Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

491–500 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#491

Post by josejuanisaac »

cryptoz wrote: post #292
pietroglyph wrote: post #254

Earlier quoted context omitted.

Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.

Vandalism is not a good public service. > I’d much rather have my data deleted until it’s secured than have it stolen by someone else There are multiple logical fallacies in this sentence. First is the use of the world 'until' which is ambiguous here; it suggests that your data can be 'undeleted' after the DB has been secured or you would rather not have any data stored anywhere that is not secured. Either option to…

I completely missed the poor consistency from the "I would rather" comment above. I would also prefer my data deleted and not stolen, but had to read your comment to realize there is no evidence to suggest that. It is funny how much I assume being at least partially aware of my ignorance of the topic.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#492

Post by JosephRedfern »

stedaniels wrote: post #460
nomel wrote: post #364

Earlier quoted context omitted.

This edit is speculation. > I'm running an elastic search for a personal project on google-cloud and I use as a search index for my application. He very clearly says it’s a personal project. Trying to learn new topics outside of your direct responsibilities, while employed, is very common in the software industry. Not everyone that works at a company is involved in databases at that company.

That was edited in afterwards. https://stackoverflow.com/posts/63067062/revisions whilst it very well may be a personal project, it certainly wasn't "very clear".

Maybe he edited it to clarify after strangers on the internet got him in trouble at work having implied that his employer had suffered a data breach?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#493

Post by CloudNetworking »

user5994461 wrote: post #289
pramodhs wrote: post #280

Earlier quoted context omitted.

I'm working on a personal project and not at all related to my work. I accidentally kept ports open :facepalm, sorting things out now :)

Recommend to setup two subnets in your project. One public and one private. This prevents this sort of issues, instances in the private subnet simply don't get a public IP, they can't be reached over the internet. For reference, the standard practice in a company is to have a (third) separate subnet for databases, with zero internet access (no NAT gateway). Connection must be explicitly opened from/to database client…

> It's a nightmare to manage on premise but it works really well in the cloud with firewalls allowing traffic based on instance tags.

It's not though. Subnetting and firewalling are like the foundation of any corporate network.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#494

Post by dredmorbius »

_-___________-_ wrote: post #486
KMag wrote: post #458

Earlier quoted context omitted.

But if they had used the password changes API to assign random passwords to all accounts, as suggested, then the data couldn't be modified. Am I missing something?

Parent's point is that any conclusion one could make from the data is worthless because, being public and unsecured, it could have been modified by any Internet user at any time before a password was set.

Correct.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#495

Post by Sebb767 »

BrandoElFollito wrote: post #478
1337shadow wrote: post #443

Earlier quoted context omitted.

If you have Docker then make sure you have a firewall on top of it, otherwise it will expose pretty much what any docker user wants !

What do you mean by that?

Docker uses it's own iptables rules which have priority over the system ones. Therefore, even if you have an iptables-based firewall blocking all ports, a docker service will still be reachable, unless configured not to be in docker itself.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#496

Post by BrandoElFollito »

Sebb767 wrote: post #495
BrandoElFollito wrote: post #478

Earlier quoted context omitted.

What do you mean by that?

Docker uses it's own iptables rules which have priority over the system ones. Therefore, even if you have an iptables-based firewall blocking all ports, a docker service will still be reachable, unless configured not to be in docker itself.

I do not understand what you mean by "priority over the system ones"

A docker container can have internal ports exposed explicitly, or use host networking. In any case these are ports exposed by the docker-proxy executable - an executable like any other on the system.

Then come the iptables rules of the system (which open or not data flow to the ports exposed by docker-proxy).

Or is it different?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#497

Post by BrandoElFollito »

BrandoElFollito wrote: post #496
Sebb767 wrote: post #495

Earlier quoted context omitted.

Docker uses it's own iptables rules which have priority over the system ones. Therefore, even if you have an iptables-based firewall blocking all ports, a docker service will still be reachable, unless configured not to be in docker itself.

I do not understand what you mean by "priority over the system ones" A docker container can have internal ports exposed explicitly, or use host networking. In any case these are ports exposed by the docker-proxy executable - an executable like any other on the system. Then come the iptables rules of the system (which open or not data flow to the ports exposed by docker-proxy). Or is it different?

Ah, now I get what you mean - that entries such as

    ACCEPT     tcp  --  anywhere             172.19.0.10          tcp dpt:8843
are created by docker, independently from the configuration of iptables themselves.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#499

Post by bpfrh »

jfk13 wrote: post #143
wolco wrote: post #110

Earlier quoted context omitted.

So is deleting a database. Putting a password and emailing the admin would solve the password problem. But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.

How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.

In the article one provider was notified that their database was without a password an publicly accessible.

They secured it, and somehow managed to make it publicly accessible again without password, this time it got hit by this attack.

Honestly this is like if a company decides to keep their paper records with my information on a public side walk, and somebody saw that and decided to bring them to the landfill.

Is it legal or fair? In a perfect world no, but at this point the company is not blameless.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#500

Post by 0xUser »

GekkePrutser wrote: post #48

It's not necessarily 'deleted', these Script Kitties just replaced some data with more valuable stuff. You can never have enough meows! But seriously, these guys are doing us a favour. You can bet the affected companies will not expose customer data again.

yup
Post reply on HN