Over 13K iSCSI storage clusters left exposed online without a password
Summary
Over 13,000 iSCSI storage clusters are currently accessible via the internet after their respective owners forgot to enable authentication. iSCSI is a core component of the modern computing industry, as it allows virtual machines (VMs) to boot from remote hard drives as theyd be local devices; allows companies to centralize storage systems without breaking apps that cant handle IP-based network storage paths; and is a crucial part of many data replication solutions. This means that anyone knowing basic details about some of these systems can follow simple YouTube video tutorials and connect to these storage clusters, may them be large-scale disk arrays inside a companys data center, or tiny NAS devices left in an office corner. In a cursory investigation of a small sample of exposed iSCSI clusters, ZDNet found passwordless iSCSI-accessible storage systems belonging to a YMCA branch, a Russian government agency, and multiple universities and research institutes from all over the globe. Such systems may be a little harder to spot in Shodan search results during short lookups, but a cyber-criminal gang looking to maximize its profits will be, without a doubt, willing to thoroughly research each exposed iSCSI cluster for its next big hit.