Live data from Hacker News

The MongoDB hack and the importance of secure defaults

snyk.io

151–160 of 223 posts

Re: The MongoDB hack and the importance of secure defaults

#151
post #141

When our sysadmin set up our Mongo cluster, he firewalled out all IPs except our production systems, turned on authentication, set things up to ensure we used SSL, and configured backups. He didn't do this because he's an amazing sysadmin. He did it because he's competent, knows how to put a service on the Internet, and RTFM. I mean. If you can connect to something and use it without having to authenticate yourself,…

Next time you cross a bridge, make sure it will handle your weight ... And think about everything that can possible go wrong, what materials are used, and how old it is, etc.

Different. This isn't some deep, underlying fault that requires a lot of specialized knowledge to recognize, like a bridge that has the wrong type of struts or whatever. If the program doesn't make you put in a password ... it probably doesn't require a password.

Refusing to deploy a process into production without setting a password is more like refusing to drive over a bridge that's obviously missing chunks and crumbling -- that is, it should be obvious, even to the untrained eye, that there is a massive structural issue that makes it unsafe.

I will grant that some junior people may assume that local connections are coming in over a trusted socket and that TCP connections are required to hit an authentication process, but even this is kind of a stretch, and no one should be leaving production deployments for real companies in the hands of someone that inexperienced.

I will also grant that guilt-by-association is probably not appropriate here. There are a lot of good people at companies that have grossly incompetent and/or disorganized managerial superstructures that may have caused something like this to end up exposed to the internet. I have personally worked at multiple places where the daily comedy of errors we called "work" could've resulted in an unpassworded Mongo ending up on the public network.

Any way you slice it, driving over what is a clearly destroyed, ruined bridge is someone's fault, somewhere (and per regular management practice, the person least responsible for the fault will probably take the fall :) ). Let's just not pretend that this is an ordinary complication or oversight in the course of sysadmin.

Re: The MongoDB hack and the importance of secure defaults

#152
post #84

Earlier quoted context omitted.

Network oriented software created after 2000 has zero excuse for allowing unauthenticated writes from the general internet by default.

Tell that to redis. No, seriously. Please. I've been banging that drum for years.

Also, MySQL [1]. Are you sure that you're right and all these major db projects are wrong?

1. note the default value of "bind to *": http://dev.mysql.com/doc/refman/5.7/en/server-options.html#o...

Re: The MongoDB hack and the importance of secure defaults

#153
post #61

Earlier quoted context omitted.

In part. According to the Github repo, it's 75% C++, 18% JS. https://github.com/mongodb/mongo

The JS is from docs and examples, not from core MongoDB code.

Thanks for the further clarification!

Re: The MongoDB hack and the importance of secure defaults

#154
post #63

No matter what your defaults are, if a sysadmin doesn't understand that some software is OK to connect to a public-internet addressable interface while other software is not, their shit is going to get hacked (or, as in this case, accessed). This is the equivalent of leaving your data in a file cabinet in your lobby and being surprised someone took it. The answer isn't to add self-locking little office locks to the f…

Network oriented software created after 2000 has zero excuse for allowing unauthenticated writes from the general internet by default.

What about the "this is the most common setting used by our clients"? Is that not a good "excuse" for being the default?

Re: The MongoDB hack and the importance of secure defaults

#155
post #98

Earlier quoted context omitted.

It is much harder to do this with MySQL. The default is now a randomly generated password. You have to overwrite it with --initialize-insecure if you want to setup with a blank password.

I don't buy that. Just did an apt-get install mysql-server and it let me install with a blank password (Ubuntu 16.04 MySQL Server 5.7)

It is most likely appearing to work without a password because it is using socket authentication (vs tcp). See: http://mysqlserverteam.com/secure-by-default-in-mysql-5-7/

If you want to double check, try 'mysql --protocol=tcp'.

Re: The MongoDB hack and the importance of secure defaults

#156

Earlier quoted context omitted.

I first started using Mongo in 2013/4, when I deployed my app, first thing I did was to change the default port and add authentication, as the manual recommended. I'm an accountant who's a hobbyist developer. I knew very little about security then, but I read the manual. The insecure defaults were an issue sure, but anyone installing a piece of software in production without at least reading up on config options need…

Meanwhile, the FTC sued D-Link over insecure defaults in their cameras. We need good and consistent rules about this, and "well I was giving it away for free" isn't as clear a boundary as people will think it is.

The FTC sued over insecure defaults because it said "secure" on the box.

Re: The MongoDB hack and the importance of secure defaults

#157
post #131

Earlier quoted context omitted.

ops-y + dev-y, isn't that supposed to evolve into DevOps? I know the term is a bit overloaded. Do the community chef, ansible and puppet cookbooks use secure defaults for MongoDB? Asking because I have never used MongoDB.

> ops-y + dev-y, isn't that supposed to evolve into DevOps? I know the term is a bit overloaded. Yes, but I've grown to dislike that term, though it's my current job title. There's a number of people who're titled with DevOps and they're yelling about Docker this and CD that, and AWS/RDS those. That crowd is way to excited about some tools and some solutions in specific use cases, and they sometimes tend to drown out…

>Yes, but I've grown to dislike that term, though it's my current job title. There's a number of people who're titled with DevOps and they're yelling about Docker this and CD that, and AWS/RDS those.

This is not exclusive to DevOps, though DevOps is a hot buzzword right now so lots of posers are flooding in. Most people, no matter their station or the prestige of their company, have no idea what they're doing. Knowing this is one of the most important things for dealing with the corporate world (I think I'm missing a couple of the other most important things, though...).

Different people try to cover this up in different ways. One popular way is acting like they always know about new cutting-edge tools sponsored by AppAmaGooBookSoft and that the next thing will finally be the Silver Bullet we've all been waiting for.

This impulse has brought us the prominence of node.js, MongoDB, the proliferation of "big data", and many other vastly-overdeployed niche products that have been ravenously and shamelessly misused by incompetent people trying to fake it through their careers. Our standards for this are, frankly, sad. It must have to do with a combination of a cultural bias against non-junior engineers outside of Java/.NET-land and putting completely unqualified MBAs in charge of tech (and yes, this is also applicable in startup world via VC proxies) -- but I digress.

Been hearing that song and dance re: docker and k8s for the last year at least, and boy is it ever tiring. Docker and k8s are both very niche, very immature products that greatly complicate system administration. They are missing features that you rely on and that you will have implement horrifying hacks to work around. Why are you doing this to yourself, again? Oh, because AWS is too expensive and you want to consolidate (fake reason btw, real reason "because it makes people think I'm smart")? Yeah, about that...

It's fun to throw together a lab for experimentation, maybe hook up a weekend project, but no sane Real Company is going to be moving its stuff to all-containerized k8s any time in the next 2 years.

My current project at work? Converting all of our environments to docker/k8s...

Re: The MongoDB hack and the importance of secure defaults

#158
post #61

Earlier quoted context omitted.

In part. According to the Github repo, it's 75% C++, 18% JS. https://github.com/mongodb/mongo

The JS is from docs and examples, not from core MongoDB code.

So https://en.wikipedia.org/wiki/MongoDB is wrong? Well, guess I trusted Wikipedia a bit too much.

Re: The MongoDB hack and the importance of secure defaults

#159

Earlier quoted context omitted.

I first started using Mongo in 2013/4, when I deployed my app, first thing I did was to change the default port and add authentication, as the manual recommended. I'm an accountant who's a hobbyist developer. I knew very little about security then, but I read the manual. The insecure defaults were an issue sure, but anyone installing a piece of software in production without at least reading up on config options need…

Meanwhile, the FTC sued D-Link over insecure defaults in their cameras. We need good and consistent rules about this, and "well I was giving it away for free" isn't as clear a boundary as people will think it is.

I'll comment without knowledge about the D-Link issue that you mention.

I would imagine that if someone were to sue MongoDB Inc. today about the issue in the article, their first defence would be clear documentation that explained/recommended production guidelines.

I don't know if D-Link had similar, but then again legal systems sometimes produce weird results that don't seem rational.

I agree that we need good and consistent rules, in addition to that, we need DevOps/SysAdmins/SRE's that are responsible enough to know what they are doing. Carefully read documentation instead of "quickly deploy" only to come back a year later writing soppy "don't use MongoDB or XYZ because we didn't read the manual". :)

MongoDB is on 3.4 now, so I would rhetorically wonder why some people/companies are still on <=2.6. If the data that is being ransomed is that important, it'll be a good lesson to those DB maintainers to upgrade and secure their stack.

Re: The MongoDB hack and the importance of secure defaults

#160
post #104
post #64

Earlier quoted context omitted.

I still think the XP guys had this figured out. You scale with your customers and stop trying to write it perfect the first time. I'm a huge proponent of never making the same mistake twice but there is just not enough time in the day for perfect. Instead you write it in a way that it has the potential to be great. Customers that have been using your software for a year will have different problems when they have bee…

Sounds a lot like translating a web app after it was released. In a company I was working on, we made a commitment to call out strings without gettext as a bug, regardless if it was really was going to be used for a single country/language. It really takes no effort to do it the first time, but adding that stuff later on is major bs.

The reason it's hard to bolt-on after the fact is that languages conflate the concept of "string" and "user-facing text". If "user-facing text" had a different type or method or whatever, it would be trivial to find all references in your codebase and consolidate them into gettext stuff. But instead, every inline dynamic sql, every dictionary key, every http parsing looks like user-facing text.
Post reply on HN