Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

191–200 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#191

Post by slver »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

> This situation is more of a script kiddie than a hacker.

Is this a useful distinction? Define the sharp line between a "script kiddie" and a "hacker".

You're describing a person who detected your vulnerability and acted within a 3 hour window of it appearing and closing. If I were you I'd be more focused on reflection and not on putting labels on whoever hacked you.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#192

Post by slver »

asteroidbelt wrote: post #16

One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.

> One possible solution to such problems is to prohibit paying ransom by law. Hackers can still be destructive, but at least they will have less incentive to participate in such activities.

One possible solution to rape is that women walk around with a bomb and if someone tries to rape them they kill themselves and the attacker. Rapists can still be destructive, but at least they will have less incentive to participate in such activities.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#193

Post by kortilla »

gnyman wrote: post #129
qbasic_forever wrote: post #33

Earlier quoted context omitted.

Oooph, good luck. And when you have time please make Docker aware that this well known foot-gun has finally done serious harm. They have known and ignored for years that iptables/ufw on Linux is totally broken and wide open when using Docker: https://github.com/moby/moby/issues/4737

Glad someone else highlighted this old ticket. I bet this, in combination with the extremely irresponsible solution to ship mongodb without auth as default has caused countless of data leaks and destruction events. We just haven't heard about most of them. Elastic provides the same foot-gun. Last year someone deleted almost 4000 open mongodb and elastic databases in what was called the Meow attack [1]. In my opinion…

> So I wouldn't be surprised if we at some point see some attempts to keep sw-developers accountable for what they give out.

Wow, the level of entitlement around open source is appalling. People download and run shit for free and get mad that they didn’t configure it right and want the government to go after the maintainers.

I can’t wait for the day where us open source devs have to contribute patches via pseudonyms and tor because they aren’t “government compliant”.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#194

Post by slver »

asteroidbelt wrote: post #63
qbasic_forever wrote: post #21

Earlier quoted context omitted.

Companies get around that by hiring a security 'consultant' or other firm to pay the ransom. Conveniently the cost of the consultant is exactly the ransom. It's enough legal cover for the company to release statements like "XYZ corp is not negotiating or paying the ransom."

Then consultants go to jail. And if these consultants are in China or some other country, then the law can be formulated in a way someone should go to jail. Top managers will deny everything, but FBI will start investigations, the will be a whistleblower, and eventually FBI will offer a deal to some middle manager to testify in court that top managers knew that "consultants" were actually hackers. This will be enough…

> Then consultants go to jail.

Because they'll just call 911 and say "I just paid ransom under cover"?

You know this is why incompetent lawmakers terrify me. They believe they can just be "tough" and everyone just falls in line instead of trying the infinite loopholes you leave open, each of which is a better outcome for them than the draconian path drawn by the law in spirit.

If you make payment illegal, not only you're punishing the victim, you're adding a STRONG INCENTIVE for them to keep the whole thing a SECRET.

You're shooting your own foot.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#195

Post by ghgr »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

> When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world.

Yeah I had the same problem. If you are not using orchestration engines like Swarm of Kubernetes you can just avoid it by explicitly binding the port to your local interface (i.e. -p 127.0.0.1:27017:27017 instead of just -p 27017:27017)

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#196

Post by panta »

vngzs wrote: post #75
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…

Another important missing point is not having docker publicly exposed. Just reach docker through a ssh tunnel (eg via rdocker) or a vpn.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#197

Post by jbuhbjlnjbn »

python273 wrote: post #156
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

The same thing happened to me a few years ago. I used DigitalOcean's Docker image and it had some message about UFW in motd, so I assumed it works with Docker. So I created a container with passwordless mongodb and it got wiped in a few hours. And DO still have this in motd for newly created droplets: Welcome to DigitalOcean's 1-Click Docker Droplet. To keep this Droplet secure, the UFW firewall is enabled. All ports…

So the makers know of the security issue, but still leave it in by default? That's bad. Either fix the issue, or put warnings all over the place that cannot be missed to inform the user.

This is just what another poster commented on, sacrificing security for ease of use.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#198

Post by [deleted] »

UrielFanelli wrote: post #189
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

I can infer so many errors in the architecture, I wonder how this may have survived so far. 1. you put your DB in a server which is exposed to the internet. 2. you have no VIP/NAT in front of your systems. 3. you rely in iptables , while knowing some automatic system is manipulating it. 3 hours? I wonder it took so long. I expect this infrastructure will be a script kiddies party room within a few minutes.

[deleted]

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#199

Post by kstenerud »

kortilla wrote: post #193
gnyman wrote: post #129

Earlier quoted context omitted.

Glad someone else highlighted this old ticket. I bet this, in combination with the extremely irresponsible solution to ship mongodb without auth as default has caused countless of data leaks and destruction events. We just haven't heard about most of them. Elastic provides the same foot-gun. Last year someone deleted almost 4000 open mongodb and elastic databases in what was called the Meow attack [1]. In my opinion…

> So I wouldn't be surprised if we at some point see some attempts to keep sw-developers accountable for what they give out. Wow, the level of entitlement around open source is appalling. People download and run shit for free and get mad that they didn’t configure it right and want the government to go after the maintainers. I can’t wait for the day where us open source devs have to contribute patches via pseudonyms…

This isn't an entitlement issue; it's a public safety issue.

If some philanthropist were to give out free bicycles to everyone, but it turns out that unless you tighten a bolt one of the main support bars will likely snap and could even impale you, the government would rightfully go after them regardless of any "without warranty" disclaimer or EULA.

This is already well-trodden legal ground in the physical space; it's just a matter of bringing it into the virtual space.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#200

Post by roboben »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

This is just another reason to laugh more about dockers "enterprise production ready" offering. So many things I encountered in Docker are so _not_ enterprise at all.
Post reply on HN