Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

91–100 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#91

Post by beermonster »

rank0 wrote: post #79
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Good luck! I appreciate your transparent account of the situation but what does it say about your company if your database got popped by a “script kiddie”?

Quite often people claim (for example talk talk) that they were attacked by a nation state. It often later transpires that it was a 16 year old from Croydon using a basic SQL injection vulnerability.

At least they’re being honest up front. but yes it does show a naivety and inexperience of basic security.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#92

Post by gumby »

serial_dev wrote: post #70
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Why do you call them "script kiddie" and not a hacker? IMO it's still a hacker even if the attack is not very sophisticated or even if you made a big security mistake.

No hacking skill or knowledge required to simply download and run someone else’s script. That’s why they are called “script kiddies”.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#93

Post by tedunangst »

wolverine876 wrote: post #4

These are crimes. Where is law enforcement? I am not sure why the public still gives them a pass and treats computer crimes differently. With the resources of the federal government, it shouldn't be hard to find and take down the criminals. Think of how easily the criminals exploit their victims - it is just as hard for the criminals to play defense as it is for everyone else.

Yeah, it's been more than hour. How dare the police not apprehend anyone yet!

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#94

Post by ocdtrekkie »

tkojames wrote: post #78
ocdtrekkie wrote: post #18

Earlier quoted context omitted.

Ultimately the solution is probably to begin to firewall off parts of the Internet by national boundaries. We should allow cross-country traffic where countries follow the same rules of order as we do. You can remove a lot of threats by just blocking every country you have no desire to reach people in. And if major hosting and cloud providers were restricted similarly such that foreign actors can't just rent US serve…

No this is not the right approach at all in my opinion. What stops someone from one of the countries using IP's from another? Teenagers in USA are gonna try and hack your stuff as well... I was one of them in my youth. You can't just block china and half ass your setup. You will get attacked from everywhere always. Anything you put on the internet is a target. Always has been always will be.

> What stops someone from one of the countries using IP's from another?

That's why this approach is only really complete if supported at a national level. Cloud providers in the US shouldn't be allowing foreign actors to rent them, for instance.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#95

Post by vngzs »

lmm wrote: post #81
vngzs wrote: post #75

Earlier quoted context omitted.

I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…

I agree with only the third of those. The other lessons I'd take would be: 1. Be cautious about trendy technologies that promise to make life easy - often they cut corners to do so, and often security is one of those corners 2. Use real authentication rather than network firewalling. Make your datastore TLS-only and require a valid client certificate to connect; that way it doesn't matter if it's exposed to the inter…

Yeah, there's the whole "zero trust" possibility which I didn't mention. If you do authentication/authorization really well, you can stop doing (2). For things like databases, I think it's better to treat them as if they _could_ be exposed to the open internet, without actually doing so. It's generally not the case that anyone on the internet needs to query your DBs.

As described, you're _only_ relying on client TLS to protect your database. What if the TLS key leaks? So you're down to one layer again - one mistake and it's game over. So maybe you need Hashicorp Vault so you can have client certificates with very short validity periods. So do you expose Vault to the Internet, so you can fetch your client certificate to query the DB? What if Vault has a bug? And it's turtles all the way down ...

I love zero trust designs. But I think saying you can just slap client TLS on the problem and be done is laying the foundation for a repeat of this event - however you look at it, you want redundancy in your security.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#96

Post by wjossey »

lmm wrote: post #81
vngzs wrote: post #75

Earlier quoted context omitted.

I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…

I agree with only the third of those. The other lessons I'd take would be: 1. Be cautious about trendy technologies that promise to make life easy - often they cut corners to do so, and often security is one of those corners 2. Use real authentication rather than network firewalling. Make your datastore TLS-only and require a valid client certificate to connect; that way it doesn't matter if it's exposed to the inter…

Respectfully, all of the suggestions are good, as are your two. But, segregating your public traffic and private traffic is an excellent way to prevent these sorts of issues from happening. While it doesn't prevent someone who's compromised your network from accessing the DB, it means someone can't fat finger a port and open a DB to the public internet.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#97

Post by beermonster »

jacquesm wrote: post #90
rank0 wrote: post #79

Earlier quoted context omitted.

Good luck! I appreciate your transparent account of the situation but what does it say about your company if your database got popped by a “script kiddie”?

It says more about Docker than anything else. This is an insane default setting, it's something that should have been fixed when it was first brought to their attention. Computer security is hard enough without loaded footguns like these lying around.

Debian has no firewall rules by default. Up until recently also home directory permissions that were not good for multi user systems. Both by design.

Defaults are often insecure but maximise interoperability or general usability. Look at Windows !

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#98

Post by haimez »

mannerheim wrote: post #88
haimez wrote: post #61

Earlier quoted context omitted.

And would you take that statement at face value from a company that just left their docker based mongo instance Internet public? It’s safe to assume that your info has already been leaked, but situations like this are why that assumption is safe.

I suppose we'll find out if/when the data will be leaked as the hacker claims?

If you give out your personal information to, for example, newsblur- the odds are very, very good that this wasn’t the first time you’ve entrusted a company to protect your privacy, and whether you realize it yet or not- you have already been sorely disappointed.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#99

Post by wjossey »

vngzs wrote: post #75
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…

Just want to yes and you.

In general, put everything in private subnets, and make the only way any traffic can get to a server is through a load balancer. There are very few reasons to have a server itself have its own public IP address, and using your load balancer as a chokepoint, means you can set up layers and layers of redundancy to prevent traffic from ever being able to reach a database under your control.

This holds true whether we're talking RDS DBs, something you've spun in a K8 cluster, or something you're running on a vanilla compute box.

Assume you will screw up at some point and open up a port that shouldn't be. Ask yourself, "what's the impact here?" If you're OK, even with a fat fingered port, great.

Assume you will have a dev deploy a DB without a password. "What's the impact here?" If you're ok, even without a password, great!

That isn't to say that the above two scenarios are something you should tolerate, but automation can help detect these sorts of issues and make it easy for you to resolve them. While that automation is running, you want to make sure you're not going to get owned.

Kudos to the OP for sharing their story. Always lots to learn on this front, and we can always get better at our cloud operations.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#100

Post by thrashh »

vngzs wrote: post #95
lmm wrote: post #81

Earlier quoted context omitted.

I agree with only the third of those. The other lessons I'd take would be: 1. Be cautious about trendy technologies that promise to make life easy - often they cut corners to do so, and often security is one of those corners 2. Use real authentication rather than network firewalling. Make your datastore TLS-only and require a valid client certificate to connect; that way it doesn't matter if it's exposed to the inter…

Yeah, there's the whole "zero trust" possibility which I didn't mention. If you do authentication/authorization really well, you can stop doing (2). For things like databases, I think it's better to treat them as if they _could_ be exposed to the open internet, without actually doing so. It's generally not the case that anyone on the internet needs to query your DBs. As described, you're _only_ relying on client TLS…

All internal services should be protected, even on your home network.

If you have 100 devices on a network where everything is unprotected, that’s 100 different ways someone can try to get full access to 99 other devices.

Post reply on HN