Is it legal to access them if they are unsecured?
Legality is determined by permission, so no.
New ‘Meow’ attack has deleted almost 4k unsecured databases
121–130 of 544 posts
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#122So why is the attack being called Meow?
Cats like to knock things off of tables.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#123Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.
I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…
> Are there databases that could be lost without consequence except to their owner
I would certainly hope the owner of the insecure database would face massive consequences. IMO there's not _nearly_ enough of that. This sort of breach should be financially ruinous for _any_ company.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#124Earlier quoted context omitted.
> Yeah, I don't care if a big chain restaurant is closed down for having too poor hygiene. But I would feel bad if someone's small restaurant had to shut down because the cook doesn't bother to wash his hands at work. If you are holding other people's data for them, you have a responsibility to do your best to keep the data safe. If you don't know how to do that and don't have time to learn, you can hire someone who…
And what about the responsibility to not destroy someone's property? Do you have the same opinion about shoplifters walking away with merchandise? Would your argument be that there should be armed guards and searches in every retail store? Isn't it reasonable that a thief be criticized and penalized for their actions even if the theft was "easy" to commit and is it OK to blame the victim for not being prepared?
But it's my personal and sensitive data that they are poor stewards of, not their property.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#125Earlier quoted context omitted.
I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…
> Are there databases that could be lost without consequence except to their owner I would certainly hope the owner of the insecure database would face massive consequences. IMO there's not _nearly_ enough of that. This sort of breach should be financially ruinous for _any_ company.
What if the database only contains my blog posts? Or my own personal health information I'm tracking? Or all the Hearthstone cards? Or any other of the infinite data sets that are totally insignificant to anyone beyond the owner of the database?
Not everything is about you, and also you totally misunderstood the post you quoted.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#126If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…
It's also easy to get bitten by Docker. You can secure your server with iptables/ufw only to discover that docker happily punches through your firewall and you need to filter on the DOCKER-USER chain - and even that was broken: https://unrouted.io/2017/08/15/docker-firewall/ https://github.com/docker/for-linux/issues/690
Seriously this is the most annoying thing ever, especially if someone on your team things you need to expose the ports to redis in a docker compose. I’ve come back from a weekend where my redis instance was being used for crypto mining.
Anything that is insecure by default in 2020 should be killed off IMO.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#127Earlier quoted context omitted.
It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? The company could take a huge financial hit and people might lose their jobs because of their practices being exposed.
Sometimes the best path forward does harm, sure. It's just hard for me to agree that deleting these databases is the harm-minimizing path. One example of a less harmful path that comes to mind immediately is installing a random password on the unsecured database and emailing the domain owner the password. That would cause downtime but it would limit the irreversible damage. You could even say that you will delete the…
[deleted]
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#128Earlier quoted context omitted.
A spin class? Really that is the best example you can come up with? That is not at all compelling.
What part of the example do you dispute? Spin studios have databases, like almost all small businesses these days.
If I knew we were frying fish this small Id a brought a different pan
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#129Earlier quoted context omitted.
I don't think the parent suggests it exonerates the hackers. Just that the clients are better off.
Better off? The idea that victims deserve to be victimized because they didn't take enough care is trotted out every time a security issue comes up on HN.
Thr victims are the unaware customers who's data has been stolen because the company wasn't providing security.
If a business left the store open with the customers credit cards details on display. Anyone passing by can go in and copy that info. Someone sees this and burns the exposed records. Perhaps they helped the victim.
Remember no one burned the store down or the table holding the records. They burned only the exposed records.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#130How do they determine ‘almost 4k’?
[deleted]