Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

121–130 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#121

Post by watermelon0 »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

It seems that you are using DigitalOcean. They offer a cloud firewall [1], which sits in front of your droplets, and you can limit inbound ports to only the necessary ones (e.g. 80, 443, SSH).

I'm always using this with providers that support it, since I've managed to mistakenly open ports that should be private (either by misconfigured firewall, or due to the Docker "issue").

[1] https://docs.digitalocean.com/products/networking/firewalls/

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#122

Post by shakna »

pm90 wrote: post #108
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Is 3 hours a large time for an open server to be discovered? Do the attackers just have a giant list of ips that they constantly scan and can instantly know if it’s suddenly open to traffic?

ZMap claims to be able to scan the entire IPv4 space of the Internet in about 45mins. [0] There's no reason not to believe that claim, either.

With many people doing this, it is kind of surprising that it took so long for a vulnerable server to be discovered.

[0] https://zmap.io/

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#123

Post by vngzs »

pm90 wrote: post #113
vngzs wrote: post #95

Earlier quoted context omitted.

Yeah, there's the whole "zero trust" possibility which I didn't mention. If you do authentication/authorization really well, you can stop doing (2). For things like databases, I think it's better to treat them as if they _could_ be exposed to the open internet, without actually doing so. It's generally not the case that anyone on the internet needs to query your DBs. As described, you're _only_ relying on client TLS…

At every layer of “breakage”, you are cutting down the chance for an attacker to access your system. While it’s possible the failures might cascade it seems likely that these failure modes are pretty independent of each other. You’re simply pointing out that no amount of layers are foolproof. The goal is not to reduce failure to 0% but to 0.001%.

I think you misunderstood me - I mean that you want multiple layers to your security, and you need to be careful to select layers that fail independently. If Vault has a sufficiently bad unauthenticated bug, then attackers can simply use it to request database credentials and query the DB, which is now on the open internet.

An easy way to get independent failures is to layer a private network with strong auth and firewall rules. While it's certainly possible to expose your DB to the internet safely - given sufficient protections - you won't get that with just a TLS key. And even if you try to implement the "obvious" additional layers here (Vault, right?), it's easy to inadvertently include design problems that reduce to "only one failure and the system is exposed."

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#124

Post by jacquesm »

beermonster wrote: post #97
jacquesm wrote: post #90

Earlier quoted context omitted.

It says more about Docker than anything else. This is an insane default setting, it's something that should have been fixed when it was first brought to their attention. Computer security is hard enough without loaded footguns like these lying around.

Debian has no firewall rules by default. Up until recently also home directory permissions that were not good for multi user systems. Both by design. Defaults are often insecure but maximise interoperability or general usability. Look at Windows !

Yes, Debian - and Ubuntu, for that matter - have some pretty bad defaults in some places. Having users' homedirs UGO rwxr-xr-x is pretty bad.

The defaults should be secure with explicit unlock steps for those that know their environment well enough that they can explicitly relax some restrictions.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#125

Post by SilverRed »

ipython wrote: post #51
SamReidHughes wrote: post #19

Earlier quoted context omitted.

Another option is to add a 900% tax on ransom payments, owed by the payer. It would either lower the price of ransoms or get less of them paid. I don't know why that would be better than prohibition, but it would be funnier.

Unfortunately it looks like the exact opposite is occurring: https://apnews.com/article/technology-business-government-an... The regularity of ransomware has apparently made the expense “ordinary” therefore now tax deductible. Shrug.

Wouldn't other types of crime like theft or damaged windows be the same?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#126

Post by namibj »

edgyquant wrote: post #17
bsder wrote: post #10

Earlier quoted context omitted.

> These are crimes. Where is law enforcement? No money so no incentive. Notice, however, when an "oil pipeline" had their billing software hacked everybody went apeshit.

Downvoted but correct. The oil pipeline was a matter of nation security though (a decent chunk of the northeast was effected) but you’re right within a week or two the government seized BTC accounts.

The pipeline worked fine, they just couldn't handle billing for the time being. At that point you start to write on paper, if needed by hand, and backfill the system once it's back up.

If anything, their shutdown of the pipeline should be illegal/prosecuted, on the grounds of being limited in what you can do business wise if you're operating critical infrastructure.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#127

Post by pm90 »

beermonster wrote: post #86
ralphington wrote: post #55

Earlier quoted context omitted.

What kind of database auth did you have? Wouldn't they have had to access config files or related in order to obtain your passwords, usernames, etc?

I think by default mongodb has no enabled access control, so there is no default user or password.

How is this acceptable… requiring a password, even a weak one might have at least bought some time in this situation.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#128

Post by haimez »

kbatten wrote: post #111
haimez wrote: post #82

Earlier quoted context omitted.

Right, and there should be a sense of shame associated with being pwned by, for example, not setting a password on your public internet accessible (redis || postgres || mongo) instances. You didn’t get hacked, you let a child have their way with your application. Hence: script kiddie

script kiddie is simply a hacker term, it has nothing to do with age or even skill.

> it has nothing to do with age…

It’s in the name, so it doesn’t seem worth disputing that at least at the time when the term was coined- it did have to do with age

> or even skill

Skill is literally the defining feature.

What exactly do you mean by “it’s simply a hacker term” anyway? Are words just sounds we make with our mouths?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#129

Post by gnyman »

qbasic_forever wrote: post #33
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Oooph, good luck. And when you have time please make Docker aware that this well known foot-gun has finally done serious harm. They have known and ignored for years that iptables/ufw on Linux is totally broken and wide open when using Docker: https://github.com/moby/moby/issues/4737

Glad someone else highlighted this old ticket.

I bet this, in combination with the extremely irresponsible solution to ship mongodb without auth as default has caused countless of data leaks and destruction events. We just haven't heard about most of them. Elastic provides the same foot-gun.

Last year someone deleted almost 4000 open mongodb and elastic databases in what was called the Meow attack [1].

In my opinion it's as irresponsible as HW manufacturers shipping with default passwords, something which finally got the attention of regulators[2]. So I wouldn't be surprised if we at some point see some attempts to keep sw-developers accountable for what they give out.

I have for some time been using the data-oil analogy to describe where we are at. If data is the new oil, and a database is a tanker, then we are at the single hull tanker stage. We need double hulls, but just like the oil industry, the sw industry has little incentive to fix it themselves. I am hoping we get some regulation which improves the situation, because otherwise this will keep happening.

1: https://www.bleepingcomputer.com/news/security/new-meow-atta...

2: https://techcrunch.com/2018/10/05/california-passes-law-that...

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#130

Post by EnigmaCurry »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Here's the fix to prevent docker messing with ufw rules:

https://github.com/chaifeng/ufw-docker

Post reply on HN