Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage • Hacker News Board

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#261

Post by Aeolun » Thu, Jun 24, 2021, 11:38 AM UTC

dawnerd wrote: post #22

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

This actually got me a while ago but with redis and some script kiddy turning my dev server into a bitcoin miner. Anyone else running docker and using iptables really needs to read this https://docs.docker.com/network/iptables/

What is this black magic? Why is docker concerned with iptables at all?

And these docs read a lot like: “We are going to totally ignore any of your firewall rules unless you follow all these steps exactly and do a lot of manual work.”

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#262

Post by canuckintime » Thu, Jun 24, 2021, 11:40 AM UTC

amphorasource wrote: post #229

0-1 wrote: post #76

From a quick skim through https://github.com/samuelclay/newsblur for models extending mongo.Document, it looks like the following private customer data has been breached: - all story content from all private feeds - any uploaded OPML files, including URLs for any private RSS feeds - User’s twitter/facebook account info and access tokens, if the user had linked those services with their newsblur account - all data tha…

Samuel's nonchalant reply to this is highly disturbing to me. I'm a Newsblur customer and as far as I can tell, my feed data is in the hands of some hacker and he doesn't care at all. I am much less concerned about the service being restored, which seems to be all that he's worried about, and more about knowing who has my data. On top of that, I used to use his "forward newsletters to Newsblur" feature for a long tim…

> On top of that, I used to use his "forward newsletters to Newsblur" feature for a long time. I've long stopped using it and deleted all the feeds with newsletters, partly because it never worked very well,

would you share your alternative?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#263

Post by Aeolun » Thu, Jun 24, 2021, 11:41 AM UTC

AtNightWeCode wrote: post #182

Shank wrote: post #107

Earlier quoted context omitted.

Relying on firewalls to do what firewalls do and have done and continue to do seems perfectly acceptable. Yes, your database should have authentication enabled too, but expecting ports to not be unexpectedly open is the entire point of firewalls.

Kind of what I said. Firewalls are for blocking unwanted traffic. It should not be used as a replacement for other security measures. "unexpectedly open", well, there I simply disagree.

So if you have a firewall set to block everything, and you run a docker container that listens to your global IP, you expect it to magic your firewall for you?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#264

Post by EdwardDiego » Thu, Jun 24, 2021, 11:47 AM UTC

higeorge13 wrote: post #225

EdwardDiego wrote: post #187

Earlier quoted context omitted.

Why not run it in containers? What's the downsides? I mean, if you can reliably run Kafka or Postgres in containers, what's sufficiently different about MongoDB? Or are you talking about using Docker itself as the container host as opposed to K8s or ECS etc.?

I don’t get why the original response is downvoted. Of course you can run those in docker containers, but it is generally suggested that you don’t. From my experience i would run stateless services in containers and persistent storages in vms, dedicated servers, or cloud services.

> it is generally suggested that you don’t.

What's the difference between a container and a instance in a cloud service?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#265

Post by pritambaral » Thu, Jun 24, 2021, 12:01 PM UTC

jd_mongodb wrote: post #238

pritambaral wrote: post #235

Earlier quoted context omitted.

> You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default. Serious: Listening on localhost-only works in dev environments only. In production, it is not the norm to run the application on the same host as Mongo, especially given what a resource hog Mongo is. So, for practical purposes, listen-on-localhost is actually an obstacle is needs t…

There wasn't a lot of information in your previous post. As I pointed out there are a comprehensive set of guidelines for enforcing security. Our defaults make it difficult to accidentally expose your data these days. However if you do add a MongoDB database to a public IP address we strongly encourage you to add a strong password. Better still do not expose your database on the public internet. Put it behind a firew…

> There wasn't a lot of information in your previous post.

As the first paragraph of my comment says: listen-on-localhost is untenable in production. Unless, of course, you guys seriously believe people should be running their production applications on the same host as mongo daemons. Honestly, I wouldn't be greatly surprised if you guys believe that.

> Our defaults make it difficult to ...

You have one (1) default that does that. Singular. None of your other defaults do that. And, as I've said above, that one (1) default is also useless, because it's one of the first things that need to be disabled in production anyway.

> However if you do add a MongoDB database to a public IP address we strongly encourage you to add a strong password. Better still do not expose your database on the public internet. Put it behind a firewall with auth enabled, secure it with a certificate and only allow access to named IP addresses.

Everybody knows this. You aren't adding anything new. Nobody's claiming MongoDB _cannot_ be secured. Everybody knows that it can be. The question, instead, is: why does every user of MongoDB even need to make it secure?!

I doubt you can answer that honestly, but plenty of us suspect we know it anyway: because MongoDB Inc. "cares" a lot more about developer experience, than it does about their data.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#266

Post by pbhjpbhj » Thu, Jun 24, 2021, 12:03 PM UTC

kgeist wrote: post #110

dfadsadsf wrote: post #11

Earlier quoted context omitted.

Actually federal government resources are pretty limited and finding hackers is hard. What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country. Even if country if friendly, extradition is expensive and time consuming. After all that you may end up putting random 20 year old guy in jail for a few years without putting any dent in…

>What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country. It's possible if US law enforcement bothers working with their counterparts in "unfriendly" countries (I doubt they even reach out to them). Case in point: 10 years ago a bunch of Russian scammers scammed Americans out of thousands of dollars pretending to be a valid mai…

Why didn't USA police contact Russian police? Why was that left to citizens to do.

It may be problematic, but Russia are part of Interpol, so surely a record of the crime should have at least been made.

Sounds like apathetic policing.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#267

Post by anotherhue » Thu, Jun 24, 2021, 12:03 PM UTC

jd_mongodb wrote: post #238

pritambaral wrote: post #235

Earlier quoted context omitted.

> You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default. Serious: Listening on localhost-only works in dev environments only. In production, it is not the norm to run the application on the same host as Mongo, especially given what a resource hog Mongo is. So, for practical purposes, listen-on-localhost is actually an obstacle is needs t…

There wasn't a lot of information in your previous post. As I pointed out there are a comprehensive set of guidelines for enforcing security. Our defaults make it difficult to accidentally expose your data these days. However if you do add a MongoDB database to a public IP address we strongly encourage you to add a strong password. Better still do not expose your database on the public internet. Put it behind a firew…

Postgres containers won't start unless a password is set. Be like postgres.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#268

Post by anotherhue » Thu, Jun 24, 2021, 12:04 PM UTC

Aeolun wrote: post #255

gnyman wrote: post #129

Earlier quoted context omitted.

Glad someone else highlighted this old ticket. I bet this, in combination with the extremely irresponsible solution to ship mongodb without auth as default has caused countless of data leaks and destruction events. We just haven't heard about most of them. Elastic provides the same foot-gun. Last year someone deleted almost 4000 open mongodb and elastic databases in what was called the Meow attack [1]. In my opinion…

I’d argue that anyone that uses Mongo given those defaults is equally culpable

Mongo recruiters often reach out to me, I tell them that I'd never get that stain off my resume.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#269

Post by amphorasource » Thu, Jun 24, 2021, 12:10 PM UTC

canuckintime wrote: post #262

amphorasource wrote: post #229

Earlier quoted context omitted.

Samuel's nonchalant reply to this is highly disturbing to me. I'm a Newsblur customer and as far as I can tell, my feed data is in the hands of some hacker and he doesn't care at all. I am much less concerned about the service being restored, which seems to be all that he's worried about, and more about knowing who has my data. On top of that, I used to use his "forward newsletters to Newsblur" feature for a long tim…

> On top of that, I used to use his "forward newsletters to Newsblur" feature for a long time. I've long stopped using it and deleted all the feeds with newsletters, partly because it never worked very well, would you share your alternative?

Newsblur mangled the formatting of a very large amount of newsletters I forwarded. The grouping per sender was great, but not really worth it if many newsletters end up unreadable.

Considering Newsblur's solution relied on setting up (sender/subject) filters on your email provider, I just kept doing that, but instead of forwarding to Newsblur, I now direct them all to a separate folder.

Lost the grouping per sender, but I honestly didn't explore an alternative too much. Even if Newsblur didn't mess with the newsletters' HTML and displayed them as GMail does, it was just too much of liability to blindly forward emails to a third party service like that: many companies do obnoxious things like send transactional emails from the same address as their newsletters, or blur the line between what is bulk and targeted mail, and I'd rather not have things like emails with flight information and other random tidbits of personal data floating around in someone's MongoDB.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#270

Post by mercora » Thu, Jun 24, 2021, 12:11 PM UTC

dddddddddddd wrote: post #252

In production never ever use ufw or firewalld. Learn a few rules in iptables and that all or create a simple script. The problem with ufw or firewalld(not only with this 2) they add so many rules in iptables, that a human can do very easy mistakes or the rules are not on your control.

... even if you handcraft your rules, docker will still, by default, add its own rulesets... ive helped people bitten by this on occasions mostly because it changes the default forward policy to drop... its also really hard to manage this concurrently... i.e if you need to reload your own rulesets you need to tell docker to reinsert its own afterward or make sure you run after docker did its thing... oh and of course you should not just save your current rulesets either in order to leave the docker rulesets out of yours and still make sure you know how their rules will affect yours then... its horrible...