If you have backups there is nothing to hold hostage. I wish people would refrain from bombastic titles like these.
Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
301–310 of 336 posts
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#302Accidentally (or because of some other tool’s poor design) open up a server to the WWW. But unauthenticated unfettered remote admin access by default?! Is it still a thing for Mongo? Oh my! I guess that’s what you get when the “conversion funnel” guys take over “engineering”
> Is it still a thing for Mongo? No. Hasn't been for years. > I guess that’s what you get when the “conversion funnel” guys take over “engineering” That's also what you get when you post rubbish without even bothering to check.
Is it? https://docs.mongodb.com/manual/administration/security-chec...
No matter how you twist it, it doesn't have the same meaning as the common English phrase: "enabled by default".
And mind your manners...
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#303Earlier quoted context omitted.
> You must have compromised the binding to localhost in some way to allow this to happen as MongoDB only listens on localhost by default. Serious: Listening on localhost-only works in dev environments only. In production, it is not the norm to run the application on the same host as Mongo, especially given what a resource hog Mongo is. So, for practical purposes, listen-on-localhost is actually an obstacle is needs t…
> Listening on localhost-only works in dev environments only You're awfully arrogant for someone who has no clue in how to properly architect systems. If you're using Kubernetes then it's very common to have a service mesh in a Production environment to enforce certain safeguards e.g. mutual TLS and provide circuit breaking, auditing, logging etc. In which case MongoDB would be running on localhost. If you're not usi…
So I need either 1. Kubernetes and a service mesh; or 2. HAProxy or F5; just to secure access to a database?! Especially when the database is already capable of TLS mutual auth?! Is this what your claim of skill in "how to properly architect systems" comes from?! Needless over-architecting?
Look, I've done my fair share of fronting services (including DBs) using TLS/SSH proxies and load balancers. When I needed them. But the question isn't if any of that can be done or needs be done. The question is: Why does MongoDB, which has all of these security support built-in, not enable them out of the box?
And your answer to that is ... throw more stuff on top of it?! Are you seriously claiming that every production user of MongoDB should take on so much software surface area just to fix the broken defaults Mongo ships with?! This is worse than what even MongoDB Inc. does; at least they document how to enable security (lol, what a concept) and merely automatically blame the user for all lapses.
And no, k8s service meshes and LBs in front of DBs aren't nearly as common in production as you're claiming.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#304Earlier quoted context omitted.
Here is an overview of what Shodan is: https://help.shodan.io/the-basics/what-is-shodan The scanning algorithm is mostly just this: 1. Generate a random IPv4 address 2. Select a random port from a list of ~2k ports 3. Check the random IP on the random port 4. Store the result of the check 5. GOTO 1 The above loop runs endlessly and because IPv4 is fairly small it doesn't take long to check everything.
If everyone somehow magically switched to the much larger IPv6 address space would that be a big problem for you?
We also crawl IPv6 but it's a very different and more complicated algorithm. We would still end up crawling a sizable chunk but there are obviously unknowns in how biased our dataset would be (i.e. we might index mostly cloud servers and fewer residential devices).
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#305Earlier quoted context omitted.
There wasn't a lot of information in your previous post. As I pointed out there are a comprehensive set of guidelines for enforcing security. Our defaults make it difficult to accidentally expose your data these days. However if you do add a MongoDB database to a public IP address we strongly encourage you to add a strong password. Better still do not expose your database on the public internet. Put it behind a firew…
Postgres containers won't start unless a password is set. Be like postgres.
Given the famed hatred MongoDB Inc. has for Postgres, I half suspect they might be doing this partly out of pure spite towards Postgres. "Eww, no. We won't do that. _Postgres_ does that."
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#306Earlier quoted context omitted.
I ran the Docker image, I'm not sure which docs I followed, it was a while ago, but in this case listening on localhost doesn't really apply. Docker, as we know will open exposed container ports to the world, that shouldn't really be the baseline though for not having your instance compromised in less time than it takes to enter an iptables rule correctly, or read the guidelines. I'm not trying to place blame, it was…
That "you must have compromised.." was in relation to the comment by pritambaral not your overall analysis.
It is demonstrably obvious this is a lie:
The first time I commented in this whole discussion was _in reply to_ your "you must have compromised ...".
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#307Earlier quoted context omitted.
I know the CICD code I wrote and manage at work launches approximately a million docker containers a day, so I suspect the total number of docker containers used per day is well into the billions.
Do tell about where you would need a million docker images for a CICD pipeline.. It's either many apps, or some very complicated pipelines
We have a suite of about two thousand integration tests and we run each test in its own docker container for isolation purposes. Multiply by 500 jobs a day and you get to a million containers.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#308Earlier quoted context omitted.
Oooph, good luck. And when you have time please make Docker aware that this well known foot-gun has finally done serious harm. They have known and ignored for years that iptables/ufw on Linux is totally broken and wide open when using Docker: https://github.com/moby/moby/issues/4737
It is 100% unfair to blame Docker for this foot-gun, especially because they cannot really do anything to fix it, because that's how the firewall works in the Linux kernel. Look: Podman has exactly the same issue when not running rootless. The root cause is that IP packets going to the containers are not going through the INPUT chain of the "filter" table (they go through FORWARD), while various firewall projects lik…
Horribly contrived- but you can run rootless docker with slirp4netns if you:
* Install slirp4netns
* DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER="slirp4netns"
* Upgrade to rootless docker 20.10.7 or higher (was bugged in 20.10.6. Yup.. bad.)
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#309If you have backups there is nothing to hold hostage. I wish people would refrain from bombastic titles like these.
That's not true, they have your private user data and you may not want them releasing that to the world.
Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
#310Earlier quoted context omitted.
I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…
Just want to yes and you. In general, put everything in private subnets, and make the only way any traffic can get to a server is through a load balancer. There are very few reasons to have a server itself have its own public IP address, and using your load balancer as a chokepoint, means you can set up layers and layers of redundancy to prevent traffic from ever being able to reach a database under your control. Thi…
"Private subnet" is just one way to accomplish it - what you want is a firewall that drops inbound traffic by default, and private subnet/NAT is one common way to do it that does have some downsides (extra complexity - you need a NAT gateway now).