Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

221–230 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#221

Post by Twirrim »

watermelon0 wrote: post #87
Twirrim wrote: post #10

Earlier quoted context omitted.

Don't expose MySQL databases to the internet. Just don't. Stick an API layer in at the very least with key based auth, and only the bare minimum capabilities allowed for the user. That said, if you'd read the article you'd see that so far only unsecured MongoDB, Elasticsearch and Redis installations are being attacked so far.

It's not strictly necessary, as long as there are no known vulnerabilities, and you use sufficiently hard password. However, it's highly recommended you never expose such services to the public, or at least limit allowed IP ranges.

> as long as there are no known vulnerabilities

That's really not something you should be gambling on. Assume the worst, and architect based on it.

Limit what can be exposed where / how (e.g. as you say, "at least limit allowed IP ranges", but to me that's absolute bare minimum)

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#222

Post by cdrini »

grahamedgecombe wrote: post #206
cdrini wrote: post #195

It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag... ). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "n…

In the UK it's probably already illegal under the Computer Misuse Act, as it'd fall under "unauthorised modification of computer material". I assume other countries have similar laws. That said, enforcing it is a different matter.

Yeah, I think enforcement is probably a big part of what keeps the internet a "Wild West" for these cases; and improvements to enforcementability could fundamentally alter what the internet is :/

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#223

Post by pessimizer »

isatty wrote: post #71
GekkePrutser wrote: post #48

It's not necessarily 'deleted', these Script Kitties just replaced some data with more valuable stuff. You can never have enough meows! But seriously, these guys are doing us a favour. You can bet the affected companies will not expose customer data again.

> You can bet the affected companies will not expose customer data again. I hope so, but I seriously doubt that. Having open databases is extreme incompetency.

If this keeps happening weekly, they'll fix it. Maybe there should be a government Agency for Deleting Publicly Exposed Databases that's likely to hit any that you stand up within a week. Also, make having had a publicly exposed database deleted something that is in the public record, and highly prejudicial evidence in civil liability cases.

A Department of Botnet-Suseptible IoT Device Bricking would be useful in the same way.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#224

Post by hinkley »

cdrini wrote: post #195

It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag... ). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "n…

For people who pride themselves on going 'faster' than previous eras of innovation, we seem to ignore the fact that we have now been the 'Wild West' for longer than the actual Wild West...

Sort yerselves out.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#226

Post by hinkley »

cdrini wrote: post #207
cdrini wrote: post #195

It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag... ). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "n…

Actually, a good physical example is restaurant health inspections. They're responsible for testing the safety of an organisation, and making sure that data is publicly visible, and in extreme cases, shutting the organisation down for negligence.

Electrical and building safety code.

They are based on disasters, but at least we try not to repeat the same ones.

One of the things that drew me to software was the idea that you could fix a problem once and for all and then just keep reusing the solution for ever and ever. I don't think I'd have the heart to go back and tell myself what a stupid notion that turns out to be.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#227

Post by cdrini »

cdrini wrote: post #213
webo wrote: post #203

Earlier quoted context omitted.

Who do you think should regulate the “public”? ISPs, police, government?

I don't know :( But this feels like some sort of terrorist tactic, and I don't think this should be the way things on the internet are regulated either.

Actually, that's one of things that makes this frustrating. Because there is no real regulation, a group/individual decided to "become" the law. The became lawmaker, judge, and executioner. They decided what was illegal, collected the guilty, and punished them for it. That's what makes this feel like a "Wild West" situation. The made themselves regulators of the internet.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#228

Post by zbuf »

petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

I don't have a feeling one way or the other, but I see where you're coming from and I think there's an interesting aspect that many of the folks here seem to be missing.

Were this sort of attack to become part of the "noise" of the internet (much as the continual bombarding of my SSH ports) then peoples databases would get deleted _before_ they contain any meaningful amount of data.

So in practice this sort of gross vandalism is limited to the appearance of such an attack, but not ongoing.

I had this the other day building OS images, which accidentally left the system a passwordless login. Within less than a few hours it was (presumably) spewing mail or doing awful things -- long before anything went anywhere near production data or any kind of trust.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#229

Post by wott »

bcrosby95 wrote: post #171
evilduck wrote: post #115

Earlier quoted context omitted.

In construction and landscaping work those companies are usually licensed, bonded and insured. If they fuck up the work there's obvious financial recourse. Also, the measure of them fucking up is generally a lot clearer for physical labor and for mom and pop businesses, getting construction work inspected by a 3rd party is usually more straightforward and cheaper. In software, financial recourse generally means you h…

If someone does a shitty job in home improvement stuff it's usually not visible for years down the line. And good luck with your recourse by then. I've never heard of a homeowner getting recourse unless it's insanely obviously bad right away. The vast majority end up just living with the defects or hiring someone else to do the job again.

10-years warranty is a thing and is mandatory in some places/countries.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#230

Post by hinkley »

b123400 wrote: post #167

If this turns out to be an effective lesson on security, systems should implement their own meow to protect their users. E.g. A database That intentionally removes itself if the default password/an insecure password is used, with an easy-to-follow guide in error log on how to properly configure it.

If memory serves, Postgres will only listen on 127.0.0.1 unless the admin password has been set.

All software should work like that.

Post reply on HN