Experts warn of mass-scanning for ENV files left unsecured online

Threat actors are scanning the Internet for ENV files that usually contain API tokens, passwords, and database logins.

Threat actors are scanning the internet for API tokens, passwords, and database logins that are usually used to store ENV files (Environment files) accidentally left exposed online.

Environment files are configuration files that usually contain user environment variables for multiple frameworks and development tools such as Docker, Node.js, Django, and Symfony.

Obviously these files should not be exposed online without any protection.

Upon discovering unprotected ENV files exposed online, threat actors will download them to access their content and us it attacks.

The scanning activities observed by several security experts are likely operated through botnets designed to search for these specific files and gather sensitive information that could be used by threat actors for multiple malicious activities.

Researchers from security firm Greynoise have reported that thousand of IP addresses have been involved in mass scanning operations aimed at discovering ENV files in the last three years. Experts reported that most of the IP addresses are in the United States, followed by Germany and France.

Ouch. Anyways, here’s a list of every single IP address crawling the entire Internet for .env files using @GreyNoiseIO:https://t.co/pYBXhX6VZNGNQL: web.paths:”.env” https://t.co/mrDYSjswWV pic.twitter.com/LppKdJ5lce— Andrew Morris (@Andrew___Morris) November 17, 2020According to Greynoise, more than 1,000 scans have been observed over the past month.

A similar activity was reported by researchers from threat intelligence firm Bad Packets:

185.234.218.174 () is mass scanning the internet for these paths:/admin-app/.env/api/.env/app/.env/apps/.env/back/.env/core/.env/cp/.env/development/.env/docker/.env/fedex/.env/local/.env/private/.env/rest/.env/shared/.env/sources/.env/system/.env. . . pic.twitter.com/vIBDk7Wbnl— Bad Packets (@bad_packets) February 19, 2020The lesson learned is to never expose online ENV files if we don’t want to make a gift to the attackers.

Pierluigi Paganini

(SecurityAffairs – hacking, botnet)

The post Experts warn of mass-scanning for ENV files left unsecured online appeared first on Security Affairs.