Experts warn of mass-scanning for ENV files left unsecured online

Threat actors are scanning the Internet for ENV files that usually contain API tokens, passwords, and database logins.

Threat actors are scanning the internet for API tokens, passwords, and database logins that are usually used to store ENV files (Environment files) accidentally left exposed online.

360 Mobile Vision - 360mobilevision.com North & South Carolina Security products and Systems Installations for Commercial and Residential - $55 Hourly Rate. ACCESS CONTROL, INTRUSION ALARM, ACCESS CONTROLLED GATES, INTERCOMS AND CCTV INSTALL OR REPAIR 360 Mobile Vision - 360mobilevision.com is committed to excellence in every aspect of our business. We uphold a standard of integrity bound by fairness, honesty and personal responsibility. Our distinction is the quality of service we bring to our customers. Accurate knowledge of our trade combined with ability is what makes us true professionals. Above all, we are watchful of our customers interests, and make their concerns the basis of our business.

Environment files are configuration files that usually contain user environment variables for multiple frameworks and development tools such as Docker, Node.js, Django, and Symfony.

Obviously these files should not be exposed online without any protection.

Upon discovering unprotected ENV files exposed online, threat actors will download them to access their content and us it attacks.

The scanning activities observed by several security experts are likely operated through botnets designed to search for these specific files and gather sensitive information that could be used by threat actors for multiple malicious activities.

Researchers from security firm Greynoise have reported that thousand of IP addresses have been involved in mass scanning operations aimed at discovering ENV files in the last three years. Experts reported that most of the IP addresses are in the United States, followed by Germany and France.

According to Greynoise, more than 1,000 scans have been observed over the past month.

A similar activity was reported by researchers from threat intelligence firm Bad Packets:

The lesson learned is to never expose online ENV files if we don’t want to make a gift to the attackers.

Pierluigi Paganini

(SecurityAffairs – hacking, botnet)

The post Experts warn of mass-scanning for ENV files left unsecured online appeared first on Security Affairs.

By admin