Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

201–210 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#201

Post by lmm »

kortilla wrote: post #190
lmm wrote: post #81

Earlier quoted context omitted.

I agree with only the third of those. The other lessons I'd take would be: 1. Be cautious about trendy technologies that promise to make life easy - often they cut corners to do so, and often security is one of those corners 2. Use real authentication rather than network firewalling. Make your datastore TLS-only and require a valid client certificate to connect; that way it doesn't matter if it's exposed to the inter…

> 2. Use real authentication rather than network firewalling. This is in vogue but it’s wrong because it presents this as an either/or. In reality, people are going to goof up and auth flag at one point, accidentally bind a service, or just run a service with a 0-day (a.k.a everyone). There is no reason to run a server accepting traffic from every IP if your clients are coming from known ranges. People see the zero t…

In reality time and attention are limited resources. Does network-level filtering have a good RoI relative to putting the same effort into improving security at the service level? IMO no (at least not until you've reached a very high level of service security where you're hitting severely diminishing returns) - network-level security is necessarily at least one of a) crude b) complex enough that it becomes an attack surface itself - though reasonable people can disagree.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#202

Post by sneak »

qbasic_forever wrote: post #33
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Oooph, good luck. And when you have time please make Docker aware that this well known foot-gun has finally done serious harm. They have known and ignored for years that iptables/ufw on Linux is totally broken and wide open when using Docker: https://github.com/moby/moby/issues/4737

This massive PITA is why I switched to using Hetzner's upstream colo firewall instead of on-host iptables on my boxes there running Docker. It's lame and also it's not even stateful, but at least the garbage software coming out of Docker Inc these days can't accidentally open my system up to the world.

The userspace proxy used by Docker Swarm is still trashing my L3 client IPs though, yet another docker networking hassle.

Ultimately solely relying on an L3 firewall for access control is a bad idea, though. Your services should all have authentication turned on, even if they are only bound to localhost, for reasons which at this moment must be obvious.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#203

Post by Kiro »

UrielFanelli wrote: post #189
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

I can infer so many errors in the architecture, I wonder how this may have survived so far. 1. you put your DB in a server which is exposed to the internet. 2. you have no VIP/NAT in front of your systems. 3. you rely in iptables , while knowing some automatic system is manipulating it. 3 hours? I wonder it took so long. I expect this infrastructure will be a script kiddies party room within a few minutes.

As someone who has been running multiple services with millions of users for decades:

1. I need to be able to connect to my DB from anywhere.

2. No idea what that even means.

3. Don't know. Never even touched the firewall.

I have a PW on my DB and that's it. Why do I need more than that?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#204

Post by sneak »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Is there a colo or host that will run honeypots within your /24 and detect and automatically block malicious traffic sources like this?

Seems like it would be a dead simple detection system, and would be a huge value-add.

You could of course order an additional IP and do it yourself, too, but it seems like the colo doing it would be more efficient in terms of scale. (And they'd likely be more diligent in doing it, avoiding obvious DoS vectors like triggering the honeypot from AWS netblocks.)

Hetzner (my host) sends me nastygrams from their IDS when my box tries to connect to RFC1819 space (which isn't even routable via them!) when running p2p software like ipfs. You'd think if they are willing to complain to customers about zero-impact stuff like that, they'd be willing to blackhole non-customers for nonzero impact malicious traffic.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#205

Post by qxmat »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Once this is over consider looking at network topology as a security mechnism in it's own right. Professionally I try operate a subnet hierarchy: public, intermediate, private where there's no routing information between public and private and private has no internet connectivity.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#206

Post by hutzlibu »

black3r wrote: post #175
herpderperator wrote: post #138

Earlier quoted context omitted.

I'm sorry that you have to go through this, it seems inevitable these days. However, while it's nice that you're sharing your analysis of the situation, you start off by downplaying the attack and calling them a script kiddie. If for example someone finds out they can brute-force Facebook's 6-digit password reset token because they didn't put any rate-limiting in[0], are they a hacker? Is there major skill involved i…

hackers start with a target and try to find a vulnerability. script kiddies start with a vulnerability and try to find sites vulnerable to it. it's not about the skill involved in making the exploit, it's about the effort around that. the case you mention is more of a hacker feat because that exploit had to be crafted specifically for facebook. meanwhile in this case it was most probably someone who just continuously…

" script kiddies start with a vulnerability and try to find sites vulnerable to it. it's not about the skill involved in making the exploit, it's about the effort around that."

The terms get clouded a bit - but in my definition a "script kiddie" is pretty much this: someone with not much skill(like a kid), but hands on some hacker tools/scripts - to find easy targets and feel powerful. And later on, try to make some money.

And they can make great effort in doing so - but they remain script kiddies. They don't really know how to hack.

Whether this was just a "script kiddie", I doubt. More a professional ransomware gang. But what op probably meant was, it was not a targeted attack.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#207

Post by blackcat201 »

I am not familiar with MongoDB but is there a mechanism in which white/blacklist base on IP, just like pg_hba in Postgresql which blocks/allows only certain IP access? Few years ago when I am still using MongoDB there's only basic authentication method(user password) which blocks unwanted access. I wonder if there's anything new now

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#208

Post by unionpivo »

lmm wrote: post #201
kortilla wrote: post #190

Earlier quoted context omitted.

> 2. Use real authentication rather than network firewalling. This is in vogue but it’s wrong because it presents this as an either/or. In reality, people are going to goof up and auth flag at one point, accidentally bind a service, or just run a service with a 0-day (a.k.a everyone). There is no reason to run a server accepting traffic from every IP if your clients are coming from known ranges. People see the zero t…

In reality time and attention are limited resources. Does network-level filtering have a good RoI relative to putting the same effort into improving security at the service level? IMO no (at least not until you've reached a very high level of service security where you're hitting severely diminishing returns) - network-level security is necessarily at least one of a) crude b) complex enough that it becomes an attack…

You are looking it as a network level filtering.

I am looking at, make private network, and then you have to explicitly add an gateway (usually a load balancer) that can access it.

In short don't design system where you need to filter, design the system, where you need to take explicite action, to make something public.

This is easily, done on something like AWS.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#209

Post by devit »

I guess targeting MongoDB is a very effective strategy for the blackhats since the fact itself that someone is running MongoDB is a reliable indicator that their overall technical ability, thus including their ability to design and implement a secure system, is significantly lower than average.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#210

Post by tluyben2 »

kstenerud wrote: post #199
kortilla wrote: post #193

Earlier quoted context omitted.

> So I wouldn't be surprised if we at some point see some attempts to keep sw-developers accountable for what they give out. Wow, the level of entitlement around open source is appalling. People download and run shit for free and get mad that they didn’t configure it right and want the government to go after the maintainers. I can’t wait for the day where us open source devs have to contribute patches via pseudonyms…

This isn't an entitlement issue; it's a public safety issue. If some philanthropist were to give out free bicycles to everyone, but it turns out that unless you tighten a bolt one of the main support bars will likely snap and could even impale you, the government would rightfully go after them regardless of any "without warranty" disclaimer or EULA. This is already well-trodden legal ground in the physical space; it'…

It will kill open source. And a lot of other small company software development.
Post reply on HN