Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

161–170 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#161

Earlier quoted context omitted.

> Yeah, I don't care if a big chain restaurant is closed down for having too poor hygiene. But I would feel bad if someone's small restaurant had to shut down because the cook doesn't bother to wash his hands at work. If you are holding other people's data for them, you have a responsibility to do your best to keep the data safe. If you don't know how to do that and don't have time to learn, you can hire someone who…

And what about the responsibility to not destroy someone's property? Do you have the same opinion about shoplifters walking away with merchandise? Would your argument be that there should be armed guards and searches in every retail store? Isn't it reasonable that a thief be criticized and penalized for their actions even if the theft was "easy" to commit and is it OK to blame the victim for not being prepared?

Agree with nkrisc -- this is like, if I contracted with a storage company, and then my stuff was vandalized because the company's "secure storage location" was an unlocked box out on the sidewalk. Obviously the vandal is directly to blame, but it's also absolutely negligence from the company.

I'm sympathetic for the people who were only storing their own data, but not for companies that failed to safeguard their customers' data. If I borrow stuff from friends, I take better care of it than if it were mine. I hold companies to the same standard.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#162
post #134

Earlier quoted context omitted.

You are suggesting that it was just "keys" but that isn't the case here. You don't know what type of data is being destroyed. A better example might be a storage unit service that left the front gate unlocked. If someone torches the place to illustrate that they need better security would you be comfortable with that? Isn't there a better approach that we should encourage or is OK to encourage people to destroy thing…

Maybe. However, if this was my diary or photoalbum, bank statements, medical reports or anything of that sort I’d rather have them destroyed than knowing that they may have been copied... The lesson is not for the people, it’s for the companies that take shortcuts to save money. It for the MBA’s that think things don’t have to be properly engineered.

So you are rationalizing a crime because it teaches companies a lesson? That is a crazy rejection of the rule of law. Would you be comfortable in applying that logic to all crimes?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#164
post #84

Earlier quoted context omitted.

It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? The company could take a huge financial hit and people might lose their jobs because of their practices being exposed.

Sometimes the best path forward does harm, sure. It's just hard for me to agree that deleting these databases is the harm-minimizing path. One example of a less harmful path that comes to mind immediately is installing a random password on the unsecured database and emailing the domain owner the password. That would cause downtime but it would limit the irreversible damage. You could even say that you will delete the…

Or just set everyone's password to the same thing eg SecureMe

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#166
post #16

Earlier quoted context omitted.

This also affected people who use software for things other than businesses. People with IoT apps for their home, researchers, etc. Our field is vast and there is a large variance in people just using the basics of CS and those who keep up with standards and best practices, etc. Your statement is basically akin to someone saying that it’s fine for people to get robbed if they went out with their wallet; or worse.. ki…

Yeah. I don't care if some big business loses their Elasticsearch data and their site stops working until they get it secured and re-hydrated with data from their relational database. Good, they learned a lesson. But I would feel bad if someone's small business had to shut down or lose a bunch of money because they lost all their customer data. I'd feel bad if someone lost all the data they'd been using for a persona…

I'm not sure wiping out data from these unsecured databases is the answer, but even for amateur installations which have data of no relevance, the database could be used for nefarious things or the machine itself it runs on could be taken over and used for things such as DDOS attacks.

In that sense, receiving a strong notification that your compute is available to anyone and you should secure it is a good thing.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#167
If this turns out to be an effective lesson on security, systems should implement their own meow to protect their users.

E.g. A database That intentionally removes itself if the default password/an insecure password is used, with an easy-to-follow guide in error log on how to properly configure it.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#168
post #110

Earlier quoted context omitted.

So is deleting a database. Putting a password and emailing the admin would solve the password problem. But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.

The problem is with the e-mailing part. A mom&pop is unlikely to track you down if you lock out their DB, but they'll likely report you to police if you contact them about it.

Is an email from an anonymous address easier to trace than remote database commands?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#169
post #146

Earlier quoted context omitted.

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…

What happens when mom & pop are storing your name and credit card # in plain text and then your identity gets stolen and credit ruined? Should we still be "charitable" to them and their d-bag nephew?

Your credit card number being stolen is a problem for your bank, not a problem for you. You can't steal someone's identity with a credit card number.

The concern in this case is when there is some social problem with being in Mom & Pop Inc's customer database. There are probably some people that buy some things that they don't want other people to know about. When the database gets hacked and you are linked to being their customer, that is the unfortunate and potentially damaging information leak. A credit card just gets reissued and the bank reverses the transaction. No big deal.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#170

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

The top-voted answer links to this HN page. I'm stuck in an infinite loop.

You should configure a timeout.
Post reply on HN