Not to be disrespectful it is there a more reputable source that doesn’t jackhammer ads down the users throat every other paragraph?
New ‘Meow’ attack has deleted almost 4k unsecured databases
421–430 of 544 posts
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#422Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.
I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…
Depending on what data is being deleted, not deleting it could also have significantly worse consequences when it later falls into the wrong hands.
In the case of the spin studio, you can prove what you paid, the owner just lost his evidence of what he no longer owes you, and will hopefully in the future stop exposing your personal data on the Internet.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#423Earlier quoted context omitted.
Seriously this is the most annoying thing ever, especially if someone on your team things you need to expose the ports to redis in a docker compose. I’ve come back from a weekend where my redis instance was being used for crypto mining. Anything that is insecure by default in 2020 should be killed off IMO.
Secure by default is super onerous though. What if I just want to try out something before committing to it, do I really need to jump through a bunch of security hoops?
Of course you don't need to waste time setting up security properly. And it's such a pain locking and unlocking your car and your house every time you go in and out too. Tell me, where do you live again?
I'm 58 and bald, so channeling yoda is easy: a valuable lesson you need to learn, and learn it the cheap way or the expensive way you can.
The cheap way is to invest in a cheap VPS for a month, fire up sshd and a webserver, and then check the logs when the month is up.
The expensive way is to carry on treating security as an afterthought. It'll cost you your pride, your reputation, and possibly your career.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#424I wonder what proportion of these are just PII that should never have been collected in the first place?
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#425Not to be disrespectful it is there a more reputable source that doesn’t jackhammer ads down the users throat every other paragraph?
If you see ads on that page you are interneting wrong. I'd really encourage you to install an adblocker.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#426Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol
This edit is speculation. > I'm running an elastic search for a personal project on google-cloud and I use as a search index for my application. He very clearly says it’s a personal project. Trying to learn new topics outside of your direct responsibilities, while employed, is very common in the software industry. Not everyone that works at a company is involved in databases at that company.
I wonder how many of the deleted databases are just people learning with databases of dummy data?
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#427Earlier quoted context omitted.
> You realize you can’t get to a private IP address over the Internet right? Of course you can - most end users have private IP addresses these days, yet they somehow manage to communicate with people on the internet. A private IP address is of course not routable directly on the Internet. But routers route, and can certainly route a packet from the public internet to an RFC 1918 private address. If the routers on th…
In the case of the attack in question - how would they have initiated a command to erase the ElasticSearch cluster from the Internet? Any NAT would be stateful and the communication would have had to be initiated from the cluster. Not having a public IP address is not about “obscuring” the IP address. It’s not like so said why didn’t they have ES listening on a non standard port.
> Any NAT would be stateful and the communication would have had to be initiated from the cluster.
Only if the router is configured that way - and you don't need NAT to configure it like that. If the router is open then you just set the destination address to the address of the server you want it to go to. (As for getting it to the router you either find a way onto the same segment, explicitly specify it as a routing hop, use ip-in-ip...).
NAT is not a security mechanism. Often the same device does both, but they are separate functions.
> Not having a public IP address is not about “obscuring” the IP address. It’s not like so said why didn’t they have ES listening on a non standard port.
It's exactly like that!
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#428Earlier quoted context omitted.
> The only thing I find weird is that ElasticSearch itself does not offer a way to handle authentication, it was just enabled by a plugin that was paid (it seems like its free now). "Wierd" is an interesting euphemism for "irresponsible." Defaults are very important. Insecure by default is insecure for 90+% of deployments.
I have _some_ sympathy for ElasticSearch and Redis, having designed/built their software under the assumption it isn't ever intended to be publicly accessible over the internet. I have a bunch of fairly important personal documents in a filing cabinet with no lock. And I'm perfectly fine with that. I wouldn't keep it in my front yard, because that's obviously stupid, but keeping it inside behind my locked door and up…
If your assumptions are repearedly demonstrated invalid they are wrong.
Change them.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#429Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol
If meant as a public service, it would have been much less destructive to use the change passwords API [0] to set random passwords for all of the users. [0] https://www.elastic.co/guide/en/elasticsearch/reference/curr...
Given that "unsecured" means "data are accessible and modifiable by anyone", creating tremendous externalities for all referenced in the data, , I'm happy with deletion.
FTA:
One of the first publicly known examples of a Meow attack is an Elasticsearch database belonging to a VPN provider that claimed not to keep any logs.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#430Earlier quoted context omitted.
In the case of the attack in question - how would they have initiated a command to erase the ElasticSearch cluster from the Internet? Any NAT would be stateful and the communication would have had to be initiated from the cluster. Not having a public IP address is not about “obscuring” the IP address. It’s not like so said why didn’t they have ES listening on a non standard port.
> Any NAT would be stateful and the communication would have had to be initiated from the cluster. Only if the router is configured that way - and you don't need NAT to configure it like that. If the router is open then you just set the destination address to the address of the server you want it to go to. (As for getting it to the router you either find a way onto the same segment, explicitly specify it as a routing…
Only if the router is configured that way - and you don't need NAT to configure it like that. If the router is open then you just set the destination address to the address of the server you want it to go to. (As for getting it to the router you either find a way onto the same segment, explicitly specify it as a routing hop, use ip-in-ip...).
So if someone purposefully for some reason goes in and configures their router to map a port to a specific internal IP address to allow internet traffic to their ES cluster it isn’t secure? Isn’t that kind of stretch? If I posted the root credentials to my AWS account and turned off MFA that would be insecure also. Does that also mean I’m depending on “security through obscurity”?
It's exactly like that!
So am I also “obscuring” my IP address when I am testing an API locally and I configure it to only listen on 127.0.0.1:3000? Oh no, I just told you my IP address!
Everything you mentioned could only be done if an inside malicious actor purposefully made it insecure.