I am super scared of accidentally exposing a port to the internet. Is there a service / tool that I could provide with a list of all my public IP machines and it would keep port scanning them periodically, sending me a report of all open ports by email each month and sending me an email each time a new port becomes open to the public internet?
Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
181–190 of 336 posts
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#182Earlier quoted context omitted.
I would say that this is the expected behavior. Also, I don't think one should rely on firewalls in this way.
Relying on firewalls to do what firewalls do and have done and continue to do seems perfectly acceptable. Yes, your database should have authentication enabled too, but expecting ports to not be unexpectedly open is the entire point of firewalls.
Kind of what I said. Firewalls are for blocking unwanted traffic. It should not be used as a replacement for other security measures. "unexpectedly open", well, there I simply disagree.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#183Earlier quoted context omitted.
I’m kind of shocked this is even deemed acceptable architecture. You’d think docker wouldn’t even touch iptables unless explicitly told to.
It's how they can make containers feel like isolated little subnets without resorting to vxlan or other kernel-level stuff. It's a great development experience and I'd be sad to see it go. But.... it really needs to proactively detect and warn users. The issue has been known for many years. A quick little check and error out on startup if you're running on Ubuntu or have ufw enabled would probably save 99% of the pai…
It works fine when users create docker networks for their containers to communicate, which docker-compose does by default, instead of publishing ports on 0.0.0.0 like yolo
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#184In case anyone else was curious what NewsBlur is supposed to look like: https://web.archive.org/web/20210601112225if_/https://www.ne...
Newblur was one of the big alternatives and go-to options when Google Reader shut down their RSS reader. It's a great service.
I've been a paying user since google shut down Reader. I really agree with your comment.
On the other hand I'm expecting to be ridiculously productive at work until Newsblur is back up.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#185Earlier quoted context omitted.
> you face a heavy fine or arrest Heavy fine yes but not arrest AFAIK. Anyway this is a script programed to scary the target. Do you even store personal data inside that database?
> Heavy fine yes but not arrest AFAIK. Newsblur is an American org. GDPR is a foreign law that has no relevance to American firms lol.
> GDPR is a foreign law that has no relevance to American firms lol.
I couldn't agree more with the spirit of your comment, but sadly the reality may be somewhat more nuanced:
GDPR in the USA https://www.cookiebot.com/en/gdpr-usa/
"The GDPR has extra-territorial scope, which means that websites outside of the EU that process data of people inside the EU are obligated to comply with the GDPR. ... In fact, the very first GDPR enforcement was against a Canadian company... being a website in the US does not exempt you from GPDR compliance and the territorial distance will not protect you from its enforcement either."
Reminded me of:
CISA amendment would allow US to jail foreigners for crimes committed abroad https://www.theguardian.com/technology/2015/oct/22/cybersecu...
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#186NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…
> Turns out the ufw firewall I enabled and diligently kept on a strict allowlist with only my internal servers didn't work on a new server because of Docker.
I’ve been got by this too.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#187Earlier quoted context omitted.
I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…
Can I also add don't run MongoDB into Docker containers. Use MongoDB Atlas or switch to AWS and DocumentDB with proper VPC and a network level firewall (security groups). @conesus It's just not worth using discount hosting providers for this exact reason. Use a M(icrosoft) A(mazon) G(oogle) cloud, yes it costs more.... But your time is worth it!
Why not run it in containers? What's the downsides?
I mean, if you can reliably run Kafka or Postgres in containers, what's sufficiently different about MongoDB?
Or are you talking about using Docker itself as the container host as opposed to K8s or ECS etc.?
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#188Earlier quoted context omitted.
Glad someone else highlighted this old ticket. I bet this, in combination with the extremely irresponsible solution to ship mongodb without auth as default has caused countless of data leaks and destruction events. We just haven't heard about most of them. Elastic provides the same foot-gun. Last year someone deleted almost 4000 open mongodb and elastic databases in what was called the Meow attack [1]. In my opinion…
Ok so now it's the manufacturer's fault if you expose containers without authentication on internet, that users are fine with just "believing" that their firewall works as they expect without even testing: that's perfectly fine, manufacturer's responsibility! Except with GDPR, which makes you responsible for having regular security testing, I mean, just an nmap after changing your infra, it takes 2 minutes, and yet w…
I am definitely not arguing users should not be responsible for what they do. My point is that companies (especially billion dollar companies) can, and should be (more) secure by default.
I am also making the observation that this does not seem to get fixed by itself, rather it seems it needs regulation, which includes GDPR.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#189NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…
I can infer so many errors in the architecture, I wonder how this may have survived so far.
1. you put your DB in a server which is exposed to the internet.
2. you have no VIP/NAT in front of your systems.
3. you rely in iptables , while knowing some automatic system is manipulating it.
3 hours? I wonder it took so long. I expect this infrastructure will be a script kiddies party room within a few minutes.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#190Earlier quoted context omitted.
I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…
I agree with only the third of those. The other lessons I'd take would be: 1. Be cautious about trendy technologies that promise to make life easy - often they cut corners to do so, and often security is one of those corners 2. Use real authentication rather than network firewalling. Make your datastore TLS-only and require a valid client certificate to connect; that way it doesn't matter if it's exposed to the inter…
> 2. Use real authentication rather than network firewalling.
This is in vogue but it’s wrong because it presents this as an either/or.
In reality, people are going to goof up and auth flag at one point, accidentally bind a service, or just run a service with a 0-day (a.k.a everyone).
There is no reason to run a server accepting traffic from every IP if your clients are coming from known ranges.
People see the zero trust model and mistakenly think it means no network-level filtering. This is completely wrong and all of the big players still protect backend services with network ACLs on top of required auth.