Company
Date Published
Author
Redis
Word count
533
Language
English
Hacker News points
None

Summary

This new cryptojacking attack incorporates Redis in a complicated manner, but fortunately, following basic configuration and security best practices can prevent it from affecting users. Redis Enterprise is completely impervious to this attack due to its built-in multi-layer security control, including access control, authentication, authorization, forensics, encryption, and protection layers. The attack exploits poor decisions related to Redis settings, such as running on the open internet without a password or firewall, using default port 6379, and manually altering configuration settings to increase vulnerability. Users can protect themselves by following security best practices and using Redis Enterprise, which provides a pure separation between management and data-plane planes, making it more secure than open-source Redis.