Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

321–330 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#321

Post by 29athrowaway »

achillean wrote: post #152
mr_o47 wrote: post #49

Earlier quoted context omitted.

How does shodan works like how do they know if something is exposed to the internet. Are they scanning networks 24/7 I’m just a noob in security so therefore learning

Here is an overview of what Shodan is: https://help.shodan.io/the-basics/what-is-shodan The scanning algorithm is mostly just this: 1. Generate a random IPv4 address 2. Select a random port from a list of ~2k ports 3. Check the random IP on the random port 4. Store the result of the check 5. GOTO 1 The above loop runs endlessly and because IPv4 is fairly small it doesn't take long to check everything.

Is there a way to opt-out from the scans?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#322

Post by threeseed »

pritambaral wrote: post #303
threeseed wrote: post #289

Earlier quoted context omitted.

> Listening on localhost-only works in dev environments only You're awfully arrogant for someone who has no clue in how to properly architect systems. If you're using Kubernetes then it's very common to have a service mesh in a Production environment to enforce certain safeguards e.g. mutual TLS and provide circuit breaking, auditing, logging etc. In which case MongoDB would be running on localhost. If you're not usi…

So I need either 1. Kubernetes and a service mesh; or 2. HAProxy or F5; just to secure access to a database?! Especially when the database is already capable of TLS mutual auth?! Is this what your claim of skill in "how to properly architect systems" comes from?! Needless over-architecting? Look, I've done my fair share of fronting services (including DBs) using TLS/SSH proxies and load balancers. When I needed them.…

I've worked for a number of the Fortune 10, banks, telcos etc.

Everyone has put some sort of middleware between their applications and databases.

Your claim that no one is running databases on localhost is simply your ignorance.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#323

Post by asteroidbelt »

slver wrote: post #194
asteroidbelt wrote: post #63

Earlier quoted context omitted.

Then consultants go to jail. And if these consultants are in China or some other country, then the law can be formulated in a way someone should go to jail. Top managers will deny everything, but FBI will start investigations, the will be a whistleblower, and eventually FBI will offer a deal to some middle manager to testify in court that top managers knew that "consultants" were actually hackers. This will be enough…

> Then consultants go to jail. Because they'll just call 911 and say "I just paid ransom under cover"? You know this is why incompetent lawmakers terrify me. They believe they can just be "tough" and everyone just falls in line instead of trying the infinite loopholes you leave open, each of which is a better outcome for them than the draconian path drawn by the law in spirit. If you make payment illegal, not only yo…

> Because they'll just call 911 and say "I just paid ransom under cover"?

Because some whistleblower will leak it (or just some person who is seeking their 15 minutes of fame).

Or because there's a transaction to China by a company which never worked with China. Like if you paid to a security consultant company based in China, and that consultant company was registered a week ago, and the website was down for a week, that is a reason to start investigation.

Oh, by the way, a law may mandate disclosure of a ransom request like within three days. So even if the FBI couldn't prove the consultants were fake, the company can be still be fined for not disclosing the request.

> STRONG INCENTIVE for them to keep the whole thing a SECRET

I suspect companies which pay ransom now don't exactly shout about it on every corner. Only those who refuse to pay do so.

> You're shooting your own foot.

How it could be worse than it is now?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#324

Post by pritambaral »

threeseed wrote: post #322
pritambaral wrote: post #303

Earlier quoted context omitted.

So I need either 1. Kubernetes and a service mesh; or 2. HAProxy or F5; just to secure access to a database?! Especially when the database is already capable of TLS mutual auth?! Is this what your claim of skill in "how to properly architect systems" comes from?! Needless over-architecting? Look, I've done my fair share of fronting services (including DBs) using TLS/SSH proxies and load balancers. When I needed them.…

I've worked for a number of the Fortune 10, banks, telcos etc. Everyone has put some sort of middleware between their applications and databases. Your claim that no one is running databases on localhost is simply your ignorance.

> I've worked for a number of the Fortune 10, banks, telcos etc.

Are you seriously claiming that the only production users of DBs are "Fortune 10, banks, telcos"?! Or are you claiming that because those guys do something a certain way, everyone else must also do it like that?! This is a weird variation of the Argument to Authority, and even more flawed than the original.

> Everyone has put some sort of middleware between their applications and databases.

Really? "Everyone"? Or are you just generalising the state of the entire industry based off of your limited experience with a small number of players in it?

> Your claim that no one is running databases on localhost

I made no such claim. I said it's "not the norm" and that it's "untenable", not that "no one does it". It doesn't matter that there are a few examples you've seen that do; they're not representative of the entire industry.

On the other hand, for the vast majority of the industry who run databases in production, my claims hold.

The vast majority of the industry, that does not include "Fortune 10, banks, telcos".

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#325

Post by indymike »

Avamander wrote: post #319
indymike wrote: post #276

Earlier quoted context omitted.

There's something about this threat that really is awful. The legal extortion angle. We'll turn you over to the regulator if you don't give us money. Aside the fact they can take the money and package you to the regulator anyway, with complete impunity, it seems like the regulation needs to be revised in some way to take this very serious threat out of the hands of people who will abuse it.

This is just an another reason why user data should be dealt with very carefully, not a reason to nerf the legislation designed to dissuade people being careless.

Agree with user and customer data being handled with care, but I do not like seeing criminals using the law to further a criminal enterprise. That is problematic.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#326

Post by pas »

threeseed wrote: post #291
eecc wrote: post #168

Accidentally (or because of some other tool’s poor design) open up a server to the WWW. But unauthenticated unfettered remote admin access by default?! Is it still a thing for Mongo? Oh my! I guess that’s what you get when the “conversion funnel” guys take over “engineering”

> Is it still a thing for Mongo? No. Hasn't been for years. > I guess that’s what you get when the “conversion funnel” guys take over “engineering” That's also what you get when you post rubbish without even bothering to check.

The convenient "mongo" docker image is still default open.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#327

Post by hnick »

achillean wrote: post #304
hnick wrote: post #239

Earlier quoted context omitted.

If everyone somehow magically switched to the much larger IPv6 address space would that be a big problem for you?

We also crawl IPv6 but it's a very different and more complicated algorithm. We would still end up crawling a sizable chunk but there are obviously unknowns in how biased our dataset would be (i.e. we might index mostly cloud servers and fewer residential devices).

That's what I thought, you might have to maintain a map of ISPs and such but even then it'd be hard to find all the clients under them.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#328

Post by lmm »

unionpivo wrote: post #208
lmm wrote: post #201

Earlier quoted context omitted.

In reality time and attention are limited resources. Does network-level filtering have a good RoI relative to putting the same effort into improving security at the service level? IMO no (at least not until you've reached a very high level of service security where you're hitting severely diminishing returns) - network-level security is necessarily at least one of a) crude b) complex enough that it becomes an attack…

You are looking it as a network level filtering. I am looking at, make private network, and then you have to explicitly add an gateway (usually a load balancer) that can access it. In short don't design system where you need to filter, design the system, where you need to take explicite action, to make something public. This is easily, done on something like AWS.

The very concept of a "private network" leads you down the path of making a security boundary that has far too large a surface area, IME. Either it becomes a big bag with all your hosts in it, and you write systems that trust all the requests they get (even if you know you "shouldn't") because you know only your systems are on the network, and then an attacker figures out how to make one of your systems make an arbitrary request and you get owned. Or you put each component on its own private network but then you have to open up every port you're actually listening on so that your components can talk to each other (and you probably automate that in your kubernetes/puppet/whatever setup, like what happened here with docker) and the private network does nothing.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#329

Post by lmm »

lowbloodsugar wrote: post #293
lmm wrote: post #166

Earlier quoted context omitted.

> there is no excuse for not having defense in depth. An old school DMZ if you are in a datacenter. A VPC if you are on the cloud. Then client certs for everything. Two factor for ssh. Auditing. Maybe there is no excuse, but literally every company I've worked for (including Fortune 500s) has been missing at least one item from your list. So "industry best practice" means committing less time and money than it would…

So the excuse is "my company doesn't take infosec seriously". Like every similar issue of "should do but don't" (testing, formal promotion processes, diversity, harassment response), you get to decide to tolerate it or get a job elsewhere. My experience is that the companies that take this stuff seriously also do a better job of converting my skills into cash, and as a result, pay me better.

Interesting. My experience is that companies that "move fast and break things" have been better at making money and paying me (whereas I personally lean too far in the perfectionist direction). Interesting businesses face a wide range of risks - competition, regulatory, market - and infosec is rarely the biggest one IME.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#330

Post by nirui »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

> Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world

Oh boi. I just knew(0) that default value is problematic.

Too bad this time it caused somebody real money.

(0): https://news.ycombinator.com/item?id=26678025

Post reply on HN