Earlier quoted context omitted.
This actually got me a while ago but with redis and some script kiddy turning my dev server into a bitcoin miner. Anyone else running docker and using iptables really needs to read this https://docs.docker.com/network/iptables/
Redis can be exploited to run executables ???
Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
211–220 of 336 posts
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#212Earlier quoted context omitted.
I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…
What strikes me about your reply is that 1, 2, 3 are all absolutely basic table-stakes things. SQL injection mitigation level things. Have we suddenly stopped teaching the basics?
Youre downvoted but you’re right - this is entry level stuff and it seems to get routinely not taught or simply forgotten and ignored.
Everyone seems to want to worry about “nation state actors” and getting with novel 0 days when in fact missing the basic low hanging fruit is likely to result in far more damage
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#213Earlier quoted context omitted.
I can infer so many errors in the architecture, I wonder how this may have survived so far. 1. you put your DB in a server which is exposed to the internet. 2. you have no VIP/NAT in front of your systems. 3. you rely in iptables , while knowing some automatic system is manipulating it. 3 hours? I wonder it took so long. I expect this infrastructure will be a script kiddies party room within a few minutes.
As someone who has been running multiple services with millions of users for decades: 1. I need to be able to connect to my DB from anywhere. 2. No idea what that even means. 3. Don't know. Never even touched the firewall. I have a PW on my DB and that's it. Why do I need more than that?
> 1. I need to be able to connect to my DB from anywhere.
Understandable and reasonable. there are ways to achieve this without exposing the DB but it take some more effort.
> 3. Don't know. Never even touched the firewall.
Firewalls are good, because they add an extra layer on security. Personally I believe, there should be firewall on most servers (firewall should be the default). But firewalls aren't magic and they are just one layer.
> I have a PW on my DB and that's it. Why do I need more than that?
Because this means you have 0 margins for error. Either you PW auth works flawlessly and without bugs, or you are screwed.
Also you expose one more endpoint that can potentially be a ddos target.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#214NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…
I was caught out by this too[0]. I now have a fw script which runs automatically for demos etc.
[0] https://github.com/docker-library/redis/issues/259#issuecomm...
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#215Earlier quoted context omitted.
In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…
0.03 BTC?! Someone is doing this for a lousy thousand dollar? Unbelievable.
> Unbelievable
Really? If they ask 100K dollars they are probably not going to be paid. So, just hijack 100 servers and assure that they will pay (since 1K dollars is "not" much if you are running a business).
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#216Earlier quoted context omitted.
Good luck! I appreciate your transparent account of the situation but what does it say about your company if your database got popped by a “script kiddie”?
It says more about Docker than anything else. This is an insane default setting, it's something that should have been fixed when it was first brought to their attention. Computer security is hard enough without loaded footguns like these lying around.
Well, Docker CE comes with a huge Disclaimer of Warranty (https://github.com/docker/docker-ce/blob/master/LICENSE). I don't think we can complain. "I should have tested it before deploying to production" it's the right thing to say.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#217NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…
Oooph, good luck. And when you have time please make Docker aware that this well known foot-gun has finally done serious harm. They have known and ignored for years that iptables/ufw on Linux is totally broken and wide open when using Docker: https://github.com/moby/moby/issues/4737
We simply stopped using Docker's control of the firewall. It also takes docker-proxy out of the equation so you have far more control and it's less resource intensive (docker starts a proxy instance per port exposed).
I've commented here in the past about my feelings on Docker's attitude towards real issues raised by users, the only way I can describe it succinctly is "contempt".
There's some serious flaws, with tickets that are the best part a decade old now, one simply can't rely on them to do anything.
Stop using Docker or solve the issue yourself is my advice.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#218Ahh.. insecure defaults. Such a nice thing.
I don't understand why this is still used. But I really can't understand the people who are advocating this, and claim that you're stupid for not hardening everything.
Insecure software defaults = bad software.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#219I am not familiar with MongoDB but is there a mechanism in which white/blacklist base on IP, just like pg_hba in Postgresql which blocks/allows only certain IP access? Few years ago when I am still using MongoDB there's only basic authentication method(user password) which blocks unwanted access. I wonder if there's anything new now
MongoDB 3.6, which was released in November 2016 defaults to listening on localhost only. A user must explicitly configure listening on a public IP address.
https://docs.mongodb.com/manual/release-notes/3.6-compatibil...
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#220Earlier quoted context omitted.
Oooph, good luck. And when you have time please make Docker aware that this well known foot-gun has finally done serious harm. They have known and ignored for years that iptables/ufw on Linux is totally broken and wide open when using Docker: https://github.com/moby/moby/issues/4737
Glad someone else highlighted this old ticket. I bet this, in combination with the extremely irresponsible solution to ship mongodb without auth as default has caused countless of data leaks and destruction events. We just haven't heard about most of them. Elastic provides the same foot-gun. Last year someone deleted almost 4000 open mongodb and elastic databases in what was called the Meow attack [1]. In my opinion…
I spun up Mongo on a cloud VM a while back to assess viability/suitability, it was Meow'd within 30 seconds, absolutely insane.
I shut it down and moved on, we don't use Mongo to date.