Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

blog.newsblur.com

Post reply on HN
Print view View original

61–70 of 275 posts

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#61

Post by bombcar »

TheDong wrote: post #34
tedk-42 wrote: post #29

I'm a bit confused here about how this was a docker issue. Initially I thought there was some stuff happening with uPnP with a router/gateway of some sort ( https://en.wikipedia.org/wiki/Universal_Plug_and_Play ) If I run a docker container on my macbook and expose a port over 0.0.0.0 (docker run -d -p 8080:8080 nginx) and it's available on my LAN network, how does it get exposed over the internet? Unless there's a r…

It's fairly normal for a laptop to be on a network behind a router/gateway. It's also fairly normal for a server to have public IPs associated with it directly, and for those IPs to be available to the public internet directly. The latter is what probably happened here. Newsblur appears to run on digital ocean, where I believe they still default to associating a public IPv4 address to each droplet, which again is pre…

And more and more things are getting publicly routable ipv6 addresses even when behind an ipv4 NAT device.

So if you’re not careful you may be exposed on ipv6 even if incidentally protected on ipv4 by the NAT.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#62

Post by caymanjim »

Docker has worked like this for a long time. It's a really bad default, and they damn well ought to stop operating this way by default, but it's also like Docker Devops 101. When you install Docker on a Linux system, you should configure the DOCKER-USER chain to drop everything originating on your public network interface. You should also stop running services bound to localhost and instead run them on a private network. You can proxy any traffic that really ought to be allowed through from the outside, or if you can't do that for some reason, then make a single exception to the iptables and host binding rules for that one container.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#64

Post by closeparen »

cratermoon wrote: post #42
closeparen wrote: post #40

Earlier quoted context omitted.

Perimeter security would have been just fine here. The breach occurred because the host was exposed directly to the internet, rather than e.g. sharing a private network with a load balancer.

Clearly it was not fine, but in fact leaky, and depending only on perimeter security was (and is) flawed. See https://collaboration.opengroup.org/jericho/commandments_v1....

There was no perimeter security here. The attacker did not first enter a private network and then pivot to MongoDB; he dialed MongoDB right from the internet. Had Mongo been un-authenticated on a private network it still might have been owned, but the bar would have been a lot higher.

Side note: everything that’s ever existed is “flawed,” it’s a weird word to use in the context of something you want to discredit, because then your alternative had better be “flawless” and it obviously isn’t.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#65

Post by ViViDboarder »

whybotherwith wrote: post #31

>In NewsBlur’s case, because NewsBlur is a home of free speech, allowing users in countries with censored news outlets to bypass restrictions and get access to the world at large, the continuing risk of supporting anonymous Internet traffic is worth the cost. This, the backups, the write-up, all make it really hard for me to want to victim-blame the dev for not catching a very silly Docker default. That having been s…

The problem with the Docker default is that they did have a firewall configured but Docker will reconfigure it.

That said, some external firewall would prevent this. My VPS provider allows me to configure which ports I want to expose to the outside world which would mitigate this kind of issue.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#66

Post by ramraj07 »

The biggest issue with docker is the false sense of security it seems to give a lot of engineers into thinking they know infra when they really don't. I stay away from this because I don't understand it fundamentally, and now this proves it's better to not think these new technologies are your friend unless you actually know what you're doing (which apparently most don't).

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#67

Post by haimez »

wyldfire wrote: post #63

Does mongodb still ship in a no-auth-required-by-default mode? I could've sworn that was the case years ago at the early NoSQL days. But if they're still around, surely they must have fixed that by now?

Based on my comments and the reply from a mongo employee in the previous thread about this: yes, they changed the defaults in 2017: https://news.ycombinator.com/item?id=27613761

That said, it also seems like the docker images are a different beast, so be careful what containers you ship and with what configuration…

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#68

Post by buzzert »

> In case of refusal to pay, we will contact the General Data Protection Regulation, GDPR and notify them that you store user data in an open form and is not safe. Under the rules of the law, you face a heavy fine or arrest and your base dump will be dropped from our server!

Does anybody know if this threat is at all credible?

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#69

Post by xeromal »

caymanjim wrote: post #62

Docker has worked like this for a long time. It's a really bad default, and they damn well ought to stop operating this way by default, but it's also like Docker Devops 101. When you install Docker on a Linux system, you should configure the DOCKER-USER chain to drop everything originating on your public network interface. You should also stop running services bound to localhost and instead run them on a private netw…

This feels like something you might forget if it's just been running for a while.
Post reply on HN