or bob(at)securitydiscovery.com

Let’s educate your team!