Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MongoHQ Security breach

security.mongohq.com

Post reply on HN
Print view View original

111–120 of 130 posts

Re: MongoHQ Security breach

#111

Post by orblivion »

alexandros wrote: post #28
theboss wrote: post #13

One thing I hate seeing is startups and security. Not that mongo is bad or anything this is just a good time to say it. Build your product correctly from the start and have a security policy early. Don't leave XSS in your website, don't just hack code together and throw it on a server. As a security guy I love seeing new startups products because so often the code is so freshly written and immature that anyone it's a…

Some times taking more time (and/or better coders) to do something 'right' vs. just hacking it together is the difference between failure and success. So from an individual startup's POV this may not be worth doing. Having enough users/success to warrant a security breach is a luxury problem when viewed from the eyes of an entrepreneur with no product. On the other hand, collectively, startups losing everyone's crede…

And yet companies do take a lot of care when it comes to design and usability. This tells me that if customers were to be more aware and security conscious, everything would fall into place. Startups would cut corners there no more than they do with usability. Right now there's a perverse incentive, if they do the right thing, they fall behind the competition. But if the competition has to do it, it's not a problem.

Re: MongoHQ Security breach

#112

Post by olefoo »

ams6110 wrote: post #92
biot wrote: post #12

Long story short: MongoHQ is securing access to critical administration functionality behind a VPN and will be requiring two-factor authentication instead of having that functionality available to anyone on the internet via a simple password. What's interesting is that I think we've all been there at one point. You start building something, it gains momentum, then you get so bogged down with adding functionality and…

that functionality [critical administation functionality] available to anyone on the internet via a simple password I mean COME ON, MAN.... there are mistakes, and then there's incompetence.

It depends on the simplicity of the password...

I mean yeah if the password was 'letme1n' that's one thing. Whereas if it's a "at least 16 characters, mixed cased, punctuation and no english words"; maybe that's another.

But, I would have thought at the very least, ssh with keys-only on the external-facing bastion host.

Re: MongoHQ Security breach

#113

Post by tsenkov »

Disclaimer: I haven't used MongoHQ.

Yesterday, I decided to go with MongoHQ for my current project and this morning I saw they got hacked. Irony aside, couple of months back I decided to check AppFog (PaaS) and the next day they were acquired. :)

I believe this is a great time to become a new user of MongoHQ - security has been tightened, experience has been built. The "storm is over" and the chances of a new "storm" in near future (with the measures these guys have taken) have decreased substantially.

I think they reacted pretty impressively, once the breach was detected.

As much as I understood, the biggest flaw in their operations was the fact that many/all internal/support systems were exposed publicly and not within a VPN.

Still, they were around for just about 2 years, which isn't that much time, after all.

Re: MongoHQ Security breach

#114

Post by nthj »

olefoo wrote: post #112
ams6110 wrote: post #92

Earlier quoted context omitted.

that functionality [critical administation functionality] available to anyone on the internet via a simple password I mean COME ON, MAN.... there are mistakes, and then there's incompetence.

It depends on the simplicity of the password... I mean yeah if the password was 'letme1n' that's one thing. Whereas if it's a "at least 16 characters, mixed cased, punctuation and no english words"; maybe that's another. But, I would have thought at the very least, ssh with keys-only on the external-facing bastion host.

What with keyboard loggers, unsecured wifi, video cameras, stolen computers, stolen iPhones (with email access, now you're vulnerable to password resets), there are just too many attack vectors for even a 16 character password to suffice. You need to be protected by both something you have and something you know. (My iPhone has a 16+ character password. It's a pain. It's worth it.)

Heroku's lack of 2-factor auth has literally given me nightmares.

Re: MongoHQ Security breach

#115

Post by Kiro »

I've never understood what people use MongoHQ for. I mean, the data is completely open and it doesn't seem to have any support for authentication.

Re: MongoHQ Security breach

#116

Post by bolder88 »

jumby wrote: post #29
iloveponies wrote: post #22

Earlier quoted context omitted.

2FA and VPNs are not exclusively the only way to secure things. X.509, bastion servers, airgaps that require physical access to a secure facility etc are also valid options, dependent on your systems and their configuration.

Granted, but an airgap would make working with some internal support tool a bit cumbersome :) Bastion servers if properly firewalled might be OK for a short term solution. The concern there is if you allow unfettered ssh (for example) is someone watching for the inevitable brute-forcing that will ensue?

If you have ssh running anywhere, please disable password access. Use keys. It should come installed like that.

Re: MongoHQ Security breach

#118

Post by dotmanish »

tsenkov wrote: post #113

Disclaimer: I haven't used MongoHQ. Yesterday, I decided to go with MongoHQ for my current project and this morning I saw they got hacked. Irony aside, couple of months back I decided to check AppFog (PaaS) and the next day they were acquired. :) I believe this is a great time to become a new user of MongoHQ - security has been tightened, experience has been built. The "storm is over" and the chances of a new "storm"…

Can you please choose Microsoft and decide to use Windows? I want to see what happens tomorrow. :)

Re: MongoHQ Security breach

#119

Post by enko »

jumby wrote: post #74
julian37 wrote: post #63

Earlier quoted context omitted.

This is the elephant in the room and I'm surprised it hasn't been mentioned by any of the other comments. When it comes to infrastructure as a service, it appears to me that there is an imbalance between the sensitivity of information entrusted to external systems on one hand, and the standards such systems are held up to on the other. EDIT: case in point, on http://mongohq.com I can't find a single mention of the wo…

"security" is always left for after-the-fact ---- exactly as evidenced by this disclosure and their poor in-house practices.

While I can see your point of view, and the grandparent's, let's be fair. These are startups in a rapidly evolving, highly competitive marketplace and they have limited resources. If they spent months triple checking every dotted i and crossed t they might never even launch, and there'd be no company.

Like everything in software it's about tradeoffs. Maybe they erred a little too far on one side of the curve, so let's learn from that. But it's unfair to expect startups to be in the same league as banks security-wise. Do you have any idea how much a good pentest costs?

Re: MongoHQ Security breach

#120

Post by alexkus »

darkarmani wrote: post #103
bdcravens wrote: post #2

detected unauthorized access to an internal support application using a password that was shared with a compromised personal account Someone's updating their resume tonight.

> Someone's updating their resume tonight. At a start-up, it most likely was not an engineering decision, but an agility trade-off. Get that product out the door now!

"Move fast and break (other people's) things!" ?
Post reply on HN