Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

141–150 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#141

Post by jeroenhd »

gverrilla wrote: post #33
Twirrim wrote: post #10

Earlier quoted context omitted.

Don't expose MySQL databases to the internet. Just don't. Stick an API layer in at the very least with key based auth, and only the bare minimum capabilities allowed for the user. That said, if you'd read the article you'd see that so far only unsecured MongoDB, Elasticsearch and Redis installations are being attacked so far.

I'm doing my first web project (self-taught), which is the prototype for an offering me and a partner are developing to become a startup. I was about to start deployment (for the first time in my life) this week, but now I'm afraid. It's a flask app. We serve users forms (POST), then I use this input to run calculations on the server through a python script which makes queries to a MySQL db, then I return results to…

Your API, in this case, is basically your Flask application so you're pretty much done.

If you want to run a database securely, you configure a decent password (should be asked during installation), create new users for each application/database (easy with tools like MySQL workbench) and make all applications running on the server (Flask, in this instance) connect to localhost/127.0.0.1. Don't expose services like databases to the outside world if you cannot in any way help it.

Then enable a firewall on your server (Ubuntu server comes with UFW by default) and lastly use a port scanning tool like nmap/zenmap to check if you have left any services other than HTTP(S) exposed.

I don't know much myself about Flask deployments specifically, but you'll probably use something like nginx or Apache to handle the actual web requests. There's an article here [0] on how to do that. After you've done that, you can secure your connections for free through Let's Encrypt clients like certbot [1] which handle most of the configuration for you.

TL;DR:

1. Configure your application to connect to localhost with a secure password

2. Enable a firewall, run "nmap " to check if it works (should only expose HTTP(S) and probably SSH if you did it right).

3. Install nginx or Apache to handle requests for you and follow the guide at [1]

[0] https://www.digitalocean.com/community/tutorials/how-to-depl...

[1] https://certbot.eff.org/instructions

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#142

Post by petee »

mod wrote: post #125
markovbot wrote: post #123

Earlier quoted context omitted.

> Are there databases that could be lost without consequence except to their owner I would certainly hope the owner of the insecure database would face massive consequences. IMO there's not _nearly_ enough of that. This sort of breach should be financially ruinous for _any_ company.

What if the database only contains my blog posts? Or my own personal health information I'm tracking? Or all the Hearthstone cards? Or any other of the infinite data sets that are totally insignificant to anyone beyond the owner of the database? Not everything is about you, and also you totally misunderstood the post you quoted.

Then you'll learn real quick to secure your database, make backups, or not post personal stuff online.

And if you've configured your database that poorly, am I supposed to assume you've properly configured your server against becoming part of a DDoS attack? Or a bot net? The base level of negligence you're defending enables a multitude of attacks. Losing your DB would be an immediate sign you don't know what you're doing, and thus shouldn't be doing it.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#143

Post by jfk13 »

wolco wrote: post #110
pojzon wrote: post #96

Earlier quoted context omitted.

What you propose is illegal in most 1st/2nd world countries. In mine, the company could thank you and then put you straight to jail for 30 years. Unfortunately very few small businesses run sade reporting programs and often react with attack.

So is deleting a database. Putting a password and emailing the admin would solve the password problem. But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.

How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#144

Post by sinsterizme »

gwright wrote: post #97
petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

Would you feel the same way if someone burned your house down if you left the door unlocked? Would you support the idea of people walking through a neighborhood and checking every door in a similar way? Does your opinion change if it happened in a business district? I think it is fine to argue that doors should be locked but that doesn't mean that a crime hasn't been committed when someone takes advantage of a situat…

I think the major difference is that losing my house along with all my belongings is much worse than losing just some of my belongings. Also data being exposed publicly can be used nefariously by multiple parties, so is likely worse in most scenarios compared to just outright deletion of the data

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#146

Post by jb775 »

asdfasgasdgasdg wrote: post #81
petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…

What happens when mom & pop are storing your name and credit card # in plain text and then your identity gets stolen and credit ruined? Should we still be "charitable" to them and their d-bag nephew?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#147

Post by jcrawfordor »

hobofan wrote: post #31
29athrowaway wrote: post #12

Search engines like shodan.io make it trivial to discover unsecured databases exposed to the Internet.

What I don't get about Shodan: Why aren't all unsecured databases found instantly (at the moment Shodan went online), but recurring attacks/dumps like this one that rely on it? Do they update their crawl data in waves?

One real limitation is getting data out of Shodan. Having done a few different projects that involve large-scale use of Shodan results (e.g. several hundred thousand records), this kind of thing usually ends up costing $300 for either export credits or a service plan. Sure, $300 isn't really that much to cause millions in damage, but I think it's a big factor in why we don't often see Shodan used for huge-scale malfeasance. You both have to put up the money and in paying you probably give up some identification info, and I don't know if Shodan has complied with law enforcement in the past but I can sure see them getting a warrant for "the person who just spend hundreds to export and/or query every unsecured MongoDB."

Also, as a bit of an aside, the relationship between "export credits" and "query credits," and the export system and API of Shodan, are extremely confusing and just a bad bit of product design. Each one seems to be capable of things the other isn't, but they're priced on totally different systems.

But really it's mostly just a matter of motivation, I think. Pulling even just thousands of entries from Shodan, writing some software to use them, and then running it in a reasonably deniable way, takes effort and is pretty slow (why we see this going for multiple days). It's not a huge amount of effort but it's enough that "script kiddie" types don't really seem to do it, you need to be motivated and spend the time on it.

Contrary to security urban legend it seems like the number of people who are highly motivated to purely cause damage is not actually that large, people only put in the time if they can figure out a way to gain from it... and just deleting data doesn't really achieve that. You've got to figure out a way to hold it for ransom and/or collect and leverage sensitive data. We've seen both happening on various scales with this kind of unsecured database and we'll probably see more of both as we go forward... but keep in mind that in the ransomware game, encrypting computers is both easier (established off-the-shelf ransomware can be purchased) and probably shows higher returns, so the "professionals" aren't spending a lot of time messing around with exposed databases.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#148

Post by 3gg »

This is bad when it comes to personal data, like the VPN provider that claimed not to be logging. Companies should spend every effort to secure people's data, and can face large fines in the event of a leak. In erasing the data, Meow is also erasing the evidence of their crimes. Instead, Meow should ransom the data and set a fine proportional to the company's size, revenue, the sensitivity of the personal data, whether that personal data should have been collected in the first place, whether that data should be public-facing, etc. Then Meow can be made a public service, perhaps paid with taxpayer money, and bring about justice.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#149

Post by zentiggr »

MattGaiser wrote: post #106
jaggirs wrote: post #100

Earlier quoted context omitted.

The possibility of someone stealing your identity (or worse) far outweighs the damages from losing some coupons. Deleting exposed databases is genious, there need to be real repercussions for companies if they leak user data.

> The possibility of someone stealing your identity (or worse) far outweighs the damages from losing some coupons. That is a very rich person statement.

Fine, what about every poor person who gets their data stolen from an unsecured database, and gets their identity stolen?

Yours is also a rich person statement.

Unsecured databases are a huge loss for everyone.

Anything that forces a shift in this naive behavior of vendors, implementors and executives is not just fine by me, I welcome it. If my life suffers because of data of mine that's lost from companies' databases, I now know who to cease doing business with.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#150

Post by usmannk »

dawnerd wrote: post #126
nisa wrote: post #60

Earlier quoted context omitted.

It's also easy to get bitten by Docker. You can secure your server with iptables/ufw only to discover that docker happily punches through your firewall and you need to filter on the DOCKER-USER chain - and even that was broken: https://unrouted.io/2017/08/15/docker-firewall/ https://github.com/docker/for-linux/issues/690

Seriously this is the most annoying thing ever, especially if someone on your team things you need to expose the ports to redis in a docker compose. I’ve come back from a weekend where my redis instance was being used for crypto mining. Anything that is insecure by default in 2020 should be killed off IMO.

Isn’t exposing ports in your docker-compose services:redis:ports, how you’d do that? (Docker hobbyist here)
Post reply on HN