Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

blog.newsblur.com

Post reply on HN
Print view View original

171–180 of 275 posts

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#171

Post by ahepp »

eru wrote: post #109
bombcar wrote: post #60

Earlier quoted context omitted.

This is perhaps the best arguments I’ve seen for a separate firewall device even if it’s in the cloud (and just software) - something on your box running as root may bypass your rules just to help you.

Alternatively, running all your services as VMs also helps. Having root in a VM doesn't typically give you any rights on the hypervisor (at least not on eg Xen).

Well, if they get root on your mongo vm they can still drop all your tables (or ransomware you) right? So would it make a difference in this particular case? Outside the VM tooling probably not being so insane as to bypass the firewall?

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#172

Post by aorth »

dirkc wrote: post #163

Just want to confirm I understand the issue here. 1. `docker run -p 0.0.0.0:6666:6666 ...` - docker will update the firewall to allow traffic to port 6666 2. `docker run -p 127.0.0.1:6666:6666 ...` - docker won't update the firewall. 3. `docker run -p 6666` - the port is published on 0.0.0.0 and a random port is opened on the host I see 3 being a little surprising, but 1 and 2 does what I would expect of it.

> 1. `docker run -p 0.0.0.0:6666:6666 ...` - docker will update the firewall to allow traffic to port 6666

I don't think Docker should touch the firewall whatsoever. Apache doesn't, nginx doesn't, PostgreSQL doesn't, etc. Why is Docker different? The sysadmin should decide that!

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#173

Post by bildung »

eganist wrote: post #169
bildung wrote: post #164

Earlier quoted context omitted.

> It's not all that great blaming the victim. Everyone wants to be treated as a (software) engineer here, but the engineer's perspective in this situation would be the opposite: The victims are the customers, and the perpetrator, acting in negligence, was Newsblur. Risk management is a core part of the engineer's job. https://www.sebokwiki.org/wiki/Risk_Management

> Everyone wants to be treated as a (software) engineer here, but the engineer's perspective in this situation would be the opposite: The victims are the customers, and the perpetrator, acting in negligence, was Newsblur. There can be multiple victims, multiple causes/threat actors, and overlap between two categories. But what's the end user a victim of in this case? Other than a brief lack of availability?

Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring?

Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#174

Post by simiones »

I see everyone discussing how much Docker is at fault, how much Mongo DB is at fault, how much NewsBlur should have had better settings, and I do agree to some extent.

However, the much worse problem seems to be the fact that NewsBlur didn't test their network connectivity with something as basic as a port scan. This wasn't some complex attack based on some complex code injection jumping through legitimate ports or anything: their machine had the Mongo port open when they thought it should be closed. This is the kind of thing that absolutely shouldn't make it past basic testing.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#175

Post by MaxBarraclough »

thatwasunusual wrote: post #41
rubyist5eva wrote: post #25

Crap like this is why I dont run docker. I'm glad RedHat took a principled stance on it and dropped it. Podman doesn't punch holes you didn't ask for in your firewall. What a ludicrous anti-feature.

That might be true, but regardless of docker (or other, similar solutions), shouldn't MongoDB have had auth protection?

I had the 'opposite' thought: if the whole system were in a VPC, Docker wouldn't have had the authority to expose a port to the outside world.

Looks like the author is ahead of both us. Later in the post he mentions both a planned transition to a VPC, and plans to beef up the security of MongoDB itself.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#176

Post by lvncelot »

kijin wrote: post #128
lvncelot wrote: post #119

Earlier quoted context omitted.

Doesn't that run counter to what devops actually should be? I know that in practice, this split is what happens at companies, but we should work to close that rift, not widen it.

Whatever devops is supposed to be, it shouldn't involve relying on a tool whose security characteristics the team does not fully understand. If requiring such knowledge results in widening a pre-existing rift, so be it.

That's true, and something that often gets lost in the acceleration of "devops culture". But, in my opinion, the consequence then should be to try to not use Docker at all, and look for alternatives (like Podman) instead of just taking control from the dev team.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#177

Post by eganist »

bildung wrote: post #173
eganist wrote: post #169

Earlier quoted context omitted.

> Everyone wants to be treated as a (software) engineer here, but the engineer's perspective in this situation would be the opposite: The victims are the customers, and the perpetrator, acting in negligence, was Newsblur. There can be multiple victims, multiple causes/threat actors, and overlap between two categories. But what's the end user a victim of in this case? Other than a brief lack of availability?

Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? Of course the behavior…

> Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring?

I don't understand the relevance of this to my original question.

> Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur.

Or this, for that matter

---

So that you have it, my original ask was: But what's the end user a victim of in this case? Other than a brief lack of availability?

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#178

Post by simiones »

berkes wrote: post #142
tigerBL00D wrote: post #141

I feel sorry for the victim, but it sounds like this whole setup is more or less careless. If your Docker configuration is the only thing that's stopping your database from being exposed - you should reconsider your approach to network and database security. At the very least there should be firewall protection at host level. Further is a standard procedure to put unsecure endpoints in a private VPC that's not access…

> At the very least there should be firewall protection at host level If you read the Footgun at https://github.com/moby/moby/issues/4737 , this is exactly what happens: someone sets up a conservative firewall, then Docker drills holes in it and opens itself up to the world, regardless of your firewall.

Isn't this to a much greater extent UFW's fault? If it claims to manage the firewall for your system, I would expect it to manage all of iptables, not just one particular chain that it thinks is important. At the very least, I would expect it to signal when there are other chains configured in iptables that it can't/won't manager for you.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#179

Post by bildung »

eganist wrote: post #177
bildung wrote: post #173

Earlier quoted context omitted.

Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? Of course the behavior…

> Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? I don't understand t…

Your actual original point was:

> It's not all that great blaming the victim.

Which is what I was replying to.

Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker Newsblur customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#180

Post by maple3142 »

aorth wrote: post #172
dirkc wrote: post #163

Just want to confirm I understand the issue here. 1. `docker run -p 0.0.0.0:6666:6666 ...` - docker will update the firewall to allow traffic to port 6666 2. `docker run -p 127.0.0.1:6666:6666 ...` - docker won't update the firewall. 3. `docker run -p 6666` - the port is published on 0.0.0.0 and a random port is opened on the host I see 3 being a little surprising, but 1 and 2 does what I would expect of it.

> 1. `docker run -p 0.0.0.0:6666:6666 ...` - docker will update the firewall to allow traffic to port 6666 I don't think Docker should touch the firewall whatsoever. Apache doesn't, nginx doesn't, PostgreSQL doesn't, etc. Why is Docker different? The sysadmin should decide that!

Maybe it is more convenient to developer so that they don't have to touch the firewall? Docker is not only used by sysadmin.
Post reply on HN