Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

blog.newsblur.com

Post reply on HN
Print view View original

231–240 of 275 posts

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#231

Post by web007 »

nneonneo wrote: post #93

Network services really should have auth by default even if they only bind to localhost . There’s so many ways that a localhost service can become accessible to attackers. Any process with network access, no matter what user it’s running as, can access a localhost service - UNIX sockets on the other hand can be restricted by the usual user/group permissions. A localhost service can be exposed by e.g. an SSRF bug from…

I don't see how NewsBlur is getting a pass on this and Docker is taking all of the blame. Would they still get sympathy if they had "password" as their DB password and were hacked that way?

I would blame MongoDB for its default-insecure configuration. There's no excuse. It's been like that for at least a decade (when I last used it) and it was a bad choice even then. At a _minimum_ when they upgraded the engine to integrate WiredTiger they should have pushed that through as part of the breaking change.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#232

Post by mtberatwork »

ex_amazon_sde wrote: post #167
eru wrote: post #104

Earlier quoted context omitted.

To be honest, I know how to type `./configure`, `make` and `make install`. And I know more about Gnu Make than I would admit in a job interview (for fear of someone expecting me to work with Make). But so far, life has been too short for me to waste my time on Gnu Autoconf. And I don't feel guilty about this, or like someone who doesn't know fundamentals. Autoconf is by all accounts a horrible system. Gnu Make ain't…

> So I can't fault people for trying to avoid this mess. Ex-Amazon here. Being deeply familiar with OS fundamentals and internals, "low level" tools, and so on is crucial. A lot of candidates show to interviews with CVs filled with names of popular frameworks and fancy devops tools and often don't understand what really happens behind the curtain. People are becoming less familiar with the basics and tend to reinvent…

I'm not saying you are wrong but this sounds like it is in part a hiring problem.

> Being deeply familiar with OS fundamentals and internals, "low level" tools, and so on is crucial.

...needs to be front and center on the job description then. Far too often these kinds of things are hidden on the initial job descriptions and it just wastes everyone's time. I get that HR/recruiters want to throw a big net but vague job descriptions are often part of the problem.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#233

Post by simiones »

papito wrote: post #207
simiones wrote: post #174

I see everyone discussing how much Docker is at fault, how much Mongo DB is at fault, how much NewsBlur should have had better settings, and I do agree to some extent. However, the much worse problem seems to be the fact that NewsBlur didn't test their network connectivity with something as basic as a port scan. This wasn't some complex attack based on some complex code injection jumping through legitimate ports or a…

As the after-action report concludes, which is painfully obvious as you read this - should have been in a VPC.

But even before talking about the fix: the setup should have been tested, ideally before it was deployed (if possible).

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#234

Post by rashkov »

eganist wrote: post #9

It's not all that great blaming the victim. They clearly made the right moves with at least some of their configuration decisions and leaned on the underlying platform not being bonkers (but alas, it was: https://github.com/moby/moby/issues/4737 and https://github.com/moby/moby/issues/22054 ). Should they have hardened in all the other ways for defense in depth, e.g requiring authentication from localhost? Sure. Shou…

that first issue links to a really great flow-chart of how iptables works: https://cesarti.files.wordpress.com/2012/02/iptables.gif

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#235

Post by Alupis »

mschuster91 wrote: post #152
Alupis wrote: post #83

Earlier quoted context omitted.

MySQL/MariaDB have a completely open root account too... although default firewall rules should prevent public access too, unless Docker likes to punch that hole open too. Yes, root account password and access permissions should be changed upon a fresh install, but the real issue here is Docker's "helpfulness" by opening ports without explicit permission. That's absurd, and has no reasonable excuse.

> MySQL/MariaDB have a completely open root account too... That's flat out wrong. You can't start MySQL/MariaDB docker images without either explicitly specifying a root password, have it generate a random one on the first start of the container, or explicitly allowing an empty password. Regarding native installs of MySQL/MariaDB, the situation is a bit more murky, but at least the Ubuntu/Debian packages will ask you…

I don't believe this is true. `mysql_secure_installation` script exists to create a password on the root account, and disable root@'%'. If what you said about the Docker image is true, this article wouldn't exist either.

Regardless, a supposed "enterprise" tool shouldn't start changing your config in surprising ways, like punching firewall holes without explicitly being asked to do so. That's just crazy...

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#236

Post by tbarbugli »

So basically he messed up something basic and he is passing the blame to the tool he used? I would fell much more sympathetic if he acknowledged his mistakes instead of flexing muscles and throwing Docker/MongoDB under the bus.

The clear mistake here is allowing incoming traffic on 0.0.0.0/32

Disclaimer: I am not into Docker or Mongodb

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#237

Post by [deleted] »

goodpoint wrote: post #160
fulafel wrote: post #90

Earlier quoted context omitted.

I'd argue an equally big problem here is this setting is that engineers have been taught to think in a perimeter security mindset.

No: good security is layered aka "defense-in-depth". docker breaches the localhost VS external port security model (and others)

[deleted]

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#238

Post by tbarbugli »

simiones wrote: post #174

I see everyone discussing how much Docker is at fault, how much Mongo DB is at fault, how much NewsBlur should have had better settings, and I do agree to some extent. However, the much worse problem seems to be the fact that NewsBlur didn't test their network connectivity with something as basic as a port scan. This wasn't some complex attack based on some complex code injection jumping through legitimate ports or a…

yes, the author made a junior dev mistake and he is trying to blame [tool name here].

Making mistakes like this sucks but passing the blame makes it even worse.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#240

Post by nightpool »

ryukafalz wrote: post #86

> If a rogue database user starts deleting stories, it would get noticed a whole lot faster than a database being dropped all at once. This feels like an odd statement. Surely a database being dropped all at once is about the loudest possible thing that could happen to a database-reliant application?

I was puzzled as well, but I think "faster" here should maybe be read as "noticed in time to do something about it"
Post reply on HN