Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

151–160 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#151

Post by lowbloodsugar »

lmm wrote: post #81
vngzs wrote: post #75

Earlier quoted context omitted.

I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…

I agree with only the third of those. The other lessons I'd take would be: 1. Be cautious about trendy technologies that promise to make life easy - often they cut corners to do so, and often security is one of those corners 2. Use real authentication rather than network firewalling. Make your datastore TLS-only and require a valid client certificate to connect; that way it doesn't matter if it's exposed to the inter…

Well, your second point is his first point.

And his second point is table-stakes as far as I'm concerned. As others have said, do all of them. They are not hard to do.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#152

Post by achillean »

mr_o47 wrote: post #49
29athrowaway wrote: post #27

Earlier quoted context omitted.

There are search engines for services exposed to the internet, like https://www.shodan.io/ If your mongoDB server is exposed to the Internet it will show up there. When that happens, it's only a matter of time until someone targets you. You can write an alert that probes for sensitive services exposed to the Internet. In that way, if this happens again, you get an alert that you can use to detect the problem early. A…

How does shodan works like how do they know if something is exposed to the internet. Are they scanning networks 24/7 I’m just a noob in security so therefore learning

Here is an overview of what Shodan is:

https://help.shodan.io/the-basics/what-is-shodan

The scanning algorithm is mostly just this:

1. Generate a random IPv4 address

2. Select a random port from a list of ~2k ports

3. Check the random IP on the random port

4. Store the result of the check

5. GOTO 1

The above loop runs endlessly and because IPv4 is fairly small it doesn't take long to check everything.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#153

Post by markdown »

pmontra wrote: post #46
conesus wrote: post #34

Earlier quoted context omitted.

In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…

> you face a heavy fine or arrest Heavy fine yes but not arrest AFAIK. Anyway this is a script programed to scary the target. Do you even store personal data inside that database?

> Heavy fine yes but not arrest AFAIK.

Newsblur is an American org. GDPR is a foreign law that has no relevance to American firms lol.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#154

Post by discordance »

wjossey wrote: post #99
vngzs wrote: post #75

Earlier quoted context omitted.

I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…

Just want to yes and you. In general, put everything in private subnets, and make the only way any traffic can get to a server is through a load balancer. There are very few reasons to have a server itself have its own public IP address, and using your load balancer as a chokepoint, means you can set up layers and layers of redundancy to prevent traffic from ever being able to reach a database under your control. Thi…

Defense in depth... VNets, TLS certs, RBAC etc.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#155

Post by jbrot »

qbasic_forever wrote: post #150
gnyman wrote: post #129

Earlier quoted context omitted.

Glad someone else highlighted this old ticket. I bet this, in combination with the extremely irresponsible solution to ship mongodb without auth as default has caused countless of data leaks and destruction events. We just haven't heard about most of them. Elastic provides the same foot-gun. Last year someone deleted almost 4000 open mongodb and elastic databases in what was called the Meow attack [1]. In my opinion…

Yeah, it seems like there's a weird inbetween phase when projects go from "awesome tool used and loved by some core people" to "this is the new normal, it's everywhere" where these issues get lost. I could see back in 2014 moby not really feeling like the quirks of ufw & iptables were its problem. But now in 2021 with how many millions of times docker run is used per day on machines all across the internet... it's ju…

I know the CICD code I wrote and manage at work launches approximately a million docker containers a day, so I suspect the total number of docker containers used per day is well into the billions.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#156

Post by python273 »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

The same thing happened to me a few years ago. I used DigitalOcean's Docker image and it had some message about UFW in motd, so I assumed it works with Docker. So I created a container with passwordless mongodb and it got wiped in a few hours.

And DO still have this in motd for newly created droplets:

  Welcome to DigitalOcean's 1-Click Docker Droplet.
  To keep this Droplet secure, the UFW firewall is enabled.
  All ports are BLOCKED except 22 (SSH), 2375 (Docker) and 2376 (Docker).
Full motd: https://pastebin.com/cdaecHU8

Though it links to https://do.co/3j6j3po and it mentions ufw problem:

> Note: The default firewall for the Docker One-Click is UFW, which is a front end to iptables. However, Docker modifies iptables directly to set up communication to and from containers. This means that UFW won’t give you a full picture of the firewall settings. You can override this behavior in Docker by adding --iptables=false to the Docker daemon.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#158

Post by z3t4 »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

My theory is that its MongoDB that is behind the ransomware, why else would they 1. Not have auth protection 2. Open up the firewall !?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#159

Post by achillean »

conesus wrote: post #34
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…

Looks like this is an automated campaign:

https://www.shodan.io/search?query=READ__ME_TO_RECOVER_YOUR_...

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#160

Post by lowbloodsugar »

lmm wrote: post #136
vngzs wrote: post #95

Earlier quoted context omitted.

Yeah, there's the whole "zero trust" possibility which I didn't mention. If you do authentication/authorization really well, you can stop doing (2). For things like databases, I think it's better to treat them as if they _could_ be exposed to the open internet, without actually doing so. It's generally not the case that anyone on the internet needs to query your DBs. As described, you're _only_ relying on client TLS…

My view is that for most cases the cost/benefit of multiple layers doesn't stack up. Given a fixed amount of available time and effort, you'll generally get better results by focusing that effort on making one really good layer - e.g. putting active monitoring in place so that you detect when your single layer breaks (whether that's an attacker from outside the network being able to connect to inside the network or a…

Unless this is literally running on a single 1U host in some colo, there is no excuse for not having defense in depth. An old school DMZ if you are in a datacenter. A VPC if you are on the cloud. Then client certs for everything. Two factor for ssh. Auditing. These are straightforward to set up, with different options if you have time-but-not-money or money-but-not-time. If you have not-money-and-not-time then this is probably going to end badly no matter what.
Post reply on HN