Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

blog.newsblur.com

Post reply on HN
Print view View original

91–100 of 275 posts

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#91

Post by fulafel »

closeparen wrote: post #64
cratermoon wrote: post #42

Earlier quoted context omitted.

Clearly it was not fine, but in fact leaky, and depending only on perimeter security was (and is) flawed. See https://collaboration.opengroup.org/jericho/commandments_v1....

There was no perimeter security here. The attacker did not first enter a private network and then pivot to MongoDB; he dialed MongoDB right from the internet. Had Mongo been un-authenticated on a private network it still might have been owned, but the bar would have been a lot higher. Side note: everything that’s ever existed is “flawed,” it’s a weird word to use in the context of something you want to discredit, bec…

There were several pieces here that conspired to produce the unfortunate end result, the blackmailing attacker exploiting the broken perimeter security was just the last piece.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#92

Post by habibur »

jessikat wrote: post #72
jbverschoor wrote: post #53

Earlier quoted context omitted.

From 3.6 the default binding is localhost. That would be ook, except that if you mail the power, you listen to all interfaces. This will happen with Redis as well and is a problem with both docker and its dockerfile

Even on localhost, you should still use auth. One shouldn't naively assume someone can't break into your server.

If someone breaks into your server, database Auth won't protect you. And you have to reinstall everything including your database just to be sure he didn't leave holes in those.

And the hacker can still delete your database or steal your data. He will simply download the datafiles and then delete those data from the server. Drop database done without a database password. And no, databases aren't kept encrypted on the server.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#93

Post by nneonneo »

Network services really should have auth by default even if they only bind to localhost. There’s so many ways that a localhost service can become accessible to attackers. Any process with network access, no matter what user it’s running as, can access a localhost service - UNIX sockets on the other hand can be restricted by the usual user/group permissions. A localhost service can be exposed by e.g. an SSRF bug from a web server on the same machine. Or, accessed by a browser on the same machine browsing untrusted sites (an attack model for desktop services which open local ports), and so on. (In case you believe that the HTTP protocol restriction in the latter two cases protects you - protocol smuggling over HTTP is frighteningly effective!)

Of course, as seen here, a network service binding to more than localhost is strictly more exposed - and auth should be required in those cases (even when the service should ostensibly be LAN-only).

Secure-by-default is the best kind of security.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#94

Post by superasn »

grayhatter wrote: post #71

This isn't a footgun. A footgun is when something happens that should be expected, but isn't for reasons of negligence or ignorance to the thing that should be expected. The example that everyone seems to love is pointer arithmetic. If you make a basic error in your math, invalid memory access may occur and then likely more bad stuff. Docker altering firewall rules without explicit instructions to do so is either a f…

And now Google is picking up the definition of footgun(1) from Hacker news!

(1) https://i.imgur.com/pHlLFJA.png

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#95

Post by NavinF »

fulafel wrote: post #81

A big thing is that this also happens on your dev machine with "docker run". (Unless you know to use -p 127.0.0.1:1234:1234 instead of just -p 1234:1234 like all the examples on the web tell you.)

Alternatively, don't map any ports and instead use docker inspect to find the container's IP address and use that to talk to it. That way you don't have to map different ports for every container

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#96

Post by dnet »

habibur wrote: post #92
jessikat wrote: post #72

Earlier quoted context omitted.

Even on localhost, you should still use auth. One shouldn't naively assume someone can't break into your server.

If someone breaks into your server, database Auth won't protect you. And you have to reinstall everything including your database just to be sure he didn't leave holes in those. And the hacker can still delete your database or steal your data. He will simply download the datafiles and then delete those data from the server. Drop database done without a database password. And no, databases aren't kept encrypted on the…

Not necessarily -- there can be a number of reasons one can access localhost over the loopback interface that does _not_ imply root access: SSRF, misconfigured tunnels, or just a plain unpriviliged account where the attacker couldn't perform privilege escalation (either because the attacker's incompetence or the system being up-to-date and/or hardened)

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#97

Post by j1elo »

caymanjim wrote: post #62

Docker has worked like this for a long time. It's a really bad default, and they damn well ought to stop operating this way by default, but it's also like Docker Devops 101. When you install Docker on a Linux system, you should configure the DOCKER-USER chain to drop everything originating on your public network interface. You should also stop running services bound to localhost and instead run them on a private netw…

Would you know of some blog post or guide in the vein of "essential sane(r) defaults to apply after installing Docker" kind of tutorial? Which included, for example, the chain config you mentioned

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#98

Post by scottydelta »

I have been using ufw-docker script[1] to patch the ufw and docker issue on my servers. The docker containers are publically accessible even if you have ufw enabled and rules applied.

These days its better to use the hosting provider firewall on top of ufw. Leading providers like AWS, Hetzner etc all provide the feature to add firewall rules via their UI.

[1] https://github.com/chaifeng/ufw-docker

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#99

Post by Marsymars »

ljm wrote: post #18

The only question I can ask is, why Docker? Newsblur presumably existed before Docker.

It did, but by interesting coincidence, only really got traction when Google Reader shut down, which happened to be the same month of the initial release of Docker.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#100

Post by 1337shadow »

eganist wrote: post #9

It's not all that great blaming the victim. They clearly made the right moves with at least some of their configuration decisions and leaned on the underlying platform not being bonkers (but alas, it was: https://github.com/moby/moby/issues/4737 and https://github.com/moby/moby/issues/22054 ). Should they have hardened in all the other ways for defense in depth, e.g requiring authentication from localhost? Sure. Shou…

> Published ports

> This creates a firewall rule which maps a container port to a port on the Docker host to the outside world.

Source : https://docs.docker.com/config/containers/container-networki...

Requiring authentication from localhost does not seem relevant to me, given that the creds would be stored somewhere, either in memory either in a file anyway, but exposing a port is not "binding on localhost".

However testing your firewall after publishing a docker port seems common sense.

Indeed, that's how I found out Docker was using the DOCKER-USER iptables chain that you can customize:

https://docs.docker.com/network/iptables/

And that's how I made a simple firewall that works:

https://yourlabs.io/oss/yourlabs.docker/-/blob/master/tasks/...

Another thing, instead of using exposing ports like that, the easiest is to use Docker-Compose, so that your containers of a stack have their own private shared network, then you won't have to publish ports to make your services communicate. Otherwise, just create a private network yourself and containerize your stuff in it.

So for me that's two newbie mistakes which conducted to falling for this non targeted, script kiddie attack which has been going on since 2017.

But yeah, go ahead publish your ports instead of using docker networks how you should, "believe" in your firewall while you're at it, and then blame "docker footgun".

Post reply on HN