Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

291–300 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#291

Post by hamandcheese »

tyre wrote: post #156
bmcahren wrote: post #102

Earlier quoted context omitted.

This is why we are refactoring our database to be able to migrate to Amazon documentdb from MongoDB. Encryption at rest.... Pay up!

Curious, why do you use Mongo? Does it give you something that a JSONB column in Postgres wouldn’t?

I use jsonb heavily. While it is amazing, I definitely wouldn’t rely on it as a general purpose replacement for NoSQL/schemaless data storage.

An example of an issue I am dealing with currently: while you can create a gin index to speed up containment queries, Postgres doesn’t keep any statistics about jsonb columns. This means the query planner will sometimes do stupid things, like using the index even for very non-selective overlap conditions, which is a lot slower than just doing a sequential scan.

Less of an issue for me but worth considering: the size of the gin index in my use case seems to be about 5x bigger than the size of the unindexed data. I was surprised by the size increase. I only use the containment operator so I could make a smaller/faster index using the jsonb_path_ops operator class. This is on my todo list :)

Like all non-btree indexes in Postgres, the index is unordered. That means sorting by values in the jsonb column will always be slow. This doesn’t matter for selective queries, but exacerbates my already slow non-selective queries that return large result sets.

That said, if your queries are selective, jsonb + gin indexes are surprisingly performant (in the 0.5-10ms range for small result sets). My use case is a mix of structured relational data with jsonb for user-defined values (which of course they want to use for querying/sorting and I was dumb enough to say “sure, why not?”)

In terms of the magnitude of data, there’s roughly 10 million rows. Each team using this service has the query scoped to about 500k-1 million records, and then additional filters (on the jsonb column) will scope that down to anywhere between 60k-0 results.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#292

Post by cryptoz »

pietroglyph wrote: post #254
user5994461 wrote: post #74

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.

Vandalism is not a good public service.

> I’d much rather have my data deleted until it’s secured than have it stolen by someone else

There are multiple logical fallacies in this sentence. First is the use of the world 'until' which is ambiguous here; it suggests that your data can be 'undeleted' after the DB has been secured or you would rather not have any data stored anywhere that is not secured. Either option to me seems like an incorrect read of your comment but I'm not sure. And "than have it stolen by someone else" seems to imply that you know that this data was never copied and cannot be stolen still. I think that seems incorrect, unless there is something I missed that assures everyone that the data could not have been stolen during these hacks.

Lastly, your personally preferred outcome for your personal data is not a measure for all of society, but you grant it that "public service" label as if your preference matters above everyone else's. You don't know what other people think about their data. You don't know what the data even is. What if some of it was just a hobby project for someone, with no financial implications of unsecured data or of data loss, but with emotional attachment to their data? Do they not matter to you?

A blind deletion of unknown data belonging to unknown people is not a public service.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#293

Post by zentiggr »

gwright wrote: post #218
sinsterizme wrote: post #144

Earlier quoted context omitted.

I think the major difference is that losing my house along with all my belongings is much worse than losing just some of my belongings. Also data being exposed publicly can be used nefariously by multiple parties, so is likely worse in most scenarios compared to just outright deletion of the data

Ok, but losing "just some of your belongings" is bad also, right? When thinking about the culpability of the person deleting the data or storing the data, we have to start from the assumption that the owner of the data values it. Whatever analysis you want to put on the situation I don't think it is reasonable to start with the idea that some of the data might not be that valuable.

Either the data is something public (name, address, etc) in which case, whatever.

Or it's data that was gathered (in line of business, for example) and its destruction is anywhere from more secure to an inconvenience.

Or it's data that was aggregated beyond legitimate use (hey, FAANG) and by all means, tear it the hell up and throw it away.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#294

Post by lotsofpulp »

gowld wrote: post #187
jrockway wrote: post #169

Earlier quoted context omitted.

Your credit card number being stolen is a problem for your bank, not a problem for you. You can't steal someone's identity with a credit card number. The concern in this case is when there is some social problem with being in Mom & Pop Inc's customer database. There are probably some people that buy some things that they don't want other people to know about. When the database gets hacked and you are linked to being…

It's a problem for the vendors, not the banks. They get hit with chargebacks for fraud that's no fault of their own, hurting the whole ecosystem of vendors and their customers. https://www.thestreet.com/personal-finance/credit-cards/cred...

The problem could be easily solved by Visa/MC/Discover/Amex implementing chip and pin, or at least 2FA SMS authorization. Bestbuy.com has it working somehow.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#295

Post by dilandau »

rectang wrote: post #27

If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…

What about developers just being competent before deploying a database on the public internet?

At least google "securing X" before just pumping data in.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#296

Post by dt3ft »

After having read a number of articles talking about data leaks on a gigantic scale, I decided to check it out. Because shodan is not free to use/behind a paywall, I wrote a simple windows console tool which scans all known Azure subnets for unsecured elasticsearch instances and logs the results. I was baffled by the amount of instances this tool found within the first few hours :( To say that security in IT is getting out of control would be an understatement...

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#297

Post by red0point »

inetknght wrote: post #202
red0point wrote: post #185

Earlier quoted context omitted.

1) If it‘s a tree, it ain‘t got no loops 2) The stack isn‘t to deal with loops, the „visited“ flag at each edge is there for that. The stack (for DFS, BFS would be a queue) is there to keep track of which nodes have been visited such that you can construct a path from the starting node to the one you‘re looking for. Obviously there are variants to this, depending on what you‘re actually trying to achieve with it. My…

1) you're right, I edited my message to reflect that I meant a graph traversal algorithm. 2) a visited flag on an edge? That won't support simultaneous traversals. Keeping a stack is a lot more efficient than permitting only one traversal at a time.

I‘m not sure why you‘re bringing concurrency to the table.

My point still is that looking something up in a stack (did I visit this node?) costs O(n) time, so the BFS will degrade from O(m+n) to O(m*n+n).

To come back to the concurrency, if you can index your edges in some way, you can also store the visited flag in a separate datastracture to support concurrent access (one „flag store“ for each access).

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#298

Post by atyppo »

acdha wrote: post #107
Wowfunhappy wrote: post #93

Earlier quoted context omitted.

What if it was a small business's inventory data rather than customer data? Seems to me, there are a lot of things businesses could store in a database which don't necessarily need to be private, or which at worst won't harm anyone other than the database creator if exposed.

That’s why I was specific about customer data: it’s basically a question of who’s harmed - if the cost is borne by the person cutting corners it’s more of a self-correcting problem.

It's not a matter of "cutting corners." Think of all of the small businesses that recently moved online due to store closures. These businesses simply do not have the budget required to create something comparable to, say, Best Buy's e-commerce. Sure, Shopify might come close, but how do you think Mom and Pop will find and create an e-commerce solution?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#299

Post by steffan »

hinkley wrote: post #230
b123400 wrote: post #167

If this turns out to be an effective lesson on security, systems should implement their own meow to protect their users. E.g. A database That intentionally removes itself if the default password/an insecure password is used, with an easy-to-follow guide in error log on how to properly configure it.

If memory serves, Postgres will only listen on 127.0.0.1 unless the admin password has been set. All software should work like that.

MongoDB listens only on localhost by default since 3.6 (2017)
Post reply on HN