Date: Mon, 5 Aug 2013 03:22:23 +0300
From: Johan Boger <jboger@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Potential security flaw in network implementation
	at Digitalocean.com

Hi,

Today, I discovered that a certain large ISP specializing in cloud hosting (
digitalocean.com), has misconfigured their network in a way that allows for
anyone to monitor customer network traffic. Per the guidelines of
responsible disclosure, I have informed the ISP in question both when I
first noticed the issue, and also before going public with the information.
As I am sure some of this info has already trickled out (or is perhaps
already common knowledge - if so, I apologize), I feel it is paramount to
get this information out there, so that customers and others who feel this
is not something they want, can act accordingly (or at least take
counter-measures to protect their information).

What happened:

I ordered a cloud vps (a very affordable one at that, I must say) at
digitalocean.com, using the NYC node. During the process of checking MySQL
replication between master and slave, I noticed there was a lot of
background noise in tcpdump. I kept looking and when I eliminated the ports
I was using, what was left was somewhat worrying. It seems DigitalOcean
has, using KVM and libvirt per their own recognition, put the
libvirt-interface in an overly large bridge, and then kept applying more
and more networks (multiple /24, it seems). While this might be a
convenient way of assigning new networks to an ever-growing customer stock,
it also sort of turns the entire thing into an amateur radio station (using
the word amateur here to denote the activity, not the skill level of
Digitalocean staff!).

I want to make one thing clear. This is one of the better cloud shops I
have used (and I have used a lot). They seem to have excellent support,
provide what they claim to provide, and my billing there so far amounts to
less than a dollar (even though I've fiddled with lots of stuff). HOWEVER,
this does not mean that I want to be able to read what goes on with various
mail, ircd, web and Microsoft sql servers, in networks far outside of my
logical reach, as a customer with one IPv4.

I am not an angry ex-customer. I will keep using their services, if this is
fixed. Which is exactly why I am sending this email. I hope that it might
add extra motivation, before someone gets their environment hacked. The way
it is now, anyone even remotely interested, could fire up a VPS in less
than a minute, and have full sniffing capabilities with hundreds (if not
thousands) of servers. All while customers are using said servers to
develop what I can only assume is important enough to host in a cloud.

I will not paste logs as that would add nothing to my disclosure, more than
a possibility to exploit innocent users. I wish to encourage the community
to take a few steps back and not engage in target practice, while
Digitalocean undoubtedly remedies this situation (I have been in contact
with them repeatedly before coming here).

I hope that this helps, for whatever it's worth. I will happily answer any
followups, as long as they do not include requests for additional probes.
This is where my involvement ends. I leave this information in the hands of
the community, and Digitalocean (who I hope reads this list).


Best Regards,
-- 
Johan Boger

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists