Pain spotting: Russia's Aeroflot Docker server lands internal source code, config files on public internet

Russian airline Aeroflot has exposed to the public internet the internal blueprints for its website, aeroflot.ru, The Register has learned. Specifically, the biz has left a Docker registry server open to all the world to see: if asked nicely, with no authentication, it will cough up compressed archives of the confidential …

[arctic_haze]

Shock

I'm shocked, shocked! Websites are created by incompetents!

[Fatman]

Re: Shock

Aren't most websites are created in this manner???

[lordminty]

So much for Russian hackers

Who needs Russian hackers when you have Russian IT professionals...

[Mark 85]

Re: So much for Russian hackers

Honor among countrymen maybe? No Russian would dare hack them. Now China is another matter.

[dvvdvv]

No security without obscurity!

[MiguelC]

No obscurity whatsoever there, I'm guessing they really favour open source! (probably unwittingly...)

[dvvdvv]

To segue from my previous comment: have there been any successful attacks against Aeroflot during the years the code has been exposed? I mean, other than the nation-state cyber attack against their VPN?

[macjules]

No, they just went for the insecure code in the British Airways site instead .. much easier to hack.

[David 132]

How responsible of you...

”We have decided not to link to the server exposing the information, nor go into detail on the data-leaking vulnerability, in the interests of responsible disclosure.”

In other words, “...because we don’t want to come into work one day and find Novichok smeared on our door handles”

[Korev]

Re: How responsible of you...

I hear Salisbury Cathedral is nice to visit at this time of year...

[chivo243]

Re: How responsible of you...

@Korev

as they say, one up vote is not enough...

"I hear Salisbury Cathedral is nice to visit at this time of year..."

[theblackhand]

Re: How responsible of you...

Salisbury Cathedral is terrible to visit at this time of year - very little mud and slush so most people go to Stonehenge instead.

Much better to go in late winter when the cooler temperatures provide a good excuse for not hanging around for very long and getting back on the train to London before anyone asks questions.

[phuzz]

Re: How responsible of you...

Don't bother with Stonehenge, pop down to Avebury instead. Stonehenge doesn't have a village pub in the middle of the circle.

[Tigra 07]

Re: David 132

I see you've been downvoted 4 times...So 1 is Corbyn, 1 from Putin, and 2 from the Russian hitmen right?

Yes, I ordered the pint of polonium sir...

[Anonymous Coward]

Re: How responsible of you...

Puhleeze... The foliage is fantastic here around Fort Meade every and each fall. Why are those bros ignoring it? No reports of Novichok here whatsoever…

[Yet Another Anonymous coward]

Now I'm confused

Do we have to not ban docker because it wasn't not used by the Russian secret service to leak secret of a Russians to foreign agencies ?

[Anonymous Coward]

Do they still have gulags?

I think some Aeroflot IT bods may be going on a trip.

[LeahroyNake]

English

Why are all the filenames in English?

Just seems a bit strange to me that they would outsource... all the away out of Russia.

[Anonymous Coward]

Re: English

They only use Slavic identifiers when hacking US elections.

[Tigra 07]

Re: English

If you build your website on the cheap then you're getting a template with a different colour scheme, not a unique specially built website. Add to that poor security and i think we have our reason of how this happened.

[Mr Dogshit]

More pictures of Russian air hostesses, please.

[Anonymous South African Coward]

If you try to hack Aeroflot's website, you'll get a prize.

One-way ticket to the Gulag.

Leaving for a safe house at an undisclosed location post-haste.

[Anonymous Coward]

Their website doesn't crash as frequently as their planes

[dvvdvv]

You mean the site has never crashed at least in the last 10 years? Not bad, not bad at all.

[Hans 1]

I am at a loss, here ... does this mean that OpenBSD, FreeBSD, Linux kernel, tar, nc, and many other pieces of software are a risk ? I mean, ok, here, somebody can run a copycat website on, say www.aerofloat.ru and potentially trick ppl into given away their hard earned cash ... but anything can siphon the website looks ... I fail to grasp ... of course, they might find sqlinjection points and with a database flavor it is easier to mount an attack ... but still ... meh

[Mookster]

if it's been done properly then there's no risk in exposing the source code..

if it's been done properly then there's no risk in exposing the source code..