# Clarifications on the Incapsula Redis security report

DevFeed: [Clarifications on the Incapsula Redis security report](<https://devfeed.tech/articles/clarifications-on-the-incapsula-redis-security-report-20609.md>)

Original publisher: [Read original article](<http://antirez.com/news/118>)

Published: 2018-06-02T17:52:39Z

Content type: article

Language: en

Sources: [Antirez](<https://devfeed.tech/sources/antirez.md>)

Topics: [Redis](<https://devfeed.tech/topics/redis.md>), [Security](<https://devfeed.tech/topics/security.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [ransomware](<https://devfeed.tech/topics/ransomware.md>)

Tags: [articles](<https://devfeed.tech/tags/articles.md>), [blog](<https://devfeed.tech/tags/blog.md>), [blog-post](<https://devfeed.tech/tags/blog-post.md>), [http](<https://devfeed.tech/tags/http.md>), [malware](<https://devfeed.tech/tags/malware.md>), [password](<https://devfeed.tech/tags/password.md>), [redis](<https://devfeed.tech/tags/redis.md>), [report](<https://devfeed.tech/tags/report.md>), [research](<https://devfeed.tech/tags/research.md>), [security](<https://devfeed.tech/tags/security.md>), [servers](<https://devfeed.tech/tags/servers.md>)

## AI overview

This article clarifies that the reported 75% infection rate applied to Redis instances exposed on public IP addresses without password protection, not to all Redis servers. It explains how unsecured cloud-hosted Redis installations become exposed and presents them as a case study in security and safe defaults.

## Source excerpt

A few days ago I started my day with my Twitter feed full of articles saying something like: "75% of Redis servers infected by malware". The obvious misquote referred to a research by Incapsula where they found that 75% of the Redis instances left open on the internet, without any protection, on a public IP address, are infected [1]. [1] https://www.incapsula.com/blog/report-75-of-open-redis-servers-are-infected.html Many folks don't need any clarification about all this, because if you have some grip on computer security and how Redis works, you can contextualize all this without much efforts. However I'm writing this blog post for two reasons. The obvious one is that it can help the press and other users that are not much into security and/or Redis to understand what's going on. The second is that the exposed Redis instances are a case study about safe defaults that should be interesting for the security circles. The Incapsula report === Let's start with the Incapsula report. What they did was to analyze exposed Redis instances on the internet. Instances that everybody from any place of the internet can access, because they are listening for connections in a public IP address, without any password protecting them. It is like if they were HTTP servers, but it's Redis instead, that is not designed to be left exposed. This is far from a new story. Because of Redis popularity the number of total Redis installations is pretty huge, and a fraction of these installations are left exposed. It's like that since the start basically. People spin a virtual machine in some cloud provider, install Redis, find that they cannot access it, open the port of the VM to anyone, and the instance is at this point running unprotected. They only thing that changed is that most of those instances in the past were left running unaffected in many cases. Maybe some script kiddie could connect and call "INFO" or a few more commands to check what there was inside, and that was it most of the ti