db on public subnets are gross.
if it’s unavoidable, then monitoring your db isn’t reachable from the public internet is important.
A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
31–40 of 117 posts
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#32I am not able to follow the reasoning of this part of the write-up: The most important bit of information the above chart shows us is what a full database transfer looks like in terms of bandwidth. From 6p to 9:30p, the amount of data was the expected amount from a working primary server with multiple secondaries syncing to it. At 3a, you’ll see an enormous amount of data transfered. This tells us that the hacker was…
If this is what a backup looks like in terms of traffic and around the time of the hack there is no corresponding amount of traffic then the hacker never made the backup that they claim they made.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#33This is why you shouldn't be using Docker in production. It's a great tool, but it's simply not designed for that kind of environment.
Edit: note I said Docker specifically, nothing about containerization.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#34It's a pity that the chances of nailing the perps is so low. Obviously docker and the person that put this together share some of the blame but: the original internet would have never gotten off the ground if it wasn't for people cooperating with each other rather than to try to tear things down all the time. And with the chances of your average script kiddie/hacker/idiot getting caught being lower than a typical bik…
Perhaps security should be the next innovation. But I don't think it will be a technical innovation: there's enough tech and know-how to keep script-kiddies out. It's the lack of interest, the hunt for the MVP, the break-fast culture.
> I personally think they are utter trash.
In this case, even criminal, given the extortion attempt.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#35I am not able to follow the reasoning of this part of the write-up: The most important bit of information the above chart shows us is what a full database transfer looks like in terms of bandwidth. From 6p to 9:30p, the amount of data was the expected amount from a working primary server with multiple secondaries syncing to it. At 3a, you’ll see an enormous amount of data transfered. This tells us that the hacker was…
I think he's saying, at 3am his own database replication kicked off, and you can see a spike in the bandwidth usage. There's no similarly-sized unexplained spike that could correspond to the hacker exfiltrating the data.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#36It's a pity that the chances of nailing the perps is so low. Obviously docker and the person that put this together share some of the blame but: the original internet would have never gotten off the ground if it wasn't for people cooperating with each other rather than to try to tear things down all the time. And with the chances of your average script kiddie/hacker/idiot getting caught being lower than a typical bik…
If we accept that this is the default state of the Internet (insecure) then I think it is a correct assumption and forces everyone to think twice before exposing anything to the Internet by default. Here the default Docker behaviour was very much at fault but also the assumption that a Linux level firewall is good for Docker. We have docker deployments that are completely hidden behind NAT in AWS and such things are…
exactly. ideally, accidentally exposing your db to the internet should be all but impossible
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#37Just wanted to say that I recently started reading RSS again and NewsBlur has been excellent. It’s a good aggregator, has a great web interface, and a great iOS app. The free tier is all you need (so I guess I’ll need to pay just out of my desire to support).
I've been a subscriber for a long time now. Newsblur has been great. It's been pretty stable, and they haven't succumbed to frequent radical redesigns.
I could self-host an RSS reader, but Newsblur works well enough that I haven't bothered.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#38It's a pity that the chances of nailing the perps is so low. Obviously docker and the person that put this together share some of the blame but: the original internet would have never gotten off the ground if it wasn't for people cooperating with each other rather than to try to tear things down all the time. And with the chances of your average script kiddie/hacker/idiot getting caught being lower than a typical bik…
> NewsBlur is useful, destroying it serves no purpose at all. And make no mistake: the hacker clearly aimed to simply destroy it and pretend they have copied the data, so they were more than willing to do just that, wanton destruction for a miserly amount of money. Whoever did this may think they're l33t and cool but I personally think they are utter trash.
I doubt this was even specifically targeted at NewsBlur. Reading the article it sounds like it's just an automated attack that scans for any open mongo servers on the internet and does the same thing to any of them. Not that that's any better, really.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#39Great write-up. I remember how shocked I was a few years back when we moved our backend to a micro-service architecture and our native Postgres installation to a docker container. As (I suppose) almost everyone, we also used ufw to manage the firewall.
Security should be the default stance, and any port exposed through docker should initially be restricted to local only. Going global should be explicit, imo.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#40I am not able to follow the reasoning of this part of the write-up: The most important bit of information the above chart shows us is what a full database transfer looks like in terms of bandwidth. From 6p to 9:30p, the amount of data was the expected amount from a working primary server with multiple secondaries syncing to it. At 3a, you’ll see an enormous amount of data transfered. This tells us that the hacker was…
They know what the bandwidth graph looks like when a full DB replication/dump is in progress.
Since that level of data transfer only occurred once (when they did it), they know the attacker did not actually transfer any data.