Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

61–70 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#61

Post by haimez »

xref wrote: post #50
pmontra wrote: post #46

Earlier quoted context omitted.

> you face a heavy fine or arrest Heavy fine yes but not arrest AFAIK. Anyway this is a script programed to scary the target. Do you even store personal data inside that database?

From their Twitter feed: mongodb is just RSS feed data, personal data is in postgres and wasn’t accessible to the script kiddy

And would you take that statement at face value from a company that just left their docker based mongo instance Internet public? It’s safe to assume that your info has already been leaked, but situations like this are why that assumption is safe.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#62

Post by steffan »

haimez wrote: post #42
fiddlerwoaroof wrote: post #26

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=27613661

Right. Maybe someday, with enough public shaming in situations like this, mongo will reconsider those defaults. Or not, maybe their best potential customers should continue to get burned publicly in incidents that have a direct line to their poor decisions.

Defaults have long been changed to prevent listening on 0.0.0.0 by default; this has been the case since May of 2017, over 4 years ago. In order for this to occur, a user has to explicitly turn on listening on all interfaces.

In conjunction with this, prudence would dictate that you enable authentication as well. In this case, it seems that reliance was placed on Docker to maintain iptables settings to disallow connections from untrusted IPs and that iptables setting was reset.

As always, defense in depth is a good strategy; authentication in addition to firewall rules would have prevented this.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#63

Post by asteroidbelt »

qbasic_forever wrote: post #21
asteroidbelt wrote: post #16

One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.

Companies get around that by hiring a security 'consultant' or other firm to pay the ransom. Conveniently the cost of the consultant is exactly the ransom. It's enough legal cover for the company to release statements like "XYZ corp is not negotiating or paying the ransom."

Then consultants go to jail. And if these consultants are in China or some other country, then the law can be formulated in a way someone should go to jail.

Top managers will deny everything, but FBI will start investigations, the will be a whistleblower, and eventually FBI will offer a deal to some middle manager to testify in court that top managers knew that "consultants" were actually hackers.

This will be enough to greatly discourage stakeholders to participate in paying to these consultants even indirectly.

Maybe it won't work perfectly, but at least it will make paying more risky, more expensive, thus less often.

Sanctions work the same way. You can't deal with a company who is under sanctions, and if you try to use some intermediary to get around sanctions, you can still be fined at least.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#64

Post by arp242 »

ocdtrekkie wrote: post #18
dfadsadsf wrote: post #11

Earlier quoted context omitted.

Actually federal government resources are pretty limited and finding hackers is hard. What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country. Even if country if friendly, extradition is expensive and time consuming. After all that you may end up putting random 20 year old guy in jail for a few years without putting any dent in…

Ultimately the solution is probably to begin to firewall off parts of the Internet by national boundaries. We should allow cross-country traffic where countries follow the same rules of order as we do. You can remove a lot of threats by just blocking every country you have no desire to reach people in. And if major hosting and cloud providers were restricted similarly such that foreign actors can't just rent US serve…

Some services do this. I live in Indonesia at the moment and there are various Dutch websites I can't access: I can't view the website of a political party for example, and I can't access newyorkpizza.nl either to unsubscribe from their stupid newsletter emails (I just blackholed them, but still). I also couldn't view their data breach announcement from a few weeks ago. Some news websites block foreign access as well.

ACM also blocked a lot of Indonesian IP addresses (because "infiltrated by sci-hub" according to their support, but since carried-grade NAT is ubiquitous here you end up blocking vast swaths of the country).

All in all, it's really annoying.

Yeah, you're going to stop various bad actors with this – no denying that – but you're also going to block your own nationals who happen to be abroad. Especially for a lot of critical services (banks, gov't, etc.) it's pretty much a non-starter.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#65

Post by zylent »

whalesalad wrote: post #56

This is one reason why most of my services are inaccessible from the public internet by design (on private subnets). Live and learn.

Zero reason to have database servers with an internet connection. These days you can ship in an entire environment with containers into borderline air gapped environments.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#66

Post by bushbaba »

dawnerd wrote: post #22
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

This actually got me a while ago but with redis and some script kiddy turning my dev server into a bitcoin miner. Anyone else running docker and using iptables really needs to read this https://docs.docker.com/network/iptables/

I’m kind of shocked this is even deemed acceptable architecture. You’d think docker wouldn’t even touch iptables unless explicitly told to.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#67

Post by dawnerd »

qbasic_forever wrote: post #44
dawnerd wrote: post #22

Earlier quoted context omitted.

This actually got me a while ago but with redis and some script kiddy turning my dev server into a bitcoin miner. Anyone else running docker and using iptables really needs to read this https://docs.docker.com/network/iptables/

The insidious thing is that there's no indication, failure, log or anything to tell you something is out of the ordinary either. It would be one thing if it just exploded and failed to run, but it's even worse that it silently interacts with iptables & ufw to allow all the traffic through. The exact opposite of what you want or intended.

Only reason I noticed was a command was taking slightly longer than normal and I checked htop and saw redis using 100% cpu. Absolutely insane this is the Docker default.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#68

Post by aledalgrande »

toomuchtodo wrote: post #31
ocdtrekkie wrote: post #18

Earlier quoted context omitted.

Ultimately the solution is probably to begin to firewall off parts of the Internet by national boundaries. We should allow cross-country traffic where countries follow the same rules of order as we do. You can remove a lot of threats by just blocking every country you have no desire to reach people in. And if major hosting and cloud providers were restricted similarly such that foreign actors can't just rent US serve…

You’re not wrong. If you don’t have a business need to talk to some IP blocks and AS’, by all means, black hole traffic from jurisdictions who aren’t going to do diddly when someone causes you harm. I see this often with client WAF configurations depending on the endpoint use case and who is expected to be hitting that endpoint. “You’re blocking everyone outside of North America?” “Yes, we’re comfortable with that as…

How does that protect you from VPNed traffic? Or residential proxies? Local botnets?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#69

Post by qbasic_forever »

bushbaba wrote: post #66
dawnerd wrote: post #22

Earlier quoted context omitted.

This actually got me a while ago but with redis and some script kiddy turning my dev server into a bitcoin miner. Anyone else running docker and using iptables really needs to read this https://docs.docker.com/network/iptables/

I’m kind of shocked this is even deemed acceptable architecture. You’d think docker wouldn’t even touch iptables unless explicitly told to.

It's how they can make containers feel like isolated little subnets without resorting to vxlan or other kernel-level stuff. It's a great development experience and I'd be sad to see it go. But.... it really needs to proactively detect and warn users. The issue has been known for many years. A quick little check and error out on startup if you're running on Ubuntu or have ufw enabled would probably save 99% of the pain people have had with it over the years.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#70

Post by serial_dev »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Why do you call them "script kiddie" and not a hacker? IMO it's still a hacker even if the attack is not very sophisticated or even if you made a big security mistake.
Post reply on HN