Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

101–110 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#101

Post by dheera »

ralphington wrote: post #55
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

What kind of database auth did you have? Wouldn't they have had to access config files or related in order to obtain your passwords, usernames, etc?

Mongo is so insecure that it's commonplace to not bother with usernames and passwords and just firewall the hell out of it instead. Plus that's one more plaintext password you'll end up storing all over the place. Its default configuration requires no authentication.

Not saying it's a good practice but it's a common pattern I've seen.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#102

Post by AtNightWeCode »

bushbaba wrote: post #66
dawnerd wrote: post #22

Earlier quoted context omitted.

This actually got me a while ago but with redis and some script kiddy turning my dev server into a bitcoin miner. Anyone else running docker and using iptables really needs to read this https://docs.docker.com/network/iptables/

I’m kind of shocked this is even deemed acceptable architecture. You’d think docker wouldn’t even touch iptables unless explicitly told to.

I would say that this is the expected behavior. Also, I don't think one should rely on firewalls in this way.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#103

Post by fastball »

DevX101 wrote: post #37
conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Put passwords on your production databases. Even if it's behind a firewall.

Yeah, my setup is: private network + whitelist + password.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#104

Post by metafunctor »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Yeah, configure `ufw default deny incoming` and Docker will sneakily bypass that and gives the internet unfettered access to your ElasticSearch and MongoDB and whatever. And somehow, that's apparently "not a bug". It's one of the biggest footguns I know of, and could not believe it was expected behavior when I first encountered it.

We have a strict policy that servers must not have a routable IP address at all, and must have an external firewall applied. It's a good idea in any case, but turns out it's absolutely necessary with Docker.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#105

Post by patrakov »

steffan wrote: post #62
haimez wrote: post #42

Earlier quoted context omitted.

Right. Maybe someday, with enough public shaming in situations like this, mongo will reconsider those defaults. Or not, maybe their best potential customers should continue to get burned publicly in incidents that have a direct line to their poor decisions.

Defaults have long been changed to prevent listening on 0.0.0.0 by default; this has been the case since May of 2017, over 4 years ago. In order for this to occur, a user has to explicitly turn on listening on all interfaces. In conjunction with this, prudence would dictate that you enable authentication as well. In this case, it seems that reliance was placed on Docker to maintain iptables settings to disallow conne…

Defaults don't matter as long as they are overridden in the official Docker image. And because of the way network works in Docker, they can't listen on anything else than 0.0.0.0 in their image.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#106

Post by [deleted] »

thrashh wrote: post #100
vngzs wrote: post #95

Earlier quoted context omitted.

Yeah, there's the whole "zero trust" possibility which I didn't mention. If you do authentication/authorization really well, you can stop doing (2). For things like databases, I think it's better to treat them as if they _could_ be exposed to the open internet, without actually doing so. It's generally not the case that anyone on the internet needs to query your DBs. As described, you're _only_ relying on client TLS…

All internal services should be protected, even on your home network. If you have 100 devices on a network where everything is unprotected, that’s 100 different ways someone can try to get full access to 99 other devices.

[deleted]

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#107

Post by Shank »

AtNightWeCode wrote: post #102
bushbaba wrote: post #66

Earlier quoted context omitted.

I’m kind of shocked this is even deemed acceptable architecture. You’d think docker wouldn’t even touch iptables unless explicitly told to.

I would say that this is the expected behavior. Also, I don't think one should rely on firewalls in this way.

Relying on firewalls to do what firewalls do and have done and continue to do seems perfectly acceptable. Yes, your database should have authentication enabled too, but expecting ports to not be unexpectedly open is the entire point of firewalls.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#108

Post by pm90 »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

Is 3 hours a large time for an open server to be discovered? Do the attackers just have a giant list of ips that they constantly scan and can instantly know if it’s suddenly open to traffic?

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#109

Post by TheChaplain »

conesus wrote: post #20

NewsBlur's founder here. I'll attempt to explain what's happening. This situation is more of a script kiddie than a hacker. I'm in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It's been a great year of maintenance and I've enjoyed the fruits of Ansible + Docker for NewsBlur's 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and…

The docker part bit me in the behind as well, had absolutely no idea it would circumvent ufw by design.

Angry at myself for not reading the docs carefully but who has time for that? :/

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#110

Post by kgeist »

dfadsadsf wrote: post #11
wolverine876 wrote: post #4

These are crimes. Where is law enforcement? I am not sure why the public still gives them a pass and treats computer crimes differently. With the resources of the federal government, it shouldn't be hard to find and take down the criminals. Think of how easily the criminals exploit their victims - it is just as hard for the criminals to play defense as it is for everyone else.

Actually federal government resources are pretty limited and finding hackers is hard. What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country. Even if country if friendly, extradition is expensive and time consuming. After all that you may end up putting random 20 year old guy in jail for a few years without putting any dent in…

>What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country.

It's possible if US law enforcement bothers working with their counterparts in "unfriendly" countries (I doubt they even reach out to them).

Case in point: 10 years ago a bunch of Russian scammers scammed Americans out of thousands of dollars pretending to be a valid mail order bride business. As far as I remember, because US police did nothing ("it's Russia! we can't do anything"), one of the Americans had to contact Russian police directly. A criminal case was opened and Russian police eventually busted a whole network of scammers. I know because they were based in my city, there was TV coverage. Those scammers targeted only foreigners so our police wasn't even aware they existed, because no one filed anything.

Post reply on HN