Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

231–240 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#231

Post by uniqueuid »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Completely unrelated: NewsBlur was the first rss service I paid for after google reader closed down. I used it intensely for a long time and have very fond memories. I especially liked that you had open-sourced the code and spent some time looking at the architecture.

I'm now self-hosting a rss reader, but NewsBlur will always remain dear to my heart.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#232

Post by bauruine »

pingec wrote: post #181

I am super scared of accidentally exposing a port to the internet. Is there a service / tool that I could provide with a list of all my public IP machines and it would keep port scanning them periodically, sending me a report of all open ports by email each month and sending me an email each time a new port becomes open to the public internet?

Shodan has a monitor feature. [0] I haven't used it myself but the description looks like it's about what you want.

[0] https://monitor.shodan.io/

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#233

Post by amphorasource »

conesus wrote: post #34
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…

This is horrific. So the hacker is claiming to have a copy of our data. 0.03 BTC is less than $1000. Regardless of you being able to restore from backups, I assume you're paying the ransom to hopefully avoid the leak, right?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#234

Post by jam48 »

pingec wrote: post #181

I am super scared of accidentally exposing a port to the internet. Is there a service / tool that I could provide with a list of all my public IP machines and it would keep port scanning them periodically, sending me a report of all open ports by email each month and sending me an email each time a new port becomes open to the public internet?

I think that shodan.io can do this, if you give it an IP it will monitor it and email you about services it finds.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#235

Post by pritambaral »

jd_mongodb wrote: post #224
alias_neo wrote: post #220

Earlier quoted context omitted.

I spun up Mongo on a cloud VM a while back to assess viability/suitability, it was Meow'd within 30 seconds, absolutely insane. I shut it down and moved on, we don't use Mongo to date.

Did you follow our guidelines? https://docs.mongodb.com/manual/administration/security-chec... You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default.

> You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default.

Serious: Listening on localhost-only works in dev environments only. In production, it is not the norm to run the application on the same host as Mongo, especially given what a resource hog Mongo is. So, for practical purposes, listen-on-localhost is actually an obstacle is needs to be disabled first-thing anyway.

You guys know this too, because you do exactly this (and a lot more) on that Atlas thing you guys love to upsell everyone and their grandmother on.

Honestly, it is telling that this is the only defence you could provide — that you listen on localhost — and not anything _actually_ secure in prod. Must come in handy when upselling Atlas, I guess, that your the default configuration conveniently omits everything.

> Did you follow our guidelines? https://docs.mongodb.com/manual/administration/security-chec...

Snark: maybe they couldn't trust your guidelines because MongoDB the company is a known blatant liar[1].

1: https://twitter.com/jepsen_io/status/1255867265997844484

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#236

Post by pritambaral »

Kiro wrote: post #203
UrielFanelli wrote: post #189

Earlier quoted context omitted.

I can infer so many errors in the architecture, I wonder how this may have survived so far. 1. you put your DB in a server which is exposed to the internet. 2. you have no VIP/NAT in front of your systems. 3. you rely in iptables , while knowing some automatic system is manipulating it. 3 hours? I wonder it took so long. I expect this infrastructure will be a script kiddies party room within a few minutes.

As someone who has been running multiple services with millions of users for decades: 1. I need to be able to connect to my DB from anywhere. 2. No idea what that even means. 3. Don't know. Never even touched the firewall. I have a PW on my DB and that's it. Why do I need more than that?

> 1. I need to be able to connect to my DB from anywhere.

So do I. So I setup all my dbs with TLS mutual auth or equivalent. Even databases that don't support TLS natively (e.g., Redis 5 and below) get a TLS/SSH port-forward setup for them at the network boundary.

> I have a PW on my DB and that's it. Why do I need more than that?

If you're not using an MITM-proof connection (e.g., TLS or SSH), and you connect to your DB from a network that has me (maybe we're in the same coffee shop, maybe I'm working in your office, or maybe I just work at an ISP between you and your server), then I have your PW.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#237

Post by gregoriol »

vngzs wrote: post #75
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…

I'd also suggest to use another server/vps to monitor your setup (availability, performance, ...), and include a ports open check in the monitoring tools. Having an external check of your usual ports (thoose that should be closed) is a good way to find when something is off.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#238

Post by jd_mongodb »

pritambaral wrote: post #235
jd_mongodb wrote: post #224

Earlier quoted context omitted.

Did you follow our guidelines? https://docs.mongodb.com/manual/administration/security-chec... You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default.

> You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default. Serious: Listening on localhost-only works in dev environments only. In production, it is not the norm to run the application on the same host as Mongo, especially given what a resource hog Mongo is. So, for practical purposes, listen-on-localhost is actually an obstacle is needs t…

There wasn't a lot of information in your previous post. As I pointed out there are a comprehensive set of guidelines for enforcing security. Our defaults make it difficult to accidentally expose your data these days. However if you do add a MongoDB database to a public IP address we strongly encourage you to add a strong password. Better still do not expose your database on the public internet. Put it behind a firewall with auth enabled, secure it with a certificate and only allow access to named IP addresses.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#239

Post by hnick »

achillean wrote: post #152
mr_o47 wrote: post #49

Earlier quoted context omitted.

How does shodan works like how do they know if something is exposed to the internet. Are they scanning networks 24/7 I’m just a noob in security so therefore learning

Here is an overview of what Shodan is: https://help.shodan.io/the-basics/what-is-shodan The scanning algorithm is mostly just this: 1. Generate a random IPv4 address 2. Select a random port from a list of ~2k ports 3. Check the random IP on the random port 4. Store the result of the check 5. GOTO 1 The above loop runs endlessly and because IPv4 is fairly small it doesn't take long to check everything.

If everyone somehow magically switched to the much larger IPv6 address space would that be a big problem for you?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#240

Post by kdmytro »

robotmay wrote: post #226
jd_mongodb wrote: post #219

Earlier quoted context omitted.

MongoDB 3.6, which was released in November 2016 defaults to listening on localhost only. A user must explicitly configure listening on a public IP address. https://docs.mongodb.com/manual/release-notes/3.6-compatibil...

When running inside a docker container this won’t be much use though as the container handles the port forwarding. It would be a much better default to ensure authentication by default, considering how widespread exploiting of this has become with bots.

You don't have to bind to 0.0.0.0:[port]. If you want the server to remain accessible only locally, bind the container to 127.0.0.1:[port]. Docker is not preventing anyone from doing this.
Post reply on HN