Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

241–250 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#241

Post by BossingAround »

lol768 wrote: post #38
rectang wrote: post #27

If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…

I've said it on here before, but the way in which Elasticsearch used to lock away critical security functionality (like TLS support and RBAC) behind a paid subscription whilst making just enough functionality available for free such that users could shoot their foot off is disgusting. This only ever changed after Open Distro for Elasticsearch came onto the scene and forced Elastic's hand. I entirely agree the vendors…

Well, it's just another attempt at monetizing the product. Nowadays, companies and developers expect everything to be OSS (and I love it) yet it's incredibly expensive to develop SW (and very few people do OSS just because of passion--I tried and failed miserably).

Locking RBAC and TLS behind a paid subscription is a sure way to force companies with security teams to pay for it (or not to use it).

This particular lesson comes relatively cheap--dropping your data is not the worst an attacker could do with it. Hopefully, more people will research what I'd call "security 101"...

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#242

Post by jcrawfordor »

achillean wrote: post #186
jcrawfordor wrote: post #147

Earlier quoted context omitted.

One real limitation is getting data out of Shodan. Having done a few different projects that involve large-scale use of Shodan results (e.g. several hundred thousand records), this kind of thing usually ends up costing $300 for either export credits or a service plan. Sure, $300 isn't really that much to cause millions in damage, but I think it's a big factor in why we don't often see Shodan used for huge-scale malfe…

We're actually getting rid of export credits because it's caused confusion over the years. We now just have query credits to download data/ do searches, and scan credits for users that want to request on-demand scans. We announced this change in the most recent Shodan Update newsletter. You can already use our new website ( https://beta.shodan.io ) to download data using your query credits. Export credits were the fi…

This is what I've assumed, but it's in a pretty uncomfortable place right now as e.g. the documentation often refers to export credits with a broken link.

The API is somewhat unsuitable for exporting large volumes because it seems remarkably unstable as to ordering, it suggests that you can do paginated requests but the second page tends to have 30% overlap with the first page.

I 100% understand the product motive to move large exports to an "Enterprise" feature, but it's rather disappointing because as a small-scale independent operation I don't expect to be able to afford it, and that would go for a lot of productive people in security research. But then, that's capitalism.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#243

Post by BossingAround »

tyre wrote: post #156
bmcahren wrote: post #102

Earlier quoted context omitted.

This is why we are refactoring our database to be able to migrate to Amazon documentdb from MongoDB. Encryption at rest.... Pay up!

Curious, why do you use Mongo? Does it give you something that a JSONB column in Postgres wouldn’t?

Surprisingly, I feel Mongo has been kind of surging back into developers' minds. I thought Mongo was utterly dead, and I also don't know why would one use Mongo instead of JSONB. The last I heard (3-4 years ago?), there were some fundamental problems with Mongo.

That said, I've incidentally heard a lot about Mongo in the last half a year. Might be my bubble. Might be MongoDB actually maturing and getting really good. I hope it's the latter.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#244

Post by TwoBit »

Linkd wrote: post #193
vulcan01 wrote: post #191

I've got some Heroku projects, which don't have a static ip. How do I protect myself against this?

Simply set a secure password on any DB instances exposed to the internet.

Are the databases being meowed lacking any passwords?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#245

Post by jwr »

nisa wrote: post #60
rectang wrote: post #27

If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…

It's also easy to get bitten by Docker. You can secure your server with iptables/ufw only to discover that docker happily punches through your firewall and you need to filter on the DOCKER-USER chain - and even that was broken: https://unrouted.io/2017/08/15/docker-firewall/ https://github.com/docker/for-linux/issues/690

Yes, this is terrible, and when I discovered this, I was appalled how it seemed no one was taking this seriously.

When you use ufw with a default DENY policy, you tend to assume that whatever isn't explicitly listed gets DENIED. This is not the case with Docker, and I think it's just a matter of time until someone loses big because of this issue.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#247

Post by davidbrennerjr »

I can't believe people are victim blaming the db admins for not knowing about vulnerability. What good comes of destroying the db instead of talking about the vulnerability to the open source projects? Coincidentally shodan; that I've never heard of.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#248

Post by gavinray »

jcrawfordor wrote: post #235
gavinray wrote: post #217

Earlier quoted context omitted.

Friendly FYI, "EXPOSE" is a no-op that is only meant as visual documentation to end-users. "The EXPOSE instruction does not actually publish the port. It functions as a type of documentation between the person who builds the image and the person who runs the container, about which ports are intended to be published." Second paragraph: https://docs.docker.com/engine/reference/builder/#expose

I'm referring to docker-compose, where 'port' and 'expose' are container configuration options that behave differently from the Dockerfile keyword. Although the similar words with different meanings no doubt contribute to confusion.

Ah, my mistake. That comes off pretty asinine then, apologies.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#249

Post by m12k »

philshem wrote: post #155
user5994461 wrote: post #74

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

The top-voted answer links to this HN page. I'm stuck in an infinite loop.

Nah, you're just in an unbounded recursion - don't worry, I can already now tell you that it ends with stack overflow.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#250

Post by achillean »

hobofan wrote: post #31
29athrowaway wrote: post #12

Search engines like shodan.io make it trivial to discover unsecured databases exposed to the Internet.

What I don't get about Shodan: Why aren't all unsecured databases found instantly (at the moment Shodan went online), but recurring attacks/dumps like this one that rely on it? Do they update their crawl data in waves?

A story like this pops up every year and preventing ransomware/ mass-deletion of publicly exposed databases has proven to be very challenging to stop from happening. I mean, I wrote about this issue 5 years ago:

https://blog.shodan.io/its-the-data-stupid/

We've also sent the raw data to various database vendors for free but even for them it's difficult to reach out to customers to get it fixed. And then there's always the worry that you'll get shot as the messenger of bad news. We've had a lot more success in getting things taken offline when we already have some relationship with the organization or at least a mutual customer.

In the past, older versions of MongoDB were more public than newer versions but that isn't the case anymore based on what we're seeing right now:

https://beta.shodan.io/search/facet?query=product%3Amongodb&...

And in terms of Shodan, we crawl 24/7 (i.e. not waves) and update the search engine as the data is collected with a small delay (https://monitor.shodan.io) for their networks will see it before it shows up on the search index.

Post reply on HN