Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

blog.newsblur.com

Post reply on HN
Print view View original

271–275 of 275 posts

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#271

Post by JamesSwift »

closeparen wrote: post #64
cratermoon wrote: post #42

Earlier quoted context omitted.

Clearly it was not fine, but in fact leaky, and depending only on perimeter security was (and is) flawed. See https://collaboration.opengroup.org/jericho/commandments_v1....

There was no perimeter security here. The attacker did not first enter a private network and then pivot to MongoDB; he dialed MongoDB right from the internet. Had Mongo been un-authenticated on a private network it still might have been owned, but the bar would have been a lot higher. Side note: everything that’s ever existed is “flawed,” it’s a weird word to use in the context of something you want to discredit, bec…

There was perimeter security in this case. The user diligently configured a white-list only UFW firewall. That is their perimeter.

Docker diligently sidestepped that firewall, and in so doing exposed that this was a case of perimeter security. Because by bypassing that single external filter, the entire service was now vulnerable.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#272

Post by closeparen »

JamesSwift wrote: post #271
closeparen wrote: post #64

Earlier quoted context omitted.

There was no perimeter security here. The attacker did not first enter a private network and then pivot to MongoDB; he dialed MongoDB right from the internet. Had Mongo been un-authenticated on a private network it still might have been owned, but the bar would have been a lot higher. Side note: everything that’s ever existed is “flawed,” it’s a weird word to use in the context of something you want to discredit, bec…

There was perimeter security in this case. The user diligently configured a white-list only UFW firewall. That is their perimeter. Docker diligently sidestepped that firewall, and in so doing exposed that this was a case of perimeter security. Because by bypassing that single external filter, the entire service was now vulnerable.

I guess this is hair-splitting semantics, but I think when most people say "perimeter security" in the context of a web production environment, they mean that things like DBs, message queues, and backend services share a private network with the servers that actually terminate user TCP connections.

Obviously with only perimeter security, those servers are soft targets to an attacker who compromises a frontend host. I am all for hardening the interior.

"Don't put stuff on the internet that doesn't need to be, even if you think it's secure, because it's probably complicated enough for you to be mistaken about that." This is a perimeter security philosophy, and also what OP needed. If anything the host-level firewall mishap seems closer to an application-level authz bypass than to a pivot across a "trustworthy" network.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#273

Post by Cpoll »

Saris wrote: post #270

I'm a bit curious as to why they had the MongoDB docker container running with the 27017 port mapped in the first place, maybe for testing? You don't need to map ports for inter-container communications, and maybe that's where some of the confusion comes in for people using docker. I have noticed a few friends who have been playing with docker for home server stuff thinking that they need to map ports for everything,…

> ufw firewall ... kept on a strict allowlist with only my internal servers

> I switched the MongoDB cluster over to the new servers.

It sounds like they had multiple Mongo nodes on separate machines, communicating over the internet. Presumably the application(s) are also on separate machines and would need to communicate with Mongo.

I think `docker network` has options to create a network across Docker daemon hosts? But that has some tradeoffs, I'm sure.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#274

Post by rasguanabana »

That’s why you need more than one layer of security over your critical assets. Network based access control to me always feels easy to misconfigure. Basic auth would delay attacker. Encryption of data at rest would render stolen data unusable to attacker.

General advice - perform threat modeling of your services to uncover weak links.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#275

Post by ex_amazon_sde »

mtberatwork wrote: post #232
ex_amazon_sde wrote: post #167

Earlier quoted context omitted.

> So I can't fault people for trying to avoid this mess. Ex-Amazon here. Being deeply familiar with OS fundamentals and internals, "low level" tools, and so on is crucial. A lot of candidates show to interviews with CVs filled with names of popular frameworks and fancy devops tools and often don't understand what really happens behind the curtain. People are becoming less familiar with the basics and tend to reinvent…

I'm not saying you are wrong but this sounds like it is in part a hiring problem. > Being deeply familiar with OS fundamentals and internals, "low level" tools, and so on is crucial. ...needs to be front and center on the job description then. Far too often these kinds of things are hidden on the initial job descriptions and it just wastes everyone's time. I get that HR/recruiters want to throw a big net but vague jo…

I cannot generalize for the whole company. When writing jobspecs in my team we never made lists of the "popular frameworks of the month".
Post reply on HN