Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

Post by ocdtrekkie » Thu, Jun 24, 2021, 3:47 AM UTC

toomuchtodo wrote: post #31

ocdtrekkie wrote: post #18

Earlier quoted context omitted.

Ultimately the solution is probably to begin to firewall off parts of the Internet by national boundaries. We should allow cross-country traffic where countries follow the same rules of order as we do. You can remove a lot of threats by just blocking every country you have no desire to reach people in. And if major hosting and cloud providers were restricted similarly such that foreign actors can't just rent US serve…

You’re not wrong. If you don’t have a business need to talk to some IP blocks and AS’, by all means, black hole traffic from jurisdictions who aren’t going to do diddly when someone causes you harm. I see this often with client WAF configurations depending on the endpoint use case and who is expected to be hitting that endpoint. “You’re blocking everyone outside of North America?” “Yes, we’re comfortable with that as…

Post by [deleted] » Thu, Jun 24, 2021, 3:48 AM UTC

ncmncm wrote: post #35

Joke's on them. People who use Mongo use it mostly because their data doesn't matter very much, even to them. Deleting it just saves them time cleaning it out. It's like stealing their garbage off the curb. The only valuable part is the can.

Post by 29athrowaway » Thu, Jun 24, 2021, 3:51 AM UTC

conesus wrote: post #34

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…

Post by [deleted] » Thu, Jun 24, 2021, 3:52 AM UTC

squeaky-clean wrote: post #36

dawnerd wrote: post #22

Earlier quoted context omitted.

This actually got me a while ago but with redis and some script kiddy turning my dev server into a bitcoin miner. Anyone else running docker and using iptables really needs to read this https://docs.docker.com/network/iptables/

Almost exactly the same thing has happened to me except Selenium and they were trying to log into Playstation Network accounts.

Post by mr_o47 » Thu, Jun 24, 2021, 3:56 AM UTC

29athrowaway wrote: post #27

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

There are search engines for services exposed to the internet, like https://www.shodan.io/ If your mongoDB server is exposed to the Internet it will show up there. When that happens, it's only a matter of time until someone targets you. You can write an alert that probes for sensitive services exposed to the Internet. In that way, if this happens again, you get an alert that you can use to detect the problem early. A…