Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

271–280 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#271

Post by zbentley »

mafro wrote: post #258
jbrot wrote: post #155

Earlier quoted context omitted.

I know the CICD code I wrote and manage at work launches approximately a million docker containers a day, so I suspect the total number of docker containers used per day is well into the billions.

Do tell about where you would need a million docker images for a CICD pipeline.. It's either many apps, or some very complicated pipelines

Or many builds of the same app. Think compatibility matrix testing: take one suite of tests and run them against every one of hundreds of permutations of versions of their dependencies, one container each.

Not GP, just hypothesizing. This is what Travis matrixes do, for example.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#272

Post by alias_neo »

jd_mongodb wrote: post #224
alias_neo wrote: post #220

Earlier quoted context omitted.

I spun up Mongo on a cloud VM a while back to assess viability/suitability, it was Meow'd within 30 seconds, absolutely insane. I shut it down and moved on, we don't use Mongo to date.

Did you follow our guidelines? https://docs.mongodb.com/manual/administration/security-chec... You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default.

I ran the Docker image, I'm not sure which docs I followed, it was a while ago, but in this case listening on localhost doesn't really apply.

Docker, as we know will open exposed container ports to the world, that shouldn't really be the baseline though for not having your instance compromised in less time than it takes to enter an iptables rule correctly, or read the guidelines.

I'm not trying to place blame, it was an exploratory endeavour anyway, but Meow existed because security in Mongo is a guideline and not a rule

As someone who builds secure software solutions for a living it doesn't thrill me that security is often an "optional extra" (looking at you elastic).

If I asked our customers/users the same question you just asked me, and then followed it up with "You must have compromised...", I'd be in hot water.

A combination of factors contributed to us choosing not to use Mongo at the time, if we have such a need again, it will be considered without prejudice.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#273

Post by vultour »

beermonster wrote: post #86
ralphington wrote: post #55

Earlier quoted context omitted.

What kind of database auth did you have? Wouldn't they have had to access config files or related in order to obtain your passwords, usernames, etc?

I think by default mongodb has no enabled access control, so there is no default user or password.

Am I misunderstanding or do people launch their Mongo container without even MONGO_INITDB_ROOT_{USERNAME,PASSWORD}? It's clearly mentioned in the image README. Takes 15 seconds to set. I'd be incredibly concerned if anybody with more than a day of infrastructure experience did this, even worse on a production database.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#274

Post by GormanFletcher »

corobo wrote: post #259
amphorasource wrote: post #257

Earlier quoted context omitted.

You misunderstand. I paid Samuel and entrusted him with my data. Not too much, but enough for it to matter. When faced with a massive leak like this, he downplays everything, calls the hacker a "script kiddie" and calls this "good practice for what will be the first of many sleepless nights", looking at it only from a "service disruption" perspective. So far we've gotten no indication of what's been leaked, if it con…

I'm on the same side of the argument as you and indeed I believe I feel as strongly about it as you. Especially in regards to brushing it off, calling them script kiddies[1], generally being "well aw shucks aren't I great for not deleting my copy of the data, I'm so great"[2] about the whole thing grinds my gears too. I'm saying whoever is ransoming the data already has the data, the data is out of Newsblur's control…

There is a material difference to users between a single attacker having (and possibly ignoring) a data dump, and that attacker publishing that dump publically, or selling it to someone who plans to exploit its contents.

The attacker has offered to not publish if they are paid. Their word probably isn't worth much, but $1,000 seems like an affordable sum for a business to gamble on them being honest about it. And if Newsblur doesn't fix their security problems they'll be targeted again either way.

As someone who has a decade of data in Newsblur, if there's any chance that an affordable ransom will keep my data from spreading further I want Samuel to take it.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#276

Post by indymike »

pmontra wrote: post #46
conesus wrote: post #34

Earlier quoted context omitted.

In case anybody's interested, here's what the "hack" looks like: nbset:PRIMARY> show dbs READ__ME_TO_RECOVER_YOUR_DATA 0.000GB admin 0.000GB local 16.471GB newsblur 0.718GB nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA switched to db READ__ME_TO_RECOVER_YOUR_DATA nbset:PRIMARY> show collections README system.profile nbset:PRIMARY> db.README.find() { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All yo…

> you face a heavy fine or arrest Heavy fine yes but not arrest AFAIK. Anyway this is a script programed to scary the target. Do you even store personal data inside that database?

There's something about this threat that really is awful. The legal extortion angle. We'll turn you over to the regulator if you don't give us money. Aside the fact they can take the money and package you to the regulator anyway, with complete impunity, it seems like the regulation needs to be revised in some way to take this very serious threat out of the hands of people who will abuse it.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#277

Post by vultour »

Kiro wrote: post #203
UrielFanelli wrote: post #189

Earlier quoted context omitted.

I can infer so many errors in the architecture, I wonder how this may have survived so far. 1. you put your DB in a server which is exposed to the internet. 2. you have no VIP/NAT in front of your systems. 3. you rely in iptables , while knowing some automatic system is manipulating it. 3 hours? I wonder it took so long. I expect this infrastructure will be a script kiddies party room within a few minutes.

As someone who has been running multiple services with millions of users for decades: 1. I need to be able to connect to my DB from anywhere. 2. No idea what that even means. 3. Don't know. Never even touched the firewall. I have a PW on my DB and that's it. Why do I need more than that?

Why would you need to be able to connect to your database from anywhere?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#278

Post by marcos100 »

corobo wrote: post #244
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

That's a lot of blame being placed outwards there. It doesn't matter how script kiddie a person is if they got past your security. Disappointing response, this. What data got leaked? Please let haveibeenpwned.com know if your system leaked emails or worse.

Yeah, downplaying the guy who hacked you doesn't make it any better.

Actually it makes it worse, since your security is so bad that any "script kiddie" can hack into your system.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#279

Post by throwaway9870 »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

In addition to the comments I see here, one more note: seems like a lot of change at one time.

* Ansible

* Docker

* Big redesign

* New database cluster

* New firewall config

I have found great benefit to breaking problems down into smaller parts even though some times it causes some extra work.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#280

Post by SOLAR_FIELDS »

the_duke wrote: post #245
higeorge13 wrote: post #225

Earlier quoted context omitted.

I don’t get why the original response is downvoted. Of course you can run those in docker containers, but it is generally suggested that you don’t. From my experience i would run stateless services in containers and persistent storages in vms, dedicated servers, or cloud services.

People have been running database instances just fine on their own for decades, without the help of "big brother". There are reasons why running a high performance database instance in containers is problematic, but security is not one of them - not any more so than application containers. You just need to know what you are doing, it's not a black art.

Truth - I personally avoid doing so, but that’s only because I prefer not to introduce that extra layer of complexity into my stack due to lack of full understanding of the technology. There’s nothing stopping me from bothering to learn all the trade offs and pitfalls and doing so, but so far there hasn’t been enough of a compelling reason for me to go through that effort. I just go with the general advice “you usually don’t want to dockerize stateful applications” and leave it at that.
Post reply on HN