Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

31–40 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#31

Post by toomuchtodo »

ocdtrekkie wrote: post #18
dfadsadsf wrote: post #11

Earlier quoted context omitted.

Actually federal government resources are pretty limited and finding hackers is hard. What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country. Even if country if friendly, extradition is expensive and time consuming. After all that you may end up putting random 20 year old guy in jail for a few years without putting any dent in…

Ultimately the solution is probably to begin to firewall off parts of the Internet by national boundaries. We should allow cross-country traffic where countries follow the same rules of order as we do. You can remove a lot of threats by just blocking every country you have no desire to reach people in. And if major hosting and cloud providers were restricted similarly such that foreign actors can't just rent US serve…

You’re not wrong. If you don’t have a business need to talk to some IP blocks and AS’, by all means, black hole traffic from jurisdictions who aren’t going to do diddly when someone causes you harm. I see this often with client WAF configurations depending on the endpoint use case and who is expected to be hitting that endpoint. “You’re blocking everyone outside of North America?” “Yes, we’re comfortable with that as a business decision.” (fintech)

It doesn’t solve the problem, but it’s low hanging fruit, and a few checkboxes (or lines of Terraform) if you’re at a cloud provider and using the usual primitives.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#33

Post by qbasic_forever »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Oooph, good luck. And when you have time please make Docker aware that this well known foot-gun has finally done serious harm. They have known and ignored for years that iptables/ufw on Linux is totally broken and wide open when using Docker: https://github.com/moby/moby/issues/4737

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#34

Post by conesus »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

In case anybody's interested, here's what the "hack" looks like:

    nbset:PRIMARY> show dbs
    READ__ME_TO_RECOVER_YOUR_DATA   0.000GB
    admin                           0.000GB
    local                          16.471GB
    newsblur                        0.718GB
    
    nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA
    switched to db READ__ME_TO_RECOVER_YOUR_DATA
    
    nbset:PRIMARY> show collections
    README
    system.profile
    
    nbset:PRIMARY> db.README.find()
    { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All your data is a backed up. You must pay 0.03 BTC to XXXXXXFTHISGUYXXXXXXX 48 hours for recover it. After 48 hours expiration we will leaked and exposed all your data. In case of refusal to pay, we will contact the General Data Protection Regulation, GDPR and notify them that you store user data in an open form and is not safe. Under the rules of the law, you face a heavy fine or arrest and your base dump will be dropped from our server! You can buy bitcoin here, does not take much time to buy https://localbitcoins.com or https://buy.moonpay.io/ After paying write to me in the mail with your DB IP: FTHISGUY@recoverme.one and you will receive a link to download your database dump." }

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#35

Post by ncmncm »

Joke's on them. People who use Mongo use it mostly because their data doesn't matter very much, even to them. Deleting it just saves them time cleaning it out.

It's like stealing their garbage off the curb. The only valuable part is the can.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#36

Post by squeaky-clean »

dawnerd wrote: post #22
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

This actually got me a while ago but with redis and some script kiddy turning my dev server into a bitcoin miner. Anyone else running docker and using iptables really needs to read this https://docs.docker.com/network/iptables/

Almost exactly the same thing has happened to me except Selenium and they were trying to log into Playstation Network accounts.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#37

Post by DevX101 »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Put passwords on your production databases. Even if it's behind a firewall.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#38

Post by [deleted] »

conesus wrote: post #34
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…

[deleted]

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#39

Post by steventhedev »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

I'm sorry to hear that you got bit by the docker networking thing. It bit me twice in the past. Once with a new server and once when they changed the config format from envvars to json (we were disabling dockers iptables nonsense).

Do you know if they simply encrypted the data in place or if they succeeded in exfiltrating a full copy?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#40

Post by naikrovek »

elliekelly wrote: post #15
naikrovek wrote: post #7

Earlier quoted context omitted.

difficult or impossible to locate, then catch. don't know the first thing about how to even collect evidence to aid in prosecution. don't know what crime has happened. no one died. probably from another country and "that ain't my jurisdiction" lazy etc.

The Computer Fraud and Abuse Act. And I can assure you the DOJ & FBI are more than capable of collecting evidence to aid in prosecution. The problem is the criminals often located in jurisdictions that “look the other way” with respect to cyber crimes committed against companies and people in other countries. So prosecuting the criminals is a whole lot of paperwork for a whole lot of nothing to happen. It’s not as th…

yes they are, but they don't answer when you call 911, do they? local police fumble around with this kind of thing every day, and crimes go unpunished thousands of times a second, every second, of every day.
Post reply on HN