Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

11–20 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#11

Post by dfadsadsf »

wolverine876 wrote: post #4

These are crimes. Where is law enforcement? I am not sure why the public still gives them a pass and treats computer crimes differently. With the resources of the federal government, it shouldn't be hard to find and take down the criminals. Think of how easily the criminals exploit their victims - it is just as hard for the criminals to play defense as it is for everyone else.

Actually federal government resources are pretty limited and finding hackers is hard. What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country. Even if country if friendly, extradition is expensive and time consuming. After all that you may end up putting random 20 year old guy in jail for a few years without putting any dent into overall number of hacking attacks.

True cost of each investigation is probably in the millions so investigating hacking of random small company is probably not high on the list of priorities. Evidence that can hold up in the court are hard to come by.

With all the talk about Russian hackers hacking Dem Party, elections, etc, there are zero people in the jail and zero evidence presented that it was even Russians. So it's hard.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#12

Post by steffan »

crazysim wrote: post #9
steffan wrote: post #6

Earlier quoted context omitted.

Sorry to hear this, jepler - please let me know if there's anything I can do to assist (MongoDB emp. in unofficial capacity). Email in profile Update: emailed Samuel directly

jepler isn't the Newsblur guy.

Thanks, crazysim

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#13

Post by [deleted] »

steffan wrote: post #6
jepler wrote: post #2

10:35p ET: Looks like the snapshot will take 10 hours to make. Ordinarily this wouldn't be a problem becuase the service is running and a snapshot would be made on a secondary DB. But all of the Mongo DBs faithfully deleted their data, so I'm taking a snapshot of a recent good backup. Once done, I can replicare the DB and we'll be back. 9:54p ET: Holy moly, when I switched to a new Mongo DB server, a hacker deleted a…

Sorry to hear this, jepler - please let me know if there's anything I can do to assist (MongoDB emp. in unofficial capacity). Email in profile Update: emailed Samuel directly

[deleted]

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#14

Post by paxys »

wolverine876 wrote: post #4

These are crimes. Where is law enforcement? I am not sure why the public still gives them a pass and treats computer crimes differently. With the resources of the federal government, it shouldn't be hard to find and take down the criminals. Think of how easily the criminals exploit their victims - it is just as hard for the criminals to play defense as it is for everyone else.

The law enforcement you are talking about has no jurisdiction in the regions the hackers operate out of.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#15

Post by elliekelly »

naikrovek wrote: post #7
wolverine876 wrote: post #4

These are crimes. Where is law enforcement? I am not sure why the public still gives them a pass and treats computer crimes differently. With the resources of the federal government, it shouldn't be hard to find and take down the criminals. Think of how easily the criminals exploit their victims - it is just as hard for the criminals to play defense as it is for everyone else.

difficult or impossible to locate, then catch. don't know the first thing about how to even collect evidence to aid in prosecution. don't know what crime has happened. no one died. probably from another country and "that ain't my jurisdiction" lazy etc.

The Computer Fraud and Abuse Act. And I can assure you the DOJ & FBI are more than capable of collecting evidence to aid in prosecution. The problem is the criminals often located in jurisdictions that “look the other way” with respect to cyber crimes committed against companies and people in other countries. So prosecuting the criminals is a whole lot of paperwork for a whole lot of nothing to happen. It’s not as though Russia or North Korea are going to extradite their own citizens to the US to stand trial.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#17

Post by edgyquant »

bsder wrote: post #10
wolverine876 wrote: post #4

These are crimes. Where is law enforcement? I am not sure why the public still gives them a pass and treats computer crimes differently. With the resources of the federal government, it shouldn't be hard to find and take down the criminals. Think of how easily the criminals exploit their victims - it is just as hard for the criminals to play defense as it is for everyone else.

> These are crimes. Where is law enforcement? No money so no incentive. Notice, however, when an "oil pipeline" had their billing software hacked everybody went apeshit.

Downvoted but correct. The oil pipeline was a matter of nation security though (a decent chunk of the northeast was effected) but you’re right within a week or two the government seized BTC accounts.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#18

Post by ocdtrekkie »

dfadsadsf wrote: post #11
wolverine876 wrote: post #4

These are crimes. Where is law enforcement? I am not sure why the public still gives them a pass and treats computer crimes differently. With the resources of the federal government, it shouldn't be hard to find and take down the criminals. Think of how easily the criminals exploit their victims - it is just as hard for the criminals to play defense as it is for everyone else.

Actually federal government resources are pretty limited and finding hackers is hard. What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country. Even if country if friendly, extradition is expensive and time consuming. After all that you may end up putting random 20 year old guy in jail for a few years without putting any dent in…

Ultimately the solution is probably to begin to firewall off parts of the Internet by national boundaries. We should allow cross-country traffic where countries follow the same rules of order as we do.

You can remove a lot of threats by just blocking every country you have no desire to reach people in. And if major hosting and cloud providers were restricted similarly such that foreign actors can't just rent US servers to stage attacks from...

I'm aware this is an unpopular opinion amongst tech crowds, but it's impossible to maintain order in an environment where some people have to obey the law and some people don't.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#19

Post by SamReidHughes »

asteroidbelt wrote: post #16

One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.

Another option is to add a 900% tax on ransom payments, owed by the payer. It would either lower the price of ransoms or get less of them paid. I don't know why that would be better than prohibition, but it would be funnier.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#20

Post by conesus »

NewsBlur's founder here. I'll attempt to explain what's happening.

This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and soon ML models).

About two hours before this happened, I switched the MongoDB cluster over to the new servers. When I did that, I shut down the original primary in order to delete it in a few days when all was well. (Thank goodness I did that! It'll come in handy a few hours from now).

Turns out the ufw firewall I enabled and diligently kept on a strict allowlist with only my internal servers didn't work on a new server because of Docker. When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world. So while my firewall was "active", doing a `sudo iptables -L | grep 27017` showed that MongoDB was open the world. More info on SO[1].

To be honest, I'm a bit surprised it took over 3 hours from when I flipped the switch to when a script kiddie dropped NewsBlur's MongoDB collections, and ransomed about 250GB of data. I am now running a snapshot on that old primary, just in case it reconnects to a network and deletes everything. Once done, I'll boot it up, secondary it out, and be back in business. Let's hope my assumptions hold.

[1]: https://stackoverflow.com/questions/30383845/what-is-the-bes...

Post reply on HN