Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

281–290 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#281

Post by colonwqbang »

gwright wrote: post #157
nkrisc wrote: post #124

Earlier quoted context omitted.

But it's my personal and sensitive data that they are poor stewards of, not their property.

I agree but I don't think that changes my point that the person who destroys the data has more culpability than the storage service in the destruction of the data. There tends to be a pass given to people destroying data and I don't think that is right.

I agree, but I think it's beside the point.

As engineers we have to assume that there is always someone out there looking to break into our systems. We don't get to blame them for our failure to secure our systems.

For us to be angry at the hackers is as fruitless as it would be for the unhygienic cook to be angry at the bacteria.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#282

Post by achillean »

akx wrote: post #205
nautilus12 wrote: post #165

Why is mongodb seem to show up alot with this. Does their default set up hide some unsecured users? Its been a while but I dont remember that being in there.

No, their default sets up no authentication at all IIRC. Combined with Dockerized installations punching through some firewall setups (as discussed elsewhere), you'll get meowed.

By default though, MongoDB will only listen on localhost and I believe it'll show you a big warning on boot up if you don't have authentication configured. They used to listen on 0.0.0.0 by default but that was fixed many years ago.

And this issue doesn't just affect MongoDB - imo since the "webscale" days it's been a favorite to knock on but the public exposure of data happens across many technologies. Here's a comparison with a few others:

https://blog.shodan.io/elastic-data-exposure-grows-to-3-2-pb...

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#283

Post by SahAssar »

Twirrim wrote: post #10
EGreg wrote: post #7

How does this work? Will it affect MySQL databases accessible from the Internet but secured with a long random password?

Don't expose MySQL databases to the internet. Just don't. Stick an API layer in at the very least with key based auth, and only the bare minimum capabilities allowed for the user. That said, if you'd read the article you'd see that so far only unsecured MongoDB, Elasticsearch and Redis installations are being attacked so far.

That makes any number of assumptions about the API layer, what "key based auth" is used and what data the database has.

For example I'd probably trust MySQL or PostgreSQL key validation more than what some random dev has coded in a private repo (more eyes on the code and probably better developers looking at it).

Auth is something that a lot of devs still do not implement properly and even popular libs for it like passport for node and others (including default configs for most JWT libs) have had very bad security issues.

If your minimum permissions map well onto the databases permission model then it's better to not have a layer in between. Proper db permissions and a using TLS/SSH as a transport is probably better.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#284

Post by nisa »

nisa wrote: post #60
rectang wrote: post #27

If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…

It's also easy to get bitten by Docker. You can secure your server with iptables/ufw only to discover that docker happily punches through your firewall and you need to filter on the DOCKER-USER chain - and even that was broken: https://unrouted.io/2017/08/15/docker-firewall/ https://github.com/docker/for-linux/issues/690

link for the missing DOCKER-USER chain: https://github.com/docker/for-linux/issues/810 - so if you are unlucky you are one apt upgrade away from data theft...

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#285

Post by achillean »

jfk13 wrote: post #143
wolco wrote: post #110

Earlier quoted context omitted.

So is deleting a database. Putting a password and emailing the admin would solve the password problem. But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.

How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.

Unfortunately it's rarely that simple. If you look at the currently exposed MongoDB instances you'll see that most of them are in the cloud without any obvious attribution. You could email the cloud providers and see if they will reach out to the end-user but chances are they already know about it. Here's an article I wrote on that subject, although it was related to industrial control systems:

https://blog.shodan.io/taking-things-offline-is-hard/

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#286

Post by Avamander »

kl4m wrote: post #163
faebi wrote: post #101

Is it legal to access them if they are unsecured?

Not any more than walking in the street and trying car doors.

Bad comparison. This is akin to someone random walking into a restaurant and looking under the fryer and finding a dead rat and removing it with the fryer.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#288

Post by gwright »

colonwqbang wrote: post #281
gwright wrote: post #157

Earlier quoted context omitted.

I agree but I don't think that changes my point that the person who destroys the data has more culpability than the storage service in the destruction of the data. There tends to be a pass given to people destroying data and I don't think that is right.

I agree, but I think it's beside the point. As engineers we have to assume that there is always someone out there looking to break into our systems. We don't get to blame them for our failure to secure our systems. For us to be angry at the hackers is as fruitless as it would be for the unhygienic cook to be angry at the bacteria.

Why are you making the assumption that I'm making the point "as an engineer" as opposed to just a citizen who thinks it is reasonable to expect people not do destroy something that doesn't belong to them?

Your analogy about bacteria doesn't make any sense, we don't expect the bacteria to be actively seeking out unhygienic cooks. If you want to use your analogy it would be like having someone shake the cook's hand in order to put a mild irritant on their hands so that when they prepare food without washing or gloving their hands the irritant is spread to the food, thus highlighting the fact that the chef wasn't following good hygiene. Would you expect that behavior to be excused? Would you be OK with that if you were the one throwing up?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#289

Post by user5994461 »

pramodhs wrote: post #280
user5994461 wrote: post #74

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

I'm working on a personal project and not at all related to my work. I accidentally kept ports open :facepalm, sorting things out now :)

Recommend to setup two subnets in your project. One public and one private. This prevents this sort of issues, instances in the private subnet simply don't get a public IP, they can't be reached over the internet.

For reference, the standard practice in a company is to have a (third) separate subnet for databases, with zero internet access (no NAT gateway). Connection must be explicitly opened from/to database clients. It's a nightmare to manage on premise but it works really well in the cloud with firewalls allowing traffic based on instance tags.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#290

Post by cpursley »

tyre wrote: post #156
bmcahren wrote: post #102

Earlier quoted context omitted.

This is why we are refactoring our database to be able to migrate to Amazon documentdb from MongoDB. Encryption at rest.... Pay up!

Curious, why do you use Mongo? Does it give you something that a JSONB column in Postgres wouldn’t?

Yes, hipster cred.

For everyone else, JUP ("Just Use Postgres")

Snark aside, Postgres should hold you over for quite some time.

With Postgres you probably don't need Redis, Elastic Search, Mongo or Kafka.

Post reply on HN