Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

281–290 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#281

Post by kristofferR »

miles wrote: post #185
markdown wrote: post #153

Earlier quoted context omitted.

> Heavy fine yes but not arrest AFAIK. Newsblur is an American org. GDPR is a foreign law that has no relevance to American firms lol.

> GDPR is a foreign law that has no relevance to American firms lol. I couldn't agree more with the spirit of your comment, but sadly the reality may be somewhat more nuanced: GDPR in the USA https://www.cookiebot.com/en/gdpr-usa/ " The GDPR has extra-territorial scope, which means that websites outside of the EU that process data of people inside the EU are obligated to comply with the GDPR. ... In fact, the very fi…

There's no sadly here, it's the opposite. In your world Facebook could still abuse European's privacy.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#282

Post by [deleted] »

GormanFletcher wrote: post #274
corobo wrote: post #259

Earlier quoted context omitted.

I'm on the same side of the argument as you and indeed I believe I feel as strongly about it as you. Especially in regards to brushing it off, calling them script kiddies[1], generally being "well aw shucks aren't I great for not deleting my copy of the data, I'm so great"[2] about the whole thing grinds my gears too. I'm saying whoever is ransoming the data already has the data, the data is out of Newsblur's control…

There is a material difference to users between a single attacker having (and possibly ignoring) a data dump, and that attacker publishing that dump publically, or selling it to someone who plans to exploit its contents. The attacker has offered to not publish if they are paid. Their word probably isn't worth much, but $1,000 seems like an affordable sum for a business to gamble on them being honest about it. And if…

[deleted]

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#283

Post by samhw »

corobo wrote: post #244
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

That's a lot of blame being placed outwards there. It doesn't matter how script kiddie a person is if they got past your security. Disappointing response, this. What data got leaked? Please let haveibeenpwned.com know if your system leaked emails or worse.

I think his point was _precisely_ that it was a stupid mistake on his part, and not a 'master hacker' subverting his defences. But I agree it's odd that he doesn't seem to have heard of defence in depth, and relied entirely on one UFW rule as opposed to also setting a password on Mongo and/or (preferably) configuring firewalls on the cloud provider level.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#284

Post by higeorge13 »

the_duke wrote: post #245
higeorge13 wrote: post #225

Earlier quoted context omitted.

I don’t get why the original response is downvoted. Of course you can run those in docker containers, but it is generally suggested that you don’t. From my experience i would run stateless services in containers and persistent storages in vms, dedicated servers, or cloud services.

People have been running database instances just fine on their own for decades, without the help of "big brother". There are reasons why running a high performance database instance in containers is problematic, but security is not one of them - not any more so than application containers. You just need to know what you are doing, it's not a black art.

I was not referring to security, otherwise completely agree.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#285

Post by exciteabletom »

schipplock wrote: post #228
pingec wrote: post #181

I am super scared of accidentally exposing a port to the internet. Is there a service / tool that I could provide with a list of all my public IP machines and it would keep port scanning them periodically, sending me a report of all open ports by email each month and sending me an email each time a new port becomes open to the public internet?

I use "nmap" for this. $ nmap example.com PORT STATE SERVICE 80/tcp open http 443/tcp open https 1119/tcp closed bnetgame 1935/tcp closed rtmp

A more complete answer using nmap and cron:

    MAILTO="youremail@yourdomain.com"
    */30 * * * * nmap yourdomain.com | grep open > nmap.log.tmp; diff nmap.log nmap.log.tmp; mv nmap.log.tmp nmap.log

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#286

Post by jd_mongodb »

alias_neo wrote: post #272
jd_mongodb wrote: post #224

Earlier quoted context omitted.

Did you follow our guidelines? https://docs.mongodb.com/manual/administration/security-chec... You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default.

I ran the Docker image, I'm not sure which docs I followed, it was a while ago, but in this case listening on localhost doesn't really apply. Docker, as we know will open exposed container ports to the world, that shouldn't really be the baseline though for not having your instance compromised in less time than it takes to enter an iptables rule correctly, or read the guidelines. I'm not trying to place blame, it was…

That "you must have compromised.." was in relation to the comment by pritambaral not your overall analysis.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#287

Post by jffry »

cunthorpe wrote: post #253
jacquesm wrote: post #119

The big takeaway here is that you simply should not use any technology on an internet facing server that you are not 100% committed to. There is no such thing as a 'casual' SaaS, you either dedicate the time and the effort required to intimately familiarize yourself with the crappy little details of all the tools you are using as well as their caveats or you will end up getting hacked. That said, software suppliers h…

> The likes of AWS already make it a bit harder to expose an insecure server Has this changed recently? S3 was a huge part of data leaks a few years ago, and that's basically a managed server.

Indeed, AWS has both made it more difficult to create a world-readable S3 bucket, and made it much more obvious in the UI. Some things I've noticed just clicking around the S3 console right now:

- There is an account-level S3 setting to instruct S3 to ignore public access grants in all buckets in that account (i.e. no matter how bucket is configured, public access is impossible).

- The list of S3 buckets in the S3 console homepage includes a prominent column saying if a bucket is private or not. Buckets that allow public access have a warning icon and red color in this column to make them stand out.

- When creating a new bucket, the default is "Block Public Access settings for this bucket". If you change this, it gives you a warning and asks you to check a box saying "I acknowledge that the current settings might result in this bucket and the objects within becoming public"

- When editing a bucket's access control list, if you grant public access, it asks you to acknowledge "When you grant access to the Everyone or Authenticated users group grantees, anyone in the world can access the objects in this bucket."

- Whenever you are looking at file listings or settings of a bucket with a public access rule in its ACL, the S3 console includes a prominent red "Publicly accessible" next to the bucket name in the top nav on every page

IMO, this is significantly better than how it used to be, and helps reduce or, with the account-level setting on, fully-eliminate accidentally public buckets.

The reality is that proper cross-account IAM role based access is still a little tricky to set up and difficult to test without coordinating with the other party, which means that this won't stop people looking to transfer data to some other account from making a bucket public and assuming it's OK as long as there is an obscure name for the bucket.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#288

Post by AtNightWeCode »

Aeolun wrote: post #263
AtNightWeCode wrote: post #182

Earlier quoted context omitted.

Kind of what I said. Firewalls are for blocking unwanted traffic. It should not be used as a replacement for other security measures. "unexpectedly open", well, there I simply disagree.

So if you have a firewall set to block everything, and you run a docker container that listens to your global IP, you expect it to magic your firewall for you?

Yes. I would assume that any service platform or services for that matter may have open ports as default and that you should place it in a private network with a proxy in front of it.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#289

Post by threeseed »

pritambaral wrote: post #235
jd_mongodb wrote: post #224

Earlier quoted context omitted.

Did you follow our guidelines? https://docs.mongodb.com/manual/administration/security-chec... You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default.

> You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default. Serious: Listening on localhost-only works in dev environments only. In production, it is not the norm to run the application on the same host as Mongo, especially given what a resource hog Mongo is. So, for practical purposes, listen-on-localhost is actually an obstacle is needs t…

> Listening on localhost-only works in dev environments only

You're awfully arrogant for someone who has no clue in how to properly architect systems.

If you're using Kubernetes then it's very common to have a service mesh in a Production environment to enforce certain safeguards e.g. mutual TLS and provide circuit breaking, auditing, logging etc. In which case MongoDB would be running on localhost.

If you're not using Kubernetes then it's also common to have some form of middleware to achieve the same as above e.g. HAProxy, F5. Again, in which case MongoDB would be running on localhost.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#290

Post by threeseed »

alias_neo wrote: post #272
jd_mongodb wrote: post #224

Earlier quoted context omitted.

Did you follow our guidelines? https://docs.mongodb.com/manual/administration/security-chec... You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default.

I ran the Docker image, I'm not sure which docs I followed, it was a while ago, but in this case listening on localhost doesn't really apply. Docker, as we know will open exposed container ports to the world, that shouldn't really be the baseline though for not having your instance compromised in less time than it takes to enter an iptables rule correctly, or read the guidelines. I'm not trying to place blame, it was…

> Docker, as we know will open exposed container ports to the world

Only if you choose to explicitly expose them.

In which case the fault is entirely with you.

Post reply on HN