Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

251–260 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#251
post #199

Earlier quoted context omitted.

No one knows more information than the article presents. When you state that victims exist or that the data being deleted is important you are also making unfounded assumptions. You can't have it both ways.

I think it is entirely reasonable to start with the presumption that people have a right to their data and to their property, that it is valuable to them.

If a site/service has a right to allow a person to delete data. The machine can be setup however they like. These are not hacked databases. The system said welcome what do you want to do? You can read everything or delete everything or add anything.

So they did.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#252

Earlier quoted context omitted.

My blame scale for breaches, most to least: 1) the cultural and economic forces driving everything online way before that’s anything like a good idea, 2) companies storing more than they need to, 3) the people who left it unsecured (bigco, tech startups, and anything very sensitive), 4) the people stealing data, 5) the people who left it unsecured (Smaller shops that’ve been made to feel they must be online), [large…

Why is the person doing the deleting so low, relatively speaking, in your ranking of people's responsibility for them doing the deleting? Also, do you think that this person or persons would refrain from deleting the data if they had the opportunity, but it qualified as a "good idea" to keep online? I.e. they might review, say, medical records, spend some time thinking to themselves whether it was 'necessary' to be o…

Mostly because it's a very effective way to ensure things get fixed, while gaining the "attacker" nothing. It's harmful, but so is finding 4000 insecure databases, sending 4000 notification emails, and having 3950 of them ignored (and that approach is probably more risky, so far as inviting legal trouble and expenses). It also neatly removes anyone else's ability to take the data.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#254

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#255

I can't believe people are victim blaming the db admins for not knowing about vulnerability. What good comes of destroying the db instead of talking about the vulnerability to the open source projects? Coincidentally shodan; that I've never heard of.

There's a difference between a vulnerability, and a common misconfiguration that usually comes from a "make it work first, security later" mindset.

The good that comes from destroying the DB is:

a) the data is no longer exposed to the Internet, where more malicious actors could take it, affecting the customers of the incompetent company

b) ignoring it stops being a viable option - leaking your customer's data all over the place often doesn't have sufficiently obvious and severe consequences for the company doing the leaking to discourage it. Disruption that breaks production will get their attention, and they likely will secure their database in the future.

(No moral or legal judgement regarding this action, just answering the "what good comes of it" question.)

Edit: Also, someone commented further below on the difficulty of doing it the right way - it's hard to contact the companies, and it's even harder to get them to actually listen and fix it instead of ignoring it or trying to "shoot the messenger". This approach may be wrong and/or illegal, but it it much likely to actually draw the attention of the right people, and prevent them from simply ignoring the problem.

The companies running those open databases aren't just victims; they're also perpetrators of privacy violations. In many cases, they're even collecting data for a purpose that the data subject receives no benefit from.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#256
post #193

Earlier quoted context omitted.

Simply set a secure password on any DB instances exposed to the internet.

Ah, I see. So no need to find a static IP to use :) Thank you.

I mean, if the database is not directly available on the internet, that would be a great help as well.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#257

Earlier quoted context omitted.

>tree^H^H^H^Hgraph If we pretend we're using readline here, ^W (yank previous word) and ^U (yank to the start of the line) should save you some key presses. Some recommended bedtime reading: https://catonmat.net/ftp/readline-emacs-editing-mode-cheat-s... https://en.wikipedia.org/wiki/GNU_Readline#Emacs_keyboard_sh...

These are not emacs commands. They aren't even unix shell commands. They are TTY commands, some of them dating back to the dot matrix teletype terminals. My favorite is ^U, which 90% of the time lets you start over on a password prompt when you are sure you just fat fingered but not sure how badly.

Thank you, that one is really useful! The one I had always remembered was ^H for whenever no other way to delete characters works. I need it in some SQL REPLs which aren't configurable.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#258

I can't believe people are victim blaming the db admins for not knowing about vulnerability. What good comes of destroying the db instead of talking about the vulnerability to the open source projects? Coincidentally shodan; that I've never heard of.

Victims are not the DB admins. Victims are the people whose private data, or data they expect to be private, is exposed due to developer incompetence.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#259
post #156

Earlier quoted context omitted.

Curious, why do you use Mongo? Does it give you something that a JSONB column in Postgres wouldn’t?

Surprisingly, I feel Mongo has been kind of surging back into developers' minds. I thought Mongo was utterly dead, and I also don't know why would one use Mongo instead of JSONB. The last I heard (3-4 years ago?), there were some fundamental problems with Mongo. That said, I've incidentally heard a lot about Mongo in the last half a year. Might be my bubble. Might be MongoDB actually maturing and getting really good.…

I mostly hear complaints about email spam from their salespeople.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#260

Is there an inexpensive service out there that does “mock” attacks if you give it a bunch of host names and ports? I know it’s something you could create yourself but would be nice to have a third party try to connect to your databases and immediately alert you if it was able to gain access. Would especially be useful if you were tinkering with firewall/security settings and accidentally opened something up.

Metasploit kinda fits the description
Post reply on HN