Is it legal to access them if they are unsecured?
New ‘Meow’ attack has deleted almost 4k unsecured databases
101–110 of 544 posts
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#102If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…
I've said it on here before, but the way in which Elasticsearch used to lock away critical security functionality (like TLS support and RBAC) behind a paid subscription whilst making just enough functionality available for free such that users could shoot their foot off is disgusting. This only ever changed after Open Distro for Elasticsearch came onto the scene and forced Elastic's hand. I entirely agree the vendors…
This is why we are refactoring our database to be able to migrate to Amazon documentdb from MongoDB. Encryption at rest.... Pay up!
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#103Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.
Would you feel the same way if someone burned your house down if you left the door unlocked? Would you support the idea of people walking through a neighborhood and checking every door in a similar way? Does your opinion change if it happened in a business district? I think it is fine to argue that doors should be locked but that doesn't mean that a crime hasn't been committed when someone takes advantage of a situat…
I don't think the parent suggests it exonerates the hackers. Just that the clients are better off.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#104Earlier quoted context omitted.
Yeah. I don't care if some big business loses their Elasticsearch data and their site stops working until they get it secured and re-hydrated with data from their relational database. Good, they learned a lesson. But I would feel bad if someone's small business had to shut down or lose a bunch of money because they lost all their customer data. I'd feel bad if someone lost all the data they'd been using for a persona…
> Yeah, I don't care if a big chain restaurant is closed down for having too poor hygiene. But I would feel bad if someone's small restaurant had to shut down because the cook doesn't bother to wash his hands at work. If you are holding other people's data for them, you have a responsibility to do your best to keep the data safe. If you don't know how to do that and don't have time to learn, you can hire someone who…
And what about the responsibility to not destroy someone's property?
Do you have the same opinion about shoplifters walking away with merchandise? Would your argument be that there should be armed guards and searches in every retail store? Isn't it reasonable that a thief be criticized and penalized for their actions even if the theft was "easy" to commit and is it OK to blame the victim for not being prepared?
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#105Earlier quoted context omitted.
Don't expose MySQL databases to the internet. Just don't. Stick an API layer in at the very least with key based auth, and only the bare minimum capabilities allowed for the user. That said, if you'd read the article you'd see that so far only unsecured MongoDB, Elasticsearch and Redis installations are being attacked so far.
I'm doing my first web project (self-taught), which is the prototype for an offering me and a partner are developing to become a startup. I was about to start deployment (for the first time in my life) this week, but now I'm afraid. It's a flask app. We serve users forms (POST), then I use this input to run calculations on the server through a python script which makes queries to a MySQL db, then I return results to…
>PS: I don't know exactly what you mean by "Stick an API layer in at the very least with key based auth" because I never used an API before and didn't know I would need something like this
Don't allow access to `mysql -h hostname` from WWW. Instead, keep your MySQL server accessible only by machines you control in the same security group/network/etc. To get access to the database from the public, create an API that allows predefined queries only to users you've authorized. This API would also be hosted within the same security group/network/etc. The public never gets direct access to the database, yet gets the predefined access they need.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#106Earlier quoted context omitted.
I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…
The possibility of someone stealing your identity (or worse) far outweighs the damages from losing some coupons. Deleting exposed databases is genious, there need to be real repercussions for companies if they leak user data.
> The possibility of someone stealing your identity (or worse) far outweighs the damages from losing some coupons.
That is a very rich person statement.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#107Earlier quoted context omitted.
I’d feel bad if someone’s hobby project was deleted. Small businesses losing customer data is only slightly more sympathetic than people getting sick because they didn’t think the health code applied to them. If you collect it, you need to be responsible for keeping it safe. Anything affected by this is already exposed and has to be assumed to have been breached.
What if it was a small business's inventory data rather than customer data? Seems to me, there are a lot of things businesses could store in a database which don't necessarily need to be private, or which at worst won't harm anyone other than the database creator if exposed.
That’s why I was specific about customer data: it’s basically a question of who’s harmed - if the cost is borne by the person cutting corners it’s more of a self-correcting problem.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#108Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.
Somehow I feel good about this.
Frankly anyone who is still using MongoDB is professionally negligent and this was if not deserved then certainly inevitable.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#109Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.
Would you feel the same way if someone burned your house down if you left the door unlocked? Would you support the idea of people walking through a neighborhood and checking every door in a similar way? Does your opinion change if it happened in a business district? I think it is fine to argue that doors should be locked but that doesn't mean that a crime hasn't been committed when someone takes advantage of a situat…
Except that I didn’t leave the doors open. Someone I trusted with the keys, left them in their safe. Unlocked. So I rather have their whole place burned down and MY keys melted at the same time.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#110Earlier quoted context omitted.
Sometimes the best path forward does harm, sure. It's just hard for me to agree that deleting these databases is the harm-minimizing path. One example of a less harmful path that comes to mind immediately is installing a random password on the unsecured database and emailing the domain owner the password. That would cause downtime but it would limit the irreversible damage. You could even say that you will delete the…
What you propose is illegal in most 1st/2nd world countries. In mine, the company could thank you and then put you straight to jail for 30 years. Unfortunately very few small businesses run sade reporting programs and often react with attack.
So is deleting a database.
Putting a password and emailing the admin would solve the password problem.
But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.