Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

blog.newsblur.com

Post reply on HN
Print view View original

31–40 of 275 posts

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#31

Post by whybotherwith »

>In NewsBlur’s case, because NewsBlur is a home of free speech, allowing users in countries with censored news outlets to bypass restrictions and get access to the world at large, the continuing risk of supporting anonymous Internet traffic is worth the cost.

This, the backups, the write-up, all make it really hard for me to want to victim-blame the dev for not catching a very silly Docker default.

That having been said - public ip? - no fw? - no password on the mongod instance?

Idk, couldn't be me, not even in dev, just take the 20 seconds to plumb the pw to both sides. Modding me down won't change these facts and won't keep you from being compromised if you take the same lazy steps

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#32

Post by qbasic_forever »

tedk-42 wrote: post #29

I'm a bit confused here about how this was a docker issue. Initially I thought there was some stuff happening with uPnP with a router/gateway of some sort ( https://en.wikipedia.org/wiki/Universal_Plug_and_Play ) If I run a docker container on my macbook and expose a port over 0.0.0.0 (docker run -d -p 8080:8080 nginx) and it's available on my LAN network, how does it get exposed over the internet? Unless there's a r…

It's not a problem on docker desktop for mac or windows. It's only an issue on linux, and only for systems that use iptables as a firewall (typically ubuntu/debian & ufw). And even more specifically it really only affects servers that are in a hosting environment with no other firewall or protection in front--Digital Ocean's default droplet config is a prime example, on AWS by default you have a cloud-specific firewall provided by Amazon's networking.

On your system docker is running in a little virtual machine that has its own linux kernel, virtual peripherals, etc. This gives you an extra layer of security (by pure happenstance) such that the VM has to allow traffic in too.

And this is kind of why this issue is so nasty. You as a mac user might never know that this is a problem or potential footgun. You could happily develop entire production services on your mac, then move them to a shared linux host like Digital Ocean and... uh oh, now your services are open and you had no idea it was even possible.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#33

Post by boardwaalk »

tedk-42 wrote: post #29

I'm a bit confused here about how this was a docker issue. Initially I thought there was some stuff happening with uPnP with a router/gateway of some sort ( https://en.wikipedia.org/wiki/Universal_Plug_and_Play ) If I run a docker container on my macbook and expose a port over 0.0.0.0 (docker run -d -p 8080:8080 nginx) and it's available on my LAN network, how does it get exposed over the internet? Unless there's a r…

Any old hosted server is going to public to the internet by default. There's no indication that this is hosted locally or in some private network (like AWS VPC).

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#34

Post by TheDong »

tedk-42 wrote: post #29

I'm a bit confused here about how this was a docker issue. Initially I thought there was some stuff happening with uPnP with a router/gateway of some sort ( https://en.wikipedia.org/wiki/Universal_Plug_and_Play ) If I run a docker container on my macbook and expose a port over 0.0.0.0 (docker run -d -p 8080:8080 nginx) and it's available on my LAN network, how does it get exposed over the internet? Unless there's a r…

It's fairly normal for a laptop to be on a network behind a router/gateway.

It's also fairly normal for a server to have public IPs associated with it directly, and for those IPs to be available to the public internet directly.

The latter is what probably happened here.

Newsblur appears to run on digital ocean, where I believe they still default to associating a public IPv4 address to each droplet, which again is pretty normal in the server world.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#39

Post by tedk-42 »

TheDong wrote: post #34
tedk-42 wrote: post #29

I'm a bit confused here about how this was a docker issue. Initially I thought there was some stuff happening with uPnP with a router/gateway of some sort ( https://en.wikipedia.org/wiki/Universal_Plug_and_Play ) If I run a docker container on my macbook and expose a port over 0.0.0.0 (docker run -d -p 8080:8080 nginx) and it's available on my LAN network, how does it get exposed over the internet? Unless there's a r…

It's fairly normal for a laptop to be on a network behind a router/gateway. It's also fairly normal for a server to have public IPs associated with it directly, and for those IPs to be available to the public internet directly. The latter is what probably happened here. Newsblur appears to run on digital ocean, where I believe they still default to associating a public IPv4 address to each droplet, which again is pre…

'Really normal in the server world' is something i heavily disagree with.

So there was no firewall then? https://www.digitalocean.com/blog/cloud-firewalls-secure-dro...

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#40

Post by closeparen »

cratermoon wrote: post #24

I can't help but be reminded that zero trust architecture for security has been a thing for at least a decade, and that the 2004 Jericho Forum concluded that perimeter security was illusory, more akin to a picket fence than a wall.

Perimeter security would have been just fine here. The breach occurred because the host was exposed directly to the internet, rather than e.g. sharing a private network with a load balancer.
Post reply on HN