Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

201–210 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#201

Post by richardrk2 »

petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

I wholeheartedly agree. I cannot think of a scenario where a company exposes my data and I would not want it to be deleted ASAP. The only thing is that such companies might not be able anymore (if data was not backed up) to email me about a “breach”.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#202

Post by inetknght »

red0point wrote: post #185
inetknght wrote: post #174

Earlier quoted context omitted.

Good tree^H^H^H^Hgraph traversal algorithms have a history stack specifically to detect and deal with loops.

1) If it‘s a tree, it ain‘t got no loops 2) The stack isn‘t to deal with loops, the „visited“ flag at each edge is there for that. The stack (for DFS, BFS would be a queue) is there to keep track of which nodes have been visited such that you can construct a path from the starting node to the one you‘re looking for. Obviously there are variants to this, depending on what you‘re actually trying to achieve with it. My…

1) you're right, I edited my message to reflect that I meant a graph traversal algorithm.

2) a visited flag on an edge? That won't support simultaneous traversals. Keeping a stack is a lot more efficient than permitting only one traversal at a time.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#203

Post by webo »

cdrini wrote: post #195

It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag... ). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "n…

Who do you think should regulate the “public”? ISPs, police, government?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#204

Post by throwaway8941 »

inetknght wrote: post #174
aledalgrande wrote: post #170

Earlier quoted context omitted.

You should configure a timeout.

Good tree^H^H^H^Hgraph traversal algorithms have a history stack specifically to detect and deal with loops.

>tree^H^H^H^Hgraph

If we pretend we're using readline here, ^W (yank previous word) and ^U (yank to the start of the line) should save you some key presses.

Some recommended bedtime reading:

https://catonmat.net/ftp/readline-emacs-editing-mode-cheat-s...

https://en.wikipedia.org/wiki/GNU_Readline#Emacs_keyboard_sh...

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#205

Post by akx »

nautilus12 wrote: post #165

Why is mongodb seem to show up alot with this. Does their default set up hide some unsecured users? Its been a while but I dont remember that being in there.

No, their default sets up no authentication at all IIRC. Combined with Dockerized installations punching through some firewall setups (as discussed elsewhere), you'll get meowed.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#206

Post by grahamedgecombe »

cdrini wrote: post #195

It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag... ). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "n…

In the UK it's probably already illegal under the Computer Misuse Act, as it'd fall under "unauthorised modification of computer material".

I assume other countries have similar laws.

That said, enforcing it is a different matter.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#207

Post by cdrini »

cdrini wrote: post #195

It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag... ). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "n…

Actually, a good physical example is restaurant health inspections. They're responsible for testing the safety of an organisation, and making sure that data is publicly visible, and in extreme cases, shutting the organisation down for negligence.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#208

Post by glenstein »

pantaloony wrote: post #190
spoopyskelly wrote: post #175

Earlier quoted context omitted.

> Why must some people insist on being assholes? The ones leaving giant databases unsecured? At least they are being taught an important lesson.

My blame scale for breaches, most to least: 1) the cultural and economic forces driving everything online way before that’s anything like a good idea, 2) companies storing more than they need to, 3) the people who left it unsecured (bigco, tech startups, and anything very sensitive), 4) the people stealing data, 5) the people who left it unsecured (Smaller shops that’ve been made to feel they must be online), [large…

Why is the person doing the deleting so low, relatively speaking, in your ranking of people's responsibility for them doing the deleting?

Also, do you think that this person or persons would refrain from deleting the data if they had the opportunity, but it qualified as a "good idea" to keep online? I.e. they might review, say, medical records, spend some time thinking to themselves whether it was 'necessary' to be online, and then decide to delete or not delete depending on their judgment?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#209

Post by [deleted] »

cdrini wrote: post #195

It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag... ). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "n…

[deleted]

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#210

Post by gwright »

wolco wrote: post #199
gwright wrote: post #182

Earlier quoted context omitted.

You don't know who was the storage vendor and who's data was being deleted and you have no idea what that data represents or what the consequences are of having to restore it. You are making several unfounded assumptions.

No one knows more information than the article presents. When you state that victims exist or that the data being deleted is important you are also making unfounded assumptions. You can't have it both ways.

I think it is entirely reasonable to start with the presumption that people have a right to their data and to their property, that it is valuable to them.
Post reply on HN