Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

blog.newsblur.com

Post reply on HN
Print view View original

221–230 of 275 posts

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#221

Post by nuker »

mercora wrote: post #210
nuker wrote: post #159

Earlier quoted context omitted.

What I do in AWS is having a VPC with 3 subnet types, public, private and restricted. Public ones have default route to inet, private to NAT, restricted - none. DBs go in restricted, load balancers in public and web/app servers in private subnets. Plus whitelist firewalling using Security Groups.

when i evaluated using a NAT setup using AWS NAT gateways it appeared to be quite expensive. we settled for strict VPC rules using only SecurityGroups in order to restrict communication. the instances did have public ip but nothing but intended services could connect to it anyways... i.e an instance running a HTTP API could only be connected to if initiated from the load balancer and itself could only connect to rele…

Normally machines behind NAT use it only for pulling stuff on boot time. Main traffic goes via LBs. depends on your case, of course.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#222

Post by coding123 »

I learned my lesson of not trusting a machine's own ability to secure itself in 1998 or 99 when an IIS machine was installed on Thursday and was completely taken over by viruses on Friday.

Block the ports using private networks or use the IP security provided by the cloud provider (which does not use your machine's security to accomplish this).

Defense in depth and all that.

But sure, docker has a footgun, everything does, otherwise linux would not ship with sudo. (someone's going to reply with a linux that does not come with sudo).

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#223

Post by mercora »

nuker wrote: post #221
mercora wrote: post #210

Earlier quoted context omitted.

when i evaluated using a NAT setup using AWS NAT gateways it appeared to be quite expensive. we settled for strict VPC rules using only SecurityGroups in order to restrict communication. the instances did have public ip but nothing but intended services could connect to it anyways... i.e an instance running a HTTP API could only be connected to if initiated from the load balancer and itself could only connect to rele…

Normally machines behind NAT use it only for pulling stuff on boot time. Main traffic goes via LBs. depends on your case, of course.

later on they also had the need for it to be honest, albeit only for a very specific external service that required us to have a fixed public IP address to connect from. The only solution deemed scaleable was using such an AWS provided NAT Gateway..

so yeah, it surely depends on the case given...

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#224

Post by rndgermandude »

buzzert wrote: post #68

> In case of refusal to pay, we will contact the General Data Protection Regulation, GDPR and notify them that you store user data in an open form and is not safe. Under the rules of the law, you face a heavy fine or arrest and your base dump will be dropped from our server! Does anybody know if this threat is at all credible?

You could end up paying a fine if the regulatory authority investigates and finds that personal data was exposed (or deleted) due to lack of "appropriate technical and organisational measures to ensure a level of security appropriate to the risk"[1].

Relatedly, you can be fined for not telling the regulatory authority about breaches yourself: "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons."[2]

British Airways[3] for example was fined for inadequate security measures. I also remember a case where some company (cannot quite remember which) itself told the regulator about some security snafu as they should, a snafu that most likely was not exploited. They were still issued a fine but a reduced one because they were very cooperative and most likely no actual damage happened.

There is an enforcement tracker website[4] where you can filter for e.g. "security" in the type column.

But nobody will go to prison for being the victim of a hack, that's just fearmongering by that attacker.

[1] https://gdpr-info.eu/art-32-gdpr/

[2] https://gdpr-info.eu/art-33-gdpr/

[3] https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...

[4] https://www.enforcementtracker.com/

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#225

Post by [deleted] »

arp242 wrote: post #204
mschuster91 wrote: post #149

Earlier quoted context omitted.

> Yes, and the fact that docker seems to have persisted with the current state is the topic of discussion. It's clearly written in the docs: To expose a container’s internal port, an operator can start the container with the -P or -p flag. The exposed port is accessible on the host and the ports are available to any client that can reach the host. (from https://docs.docker.com/engine/reference/run/#expose-incomin...…

I don't think that's clear at all. If I set "bind_ip = *" in some application then it's also "available to any client that can reach the host", but the firewall is in front of that. I certainly wouldn't expect an application to frob with my firewall. And as I understand it, this is very much an unintentional side-effect of ufw and Docker interacting – it's not Docker's the intention at all to override any iptable rul…

[deleted]

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#226

Post by tomrod »

mschuster91 wrote: post #149
eganist wrote: post #9

It's not all that great blaming the victim. They clearly made the right moves with at least some of their configuration decisions and leaned on the underlying platform not being bonkers (but alas, it was: https://github.com/moby/moby/issues/4737 and https://github.com/moby/moby/issues/22054 ). Should they have hardened in all the other ways for defense in depth, e.g requiring authentication from localhost? Sure. Shou…

> Yes, and the fact that docker seems to have persisted with the current state is the topic of discussion. It's clearly written in the docs: To expose a container’s internal port, an operator can start the container with the -P or -p flag. The exposed port is accessible on the host and the ports are available to any client that can reach the host. (from https://docs.docker.com/engine/reference/run/#expose-incomin...…

While common knowledge, the resolution is not always clear. Is the current expectation that everyone using docker is schooled in network engineering?

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#227

Post by amphorasource »

While I'm glad no data was leaked and that Samuel is taking the layered defense approach seriously as it was wildly debated on the previous HN thread, I'm still a bit miffed that we only got confirmation that no leak actually occurred now.

As a Newsblur customer, would have really preferred the following course of action: lock down infrastructure, confirmation that no leak occurred, communication of that fact to customers and THEN service recovery. While this was all happening, the only indication that most likely no data was leaked was a single HN commenter that had a similar experience: https://news.ycombinator.com/item?id=27615708

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#228

Post by Annatar »

So instead of just going through http://ftp.rpm.org/max-rpm/ and learning how to make RPM's, the author continues employing all this complex technology, because why keep it simple when it can be ultra-complex, hack-prone and Dockerized with a gratis footgun to boot? Makes perfect sense!

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#229

Post by namibj »

secabeen wrote: post #214
arp242 wrote: post #204

Earlier quoted context omitted.

I don't think that's clear at all. If I set "bind_ip = *" in some application then it's also "available to any client that can reach the host", but the firewall is in front of that. I certainly wouldn't expect an application to frob with my firewall. And as I understand it, this is very much an unintentional side-effect of ufw and Docker interacting – it's not Docker's the intention at all to override any iptable rul…

Same here. It's even a little worse because of the vagaries of Docker networking. I have a server, it has a firewall that has all ports blocked. If I install Docker to run some containers and use the --network=host option, it all works fine. Containers listen on ports on the host, my existing firewall controls it, great. If I use what would seem like the more secure port-forward option, Docker adds a new rule to the…

You forgot IPv6, unless Docker still doesn't support that, ofc.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#230

Post by detaro »

bildung wrote: post #173
eganist wrote: post #169

Earlier quoted context omitted.

> Everyone wants to be treated as a (software) engineer here, but the engineer's perspective in this situation would be the opposite: The victims are the customers, and the perpetrator, acting in negligence, was Newsblur. There can be multiple victims, multiple causes/threat actors, and overlap between two categories. But what's the end user a victim of in this case? Other than a brief lack of availability?

Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? Of course the behavior…

If there is a third-party exploiting that error to cause damage, sure (not the case in your examples, which is why they miss the point). If you don't get security for your business right and it gets burned down by an arsonist, nobody is going to not consider the business owner a victim too.

Software culture is IMHO problematic there in multiple dimensions.

Post reply on HN