Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

111–120 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#111

Post by birdyrooster »

asdfasgasdgasdg wrote: post #81
petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…

A spin class? Really that is the best example you can come up with? That is not at all compelling.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#113

Post by gwright »

cm2187 wrote: post #103
gwright wrote: post #97

Earlier quoted context omitted.

Would you feel the same way if someone burned your house down if you left the door unlocked? Would you support the idea of people walking through a neighborhood and checking every door in a similar way? Does your opinion change if it happened in a business district? I think it is fine to argue that doors should be locked but that doesn't mean that a crime hasn't been committed when someone takes advantage of a situat…

I don't think the parent suggests it exonerates the hackers. Just that the clients are better off.

Better off? The idea that victims deserve to be victimized because they didn't take enough care is trotted out every time a security issue comes up on HN.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#115

Post by evilduck »

Tade0 wrote: post #92
asdfasgasdgasdg wrote: post #81

Earlier quoted context omitted.

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…

Like, how does the local mom and pop correctly evaluate a person's IT chops? Usually by price and unfortunately both mom and pop like a bargain - I've seen this play out more times than I would like. Also how do you evaluate, say, a landscaper's chops? Or any other kind of contractor's for that matter? By doing research beforehand, checking what kind of reputation that person has etc. Low-effort or lack of research g…

In construction and landscaping work those companies are usually licensed, bonded and insured. If they fuck up the work there's obvious financial recourse. Also, the measure of them fucking up is generally a lot clearer for physical labor and for mom and pop businesses, getting construction work inspected by a 3rd party is usually more straightforward and cheaper.

In software, financial recourse generally means you have to jump straight to lawsuits. There's no licensing for who's qualified to build a website, developers don't have to escrow funds or carry malpractice insurance in case they make a mistake, a development business should have insurance in place but there's not always easy or affordable ways to assign fault in most IT situations if you want to pursue them. Software and IT forensics are prohibitively costly and usually mean a lot of money has to be on the line which rule out mom and pop businesses entirely. IT and software mistakes also usually take longer to rear their heads, and people in IT and software also aren't known for sticking around for decades. How do you sue an LLC that dissolved 5 years ago?

It's apples and oranges in my opinion.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#116

Post by wolco »

nxpnsv wrote: post #90
mcv wrote: post #88

Earlier quoted context omitted.

I don't find your example very convincing. Any database storing personal data needs to be properly secured, and if that gym also has ID credit card or other more sensitive data, that data might better be destroyed than stolen. If it's a publicly accessible wiki with no sensitive data whatsoever, and that's meant to be publicly accessible, then there's a reasonable excuse for the poor security and it's not helping any…

Why should innocent users be punished? Why not just send a pic confirming you have full db access? This is just unnecessary vandalism.

Somehow that would be worse. Feels like a ransom call.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#117

Post by [deleted] »

watermelon0 wrote: post #87
Twirrim wrote: post #10

Earlier quoted context omitted.

Don't expose MySQL databases to the internet. Just don't. Stick an API layer in at the very least with key based auth, and only the bare minimum capabilities allowed for the user. That said, if you'd read the article you'd see that so far only unsecured MongoDB, Elasticsearch and Redis installations are being attacked so far.

It's not strictly necessary, as long as there are no known vulnerabilities, and you use sufficiently hard password. However, it's highly recommended you never expose such services to the public, or at least limit allowed IP ranges.

[deleted]

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#119

Post by gwright »

rytis wrote: post #109
gwright wrote: post #97

Earlier quoted context omitted.

Would you feel the same way if someone burned your house down if you left the door unlocked? Would you support the idea of people walking through a neighborhood and checking every door in a similar way? Does your opinion change if it happened in a business district? I think it is fine to argue that doors should be locked but that doesn't mean that a crime hasn't been committed when someone takes advantage of a situat…

Except that I didn’t leave the doors open. Someone I trusted with the keys, left them in their safe. Unlocked. So I rather have their whole place burned down and MY keys melted at the same time.

You are suggesting that it was just "keys" but that isn't the case here. You don't know what type of data is being destroyed.

A better example might be a storage unit service that left the front gate unlocked. If someone torches the place to illustrate that they need better security would you be comfortable with that? Isn't there a better approach that we should encourage or is OK to encourage people to destroy things that aren't protected to teach people "lessons"?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#120

Post by asdfasgasdgasdg »

birdyrooster wrote: post #111
asdfasgasdgasdg wrote: post #81

Earlier quoted context omitted.

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…

A spin class? Really that is the best example you can come up with? That is not at all compelling.

What part of the example do you dispute? Spin studios have databases, like almost all small businesses these days.
Post reply on HN