Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

221–230 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#221

Post by python273 »

jbuhbjlnjbn wrote: post #197
python273 wrote: post #156

Earlier quoted context omitted.

The same thing happened to me a few years ago. I used DigitalOcean's Docker image and it had some message about UFW in motd, so I assumed it works with Docker. So I created a container with passwordless mongodb and it got wiped in a few hours. And DO still have this in motd for newly created droplets: Welcome to DigitalOcean's 1-Click Docker Droplet. To keep this Droplet secure, the UFW firewall is enabled. All ports…

So the makers know of the security issue, but still leave it in by default? That's bad. Either fix the issue, or put warnings all over the place that cannot be missed to inform the user. This is just what another poster commented on, sacrificing security for ease of use.

Yeah, I reported it to DO support and suggested to add a warning, but seems like it was never added.

  DigitalOcean Support Thursday, March 15, 2018 9:53 PM
  Hello,
  
  Thank you very much for bringing this to our attention.
  
  I will create an internal escalation to our images team to review this. :)
  
  [...]

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#222

Post by jd_mongodb »

gnyman wrote: post #134
pm90 wrote: post #108

Earlier quoted context omitted.

Is 3 hours a large time for an open server to be discovered? Do the attackers just have a giant list of ips that they constantly scan and can instantly know if it’s suddenly open to traffic?

Yes if you publish a known insecure service like mongodb, on the standard port, on a well known VPS provider you can expect it to be automatically compromised within hours if not minutes. As others commented, scanning the whole Internet is even not a problem so scanning a "limited" part where you are likely to see these services pop up is even less of a problem. I think the takeaway is that you cannot hide in the mas…

If you want to secure your on-premise MongoDB we publish a checklist here https://docs.mongodb.com/manual/administration/security-chec...

better still use MongoDB Atlas and get our best security practices baked in.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#223

Post by goatinaboat »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world.

This is crazy. Your network should have been on a private IP address space behind a firewall running static NAT exposing only ports 80 and 443 on a routable IP address. This is network architecture 101.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#224

Post by jd_mongodb »

alias_neo wrote: post #220
gnyman wrote: post #129

Earlier quoted context omitted.

Glad someone else highlighted this old ticket. I bet this, in combination with the extremely irresponsible solution to ship mongodb without auth as default has caused countless of data leaks and destruction events. We just haven't heard about most of them. Elastic provides the same foot-gun. Last year someone deleted almost 4000 open mongodb and elastic databases in what was called the Meow attack [1]. In my opinion…

I spun up Mongo on a cloud VM a while back to assess viability/suitability, it was Meow'd within 30 seconds, absolutely insane. I shut it down and moved on, we don't use Mongo to date.

Did you follow our guidelines? https://docs.mongodb.com/manual/administration/security-chec...

You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#225

Post by higeorge13 »

EdwardDiego wrote: post #187
nodesocket wrote: post #112

Earlier quoted context omitted.

Can I also add don't run MongoDB into Docker containers. Use MongoDB Atlas or switch to AWS and DocumentDB with proper VPC and a network level firewall (security groups). @conesus It's just not worth using discount hosting providers for this exact reason. Use a M(icrosoft) A(mazon) G(oogle) cloud, yes it costs more.... But your time is worth it!

Why not run it in containers? What's the downsides? I mean, if you can reliably run Kafka or Postgres in containers, what's sufficiently different about MongoDB? Or are you talking about using Docker itself as the container host as opposed to K8s or ECS etc.?

I don’t get why the original response is downvoted. Of course you can run those in docker containers, but it is generally suggested that you don’t. From my experience i would run stateless services in containers and persistent storages in vms, dedicated servers, or cloud services.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#226

Post by robotmay »

jd_mongodb wrote: post #219
blackcat201 wrote: post #207

I am not familiar with MongoDB but is there a mechanism in which white/blacklist base on IP, just like pg_hba in Postgresql which blocks/allows only certain IP access? Few years ago when I am still using MongoDB there's only basic authentication method(user password) which blocks unwanted access. I wonder if there's anything new now

MongoDB 3.6, which was released in November 2016 defaults to listening on localhost only. A user must explicitly configure listening on a public IP address. https://docs.mongodb.com/manual/release-notes/3.6-compatibil...

When running inside a docker container this won’t be much use though as the container handles the port forwarding. It would be a much better default to ensure authentication by default, considering how widespread exploiting of this has become with bots.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#227

Post by k_ »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Similar thing happened to me on side projects a couple years ago. A docker update (or something like that, I don't remember the details) rewrote iptables config and opened my mongodb to the world. I didn't notice and the whole thing got ransomed over and over...

Had some fun using mongodb but I don't think I'll ever use it again =/

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#228

Post by schipplock »

pingec wrote: post #181

I am super scared of accidentally exposing a port to the internet. Is there a service / tool that I could provide with a list of all my public IP machines and it would keep port scanning them periodically, sending me a report of all open ports by email each month and sending me an email each time a new port becomes open to the public internet?

I use "nmap" for this.

  $ nmap example.com
  PORT     STATE  SERVICE
  80/tcp   open   http
  443/tcp  open   https
  1119/tcp closed bnetgame
  1935/tcp closed rtmp

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#229

Post by amphorasource »

0-1 wrote: post #76

From a quick skim through https://github.com/samuelclay/newsblur for models extending mongo.Document, it looks like the following private customer data has been breached: - all story content from all private feeds - any uploaded OPML files, including URLs for any private RSS feeds - User’s twitter/facebook account info and access tokens, if the user had linked those services with their newsblur account - all data tha…

Samuel's nonchalant reply to this is highly disturbing to me. I'm a Newsblur customer and as far as I can tell, my feed data is in the hands of some hacker and he doesn't care at all. I am much less concerned about the service being restored, which seems to be all that he's worried about, and more about knowing who has my data.

On top of that, I used to use his "forward newsletters to Newsblur" feature for a long time. I've long stopped using it and deleted all the feeds with newsletters, partly because it never worked very well, but mostly because I more or less had an inkling that something like this would happen and it's just not worth it, too many email newsletters leak personal data all over the place. However, I have no clue if those were really deleted or if they stuck around in MongoDB.

Clarification what exactly the ransom is (did he just dump it locally and encrypt it? or did the hacker download it and is threatening to leak it?) would be very welcome.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#230

Post by LunaSea »

Kiro wrote: post #203
UrielFanelli wrote: post #189

Earlier quoted context omitted.

I can infer so many errors in the architecture, I wonder how this may have survived so far. 1. you put your DB in a server which is exposed to the internet. 2. you have no VIP/NAT in front of your systems. 3. you rely in iptables , while knowing some automatic system is manipulating it. 3 hours? I wonder it took so long. I expect this infrastructure will be a script kiddies party room within a few minutes.

As someone who has been running multiple services with millions of users for decades: 1. I need to be able to connect to my DB from anywhere. 2. No idea what that even means. 3. Don't know. Never even touched the firewall. I have a PW on my DB and that's it. Why do I need more than that?

You need to:

- put the database in a virtual private cloud (VPC), an internal network

- setup a Virtual Private Network (VPN) also placed in the same VPC from which developers can connect to to access the internal network

- setup at least two MongoDB users, one `readWrite` user that can connect from the internal network and one administrative user that can only connect from localhost

- setup a key based SSH connection only accessible from the VPN to the MongoDB instance

- setup Security Groups (firewall) to lock all the unused ports and IP origins out

That way you'll need a VPN key, an SSH key and the MongoDB admin user's access to fully compromise the database.

Post reply on HN