# That’s the kind of password an idiot uses on luggage: cloud security

- Link: https://www.agilicus.com/thats-the-kind-of-password-an-idiot-uses-on-luggage-cloud-security/
- Published: 2019-04-26T12:45:00+00:00
- Author: Don Bowman

Say it ain’t so, etcd is on the public Internets? And its leaking like a sieve.

A Shodan [query](https://www.shodan.io/search?query=etcd) shows 2593 etcd services
out there flapping in the breeze. More detail was [covered](https://elweb.co/the-security-footgun-in-etcd/)
in Giovanni Collazo blog, but, in a nutshell, the combination of:

 1. simplicity. Its just easy to use and deploy etcd
 2. Insecure by design and default. To make it simple, no security model was originally
    used, if you can access the port, you can read the world
 3. orchestration platforms using etcd to move config around, including the link between
    container A and container B (e.g. mysql-client and mysql-server).

is super-dangerous.

In the [tweet](https://twitter.com/bad_packets/status/975206905659383808) about 
this, we see a great screen shot, mysql password is 1234. Yup. The same one that
[Spaceballs](https://www.youtube.com/watch?v=a6iW-8xPw3k) talked about.

![2219e773 mysql password tweet](https://www.agilicus.com/www/2019/04/2219e773-mysql-
password-tweet.png "That’s the kind of password an idiot uses on luggage: cloud 
security 1")

mysql password in tweet

You can’t ‘yada yada yada’ cloud security. You need a real firewall, particularly
when you are playing with ‘this only works on a dedicated network that is isolated
even from the rest of your own application stack’ stuff like etcd. Seriously, you
can’t even just be ‘outside bad, inside good’, you need to think about lateral traversal.
if one machine of yours is compromised, and it can walk around in etcd (maybe it
changes that password? just reads it? Its bad regardless). And its probably hard
to retool everything.