Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

241–250 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#241

Post by lbriner »

Being a big fan of containerisation for many reasons, for me, the default open-networking is the biggest footgun of the lot. Docker Swarm seems to be better for treating networks as principle objects whereas K8S requires that you install custom network drivers, otherwise you only seem to get namespaces for protection (i.e. no protection) within a cluster.

For me also, the tooling to actually see what is happening at the network level, what DNS has been assigned, what can and can't route is not easy to identify even though I understand a reasonable amount about the theory.

Even an obvious question like, "if we are sharing a registry between development and production clusters, does that introduce a vulnerability?" doesn't have an obvious answer.

VLANs are great but again, they don't seem to exist in K8S by default and we already read that Docker was punching its own holes in firewalls anyway.

Maybe the default for all of these orchestrators should be private networks unless you specifically open them up otherwise I can see why people might recommend running DB servers on VMs with more obvious attack surfaces.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#242

Post by adevx »

qbasic_forever wrote: post #33
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Oooph, good luck. And when you have time please make Docker aware that this well known foot-gun has finally done serious harm. They have known and ignored for years that iptables/ufw on Linux is totally broken and wide open when using Docker: https://github.com/moby/moby/issues/4737

This has also hit me hard when it opened up Mailcow's not open relay protected internal network. Creating an open relay, and almost getting me banned by Hetzner. I try to avoid Docker when not absolutely necessary just to keep my stack as simple as possible.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#243

Post by carlsborg »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Been bitten by servers listening on 0:0:0:0 before. Nice thing about deploying on AWS is this class of problems is avoided by security groups defined in code or yaml and managed in github.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#244

Post by corobo »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

That's a lot of blame being placed outwards there. It doesn't matter how script kiddie a person is if they got past your security.

Disappointing response, this.

What data got leaked? Please let haveibeenpwned.com know if your system leaked emails or worse.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#245

Post by the_duke »

higeorge13 wrote: post #225
EdwardDiego wrote: post #187

Earlier quoted context omitted.

Why not run it in containers? What's the downsides? I mean, if you can reliably run Kafka or Postgres in containers, what's sufficiently different about MongoDB? Or are you talking about using Docker itself as the container host as opposed to K8s or ECS etc.?

I don’t get why the original response is downvoted. Of course you can run those in docker containers, but it is generally suggested that you don’t. From my experience i would run stateless services in containers and persistent storages in vms, dedicated servers, or cloud services.

People have been running database instances just fine on their own for decades, without the help of "big brother".

There are reasons why running a high performance database instance in containers is problematic, but security is not one of them - not any more so than application containers.

You just need to know what you are doing, it's not a black art.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#246

Post by AtNightWeCode »

wjossey wrote: post #99
vngzs wrote: post #75

Earlier quoted context omitted.

I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…

Just want to yes and you. In general, put everything in private subnets, and make the only way any traffic can get to a server is through a load balancer. There are very few reasons to have a server itself have its own public IP address, and using your load balancer as a chokepoint, means you can set up layers and layers of redundancy to prevent traffic from ever being able to reach a database under your control. Thi…

Layer 4 and/or 7 proxies -> private networks -> services. Auth and encryption all the way on everything. IP white-listening were suitable. Pretty much the standard way of building web were I live.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#247

Post by Namari »

conesus wrote: post #34
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…

This happened to us on a test DB as well and from what we've seen on the network traffic they was not much there, less than 1MB or something. So you can be sure they have not stored your data and you will not be able to recover anything. Pretty expected from someone who only ask so little.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#248

Post by throwawinsider »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

I also found frustrating that docker ignored ufw.

Both ufw and iptables are very impractical apps. Add to it that docker integrates those rules in a obscure way.

The result is a time sink and a huge security risk.

Thanks god the server provider supports firewall rules in my case.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#249

Post by [deleted] »

devit wrote: post #209

I guess targeting MongoDB is a very effective strategy for the blackhats since the fact itself that someone is running MongoDB is a reliable indicator that their overall technical ability, thus including their ability to design and implement a secure system, is significantly lower than average.

[deleted]

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#250

Post by corobo »

amphorasource wrote: post #233
conesus wrote: post #34

Earlier quoted context omitted.

In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…

This is horrific. So the hacker is claiming to have a copy of our data. 0.03 BTC is less than $1000. Regardless of you being able to restore from backups, I assume you're paying the ransom to hopefully avoid the leak, right?

Paying a ransom marks you as will-pay. The price will keep rising till they find your limit.

The data is already leaked, let your users know what was leaked and recover from there.

See also: 80% of orgs that paid the ransom were hit again https://news.ycombinator.com/item?id=27552611

Post reply on HN