Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

151–160 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#151

Post by zentiggr »

glckr wrote: post #11
petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

No other bad actors can get it, but we don't know if it's already been found, and now that it's gone we have no idea what data is out in the wild. And as you note, we can't trust the companies to accurately report it themselves.

Oh, they'll have to say something when they suddenly stop doing business until a backup can get pulled, and the new db instances actually secured before putting them up again.

Even a bland 'we lost parts of our data and we will have to start recovery processes. please stand by' is a signal.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#152

Post by rightbyte »

jb775 wrote: post #146
asdfasgasdgasdg wrote: post #81

Earlier quoted context omitted.

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…

What happens when mom & pop are storing your name and credit card # in plain text and then your identity gets stolen and credit ruined? Should we still be "charitable" to them and their d-bag nephew?

Ye it is not like I trust my credit card to strangers and let them walk away with it for a while.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#154

Post by klyrs »

petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

> Somehow I feel good about this.

For me, it's not exactly "good." But I am more upset with the database owners than I am with the kitties. Don't leave the barn door open, or this (or worse) will happen to you, and happen again. If they were instead exfiltrating and selling the data, the equation would change. I'm not saying the cats are doing good, but I do say that the "responsible adults" did the greatest harm by not cat-proofing their databases that contain PII.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#155

Post by philshem »

user5994461 wrote: post #74

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

The top-voted answer links to this HN page. I'm stuck in an infinite loop.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#156

Post by tyre »

bmcahren wrote: post #102
lol768 wrote: post #38

Earlier quoted context omitted.

I've said it on here before, but the way in which Elasticsearch used to lock away critical security functionality (like TLS support and RBAC) behind a paid subscription whilst making just enough functionality available for free such that users could shoot their foot off is disgusting. This only ever changed after Open Distro for Elasticsearch came onto the scene and forced Elastic's hand. I entirely agree the vendors…

This is why we are refactoring our database to be able to migrate to Amazon documentdb from MongoDB. Encryption at rest.... Pay up!

Curious, why do you use Mongo? Does it give you something that a JSONB column in Postgres wouldn’t?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#157

Post by gwright »

nkrisc wrote: post #124
gwright wrote: post #104

Earlier quoted context omitted.

And what about the responsibility to not destroy someone's property? Do you have the same opinion about shoplifters walking away with merchandise? Would your argument be that there should be armed guards and searches in every retail store? Isn't it reasonable that a thief be criticized and penalized for their actions even if the theft was "easy" to commit and is it OK to blame the victim for not being prepared?

But it's my personal and sensitive data that they are poor stewards of, not their property.

I agree but I don't think that changes my point that the person who destroys the data has more culpability than the storage service in the destruction of the data.

There tends to be a pass given to people destroying data and I don't think that is right.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#158

Post by ThrowawayR2 »

gwright wrote: post #113
cm2187 wrote: post #103

Earlier quoted context omitted.

I don't think the parent suggests it exonerates the hackers. Just that the clients are better off.

Better off? The idea that victims deserve to be victimized because they didn't take enough care is trotted out every time a security issue comes up on HN.

These aren't victims; they were harmed through their own gross negligence or the gross negligence of the developer they employed.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#159

Post by jcrawfordor »

usmannk wrote: post #150
dawnerd wrote: post #126

Earlier quoted context omitted.

Seriously this is the most annoying thing ever, especially if someone on your team things you need to expose the ports to redis in a docker compose. I’ve come back from a weekend where my redis instance was being used for crypto mining. Anything that is insecure by default in 2020 should be killed off IMO.

Isn’t exposing ports in your docker-compose services:redis:ports, how you’d do that? (Docker hobbyist here)

My guess would be that they went with "ports" instead of "expose" which makes it public. But even with careful composition of your docker-compose you might want to be careful, Docker can interact with iptables in surprising ways and long iptables rulesets are almost comically difficult to validate sometimes. The result is that if you're using both Docker (and even more if you use Compose, Kubernetes, some other orchestrator) and doing anything else with iptables (including using it as a host firewall) you need to take a lot of caution to make sure you don't mess anything up. These tools usually confine their changes to custom chains to make this stuff easier to sort out but at the same time it can make it more difficult to understand what's happening, particularly with the use of tagging and etc.

In general I would recommend putting some kind of protection between machines running Docker (and especially orchestrators) and the internet. This could be cloud provider mechanisms (security groups, ACLs, etc), a firewall appliance, NAT gateway configuration, etc. depending on the situation. It's not necessary, but it makes the situation easier to audit/validate, and more layers of protection seldom hurt. If nothing else it means that much of the time you'll need to make a mistake in two places instead of one, in order to have an unintended exposure.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#160

Post by RcouF1uZ4gsC »

asdfasgasdgasdg wrote: post #81
petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…

> What if one of the databases has a record of credits you've purchased at your local spin studio?

Usually when you buy something, you get an email receipt. So you print out your email receipt and go to the mom and pop store.

Given they are a local mom and pop store, you likely have a long term relationship with them and they may even remember you buying credits. So it will be a hassle, but likely ok.

It is the huge corporate stores that don’t have long term relationships that would be hurt by this thing the most.

Post reply on HN