Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

51–60 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#51

Post by ipython »

SamReidHughes wrote: post #19
asteroidbelt wrote: post #16

One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.

Another option is to add a 900% tax on ransom payments, owed by the payer. It would either lower the price of ransoms or get less of them paid. I don't know why that would be better than prohibition, but it would be funnier.

Unfortunately it looks like the exact opposite is occurring: https://apnews.com/article/technology-business-government-an...

The regularity of ransomware has apparently made the expense “ordinary” therefore now tax deductible. Shrug.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#52

Post by 29athrowaway »

mr_o47 wrote: post #49
29athrowaway wrote: post #27

Earlier quoted context omitted.

There are search engines for services exposed to the internet, like https://www.shodan.io/ If your mongoDB server is exposed to the Internet it will show up there. When that happens, it's only a matter of time until someone targets you. You can write an alert that probes for sensitive services exposed to the Internet. In that way, if this happens again, you get an alert that you can use to detect the problem early. A…

How does shodan works like how do they know if something is exposed to the internet. Are they scanning networks 24/7 I’m just a noob in security so therefore learning

They go through the entire ip address range scanning specific ports.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#53

Post by beprogrammed »

conesus wrote: post #34
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…

"XXXXXXFTHISGUYXXXXXXX" is right lol

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#54

Post by zootboy »

mr_o47 wrote: post #49
29athrowaway wrote: post #27

Earlier quoted context omitted.

There are search engines for services exposed to the internet, like https://www.shodan.io/ If your mongoDB server is exposed to the Internet it will show up there. When that happens, it's only a matter of time until someone targets you. You can write an alert that probes for sensitive services exposed to the Internet. In that way, if this happens again, you get an alert that you can use to detect the problem early. A…

How does shodan works like how do they know if something is exposed to the internet. Are they scanning networks 24/7 I’m just a noob in security so therefore learning

They do a monthly scan, with additional spot checks available on-demand:

https://help.shodan.io/the-basics/on-demand-scanning

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#55

Post by ralphington »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

What kind of database auth did you have? Wouldn't they have had to access config files or related in order to obtain your passwords, usernames, etc?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#57

Post by qbasic_forever »

tyingq wrote: post #5

In case anyone else was curious what NewsBlur is supposed to look like: https://web.archive.org/web/20210601112225if_/https://www.ne...

Newblur was one of the big alternatives and go-to options when Google Reader shut down their RSS reader. It's a great service.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#58

Post by narism »

qbasic_forever wrote: post #21
asteroidbelt wrote: post #16

One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.

Companies get around that by hiring a security 'consultant' or other firm to pay the ransom. Conveniently the cost of the consultant is exactly the ransom. It's enough legal cover for the company to release statements like "XYZ corp is not negotiating or paying the ransom."

Assuming paying ransoms were illegal[0], arranging for another party to pay it (commit an illegal act) would be an act of conspiracy.

[0] already being signaled: https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M...

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#59

Post by TameAntelope »

conesus wrote: post #34
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…

Curious this got downvoted so quickly, maybe your "hacker" is among us now!

Have you contacted the relevant authorities?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#60

Post by xmprt »

qbasic_forever wrote: post #21
asteroidbelt wrote: post #16

One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.

Companies get around that by hiring a security 'consultant' or other firm to pay the ransom. Conveniently the cost of the consultant is exactly the ransom. It's enough legal cover for the company to release statements like "XYZ corp is not negotiating or paying the ransom."

Sounds like there's an easy solution to that. Just don't allow ransom payments to be tax deductible.
Post reply on HN