Earlier quoted context omitted.
I think by default mongodb has no enabled access control, so there is no default user or password.
How is this acceptable… requiring a password, even a weak one might have at least bought some time in this situation.
Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
141–150 of 336 posts
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#142NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…
Is 3 hours a large time for an open server to be discovered? Do the attackers just have a giant list of ips that they constantly scan and can instantly know if it’s suddenly open to traffic?
It's possible to check every IP on the Internet nowadays so you don't need to keep a list. You can just brute-force check every IPv4 address in less than an hour. I've written on the subject a few times:
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#143Earlier quoted context omitted.
How does shodan works like how do they know if something is exposed to the internet. Are they scanning networks 24/7 I’m just a noob in security so therefore learning
They do a monthly scan, with additional spot checks available on-demand: https://help.shodan.io/the-basics/on-demand-scanning
We actually scan on average once a week. I used that language to be ultra conservative but I'll need to change it. For the past 8+ years we've been doing weekly scans.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#144NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…
There are search engines for services exposed to the internet, like https://www.shodan.io/ If your mongoDB server is exposed to the Internet it will show up there. When that happens, it's only a matter of time until someone targets you. You can write an alert that probes for sensitive services exposed to the Internet. In that way, if this happens again, you get an alert that you can use to detect the problem early. A…
We have a service where we'll notify you if anything new gets exposed on one of your IPs:
If you have a membership (which is a one-time payment of $49 - no subscription necessary) then you can monitor up to 16 IPs. We have a lot of individuals that have configured monitoring for their home network just in case something accidentally gets exposed.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#145NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…
Absolutely horrid that Docker still bypasses iptables / ufw by default.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#146One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.
I'd argue that a far better solution is improving security requirements and developing better procedures.
Hacks in many ways incentivize companies to invest in their security.
Also, if you prohibit paying ransom nothing will probably change. Hackers will continue to steal data, they will just sell it like they always did.
Sure they will target now companies that have more valuable data, but the big picture won't change.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#147Earlier quoted context omitted.
No this is not the right approach at all in my opinion. What stops someone from one of the countries using IP's from another? Teenagers in USA are gonna try and hack your stuff as well... I was one of them in my youth. You can't just block china and half ass your setup. You will get attacked from everywhere always. Anything you put on the internet is a target. Always has been always will be.
> What stops someone from one of the countries using IP's from another? That's why this approach is only really complete if supported at a national level. Cloud providers in the US shouldn't be allowing foreign actors to rent them, for instance.
But how? How can US cloud providers stop this? I am really curious how from my understanding it is not possible with how things are currently setup.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#148NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…
Don't pay, they have deleted your data and you're not getting it back. This non targeted attack has been running since 2017 and is pretty well documented now, nobody ever reported getting their data back after paying. ALWAYS read for existing documentation about an attack you have been victim of, should be one of the first thing you do, especially prior to pay.
https://www.imperva.com/blog/ransomware-attacks-on-mysql-and... https://www.itproportal.com/news/ransomware-attacks-on-mongo... https://security.stackexchange.com/questions/237048/mongo-db...
Everybody falls for that, I mean, look at the BTC these guys made, it's crazy! Anyway, Docker uses the DOCKER-USER firewall chain:
https://docs.docker.com/network/iptables/
Example:
https://yourlabs.io/oss/yourlabs.docker/-/blob/master/tasks/...
People should really test their firewalls after setting it up.
Another thing, instead of using Ansible+Docker and exposing ports like that, use Ansible+Docker-Compose, so that your containers of a stack have their own private shared network, then you won't have to publish ports to make your services communicate.
https://docs.ansible.com/ansible/latest/collections/communit...
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#149Earlier quoted context omitted.
> What stops someone from one of the countries using IP's from another? That's why this approach is only really complete if supported at a national level. Cloud providers in the US shouldn't be allowing foreign actors to rent them, for instance.
But how? How can US cloud providers stop this? I am really curious how from my understanding it is not possible with how things are currently setup.
Of course it's possible: KYC. As it is, cloud providers already tend to require credit cards when setting up an account that can possibly generate any sort of billing.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#150Earlier quoted context omitted.
Oooph, good luck. And when you have time please make Docker aware that this well known foot-gun has finally done serious harm. They have known and ignored for years that iptables/ufw on Linux is totally broken and wide open when using Docker: https://github.com/moby/moby/issues/4737
Glad someone else highlighted this old ticket. I bet this, in combination with the extremely irresponsible solution to ship mongodb without auth as default has caused countless of data leaks and destruction events. We just haven't heard about most of them. Elastic provides the same foot-gun. Last year someone deleted almost 4000 open mongodb and elastic databases in what was called the Meow attack [1]. In my opinion…
Yeah, it seems like there's a weird inbetween phase when projects go from "awesome tool used and loved by some core people" to "this is the new normal, it's everywhere" where these issues get lost. I could see back in 2014 moby not really feeling like the quirks of ufw & iptables were its problem. But now in 2021 with how many millions of times docker run is used per day on machines all across the internet... it's just irresponsible security. It sucks, it isn't really docker's problem in the first place... but it's reality and someone needs to grab the hot potato and keep it from burning people for the good of us all.