Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

301–310 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#301

Post by wolco »

cryptoz wrote: post #276
wolco wrote: post #251

Earlier quoted context omitted.

If a site/service has a right to allow a person to delete data. The machine can be setup however they like. These are not hacked databases. The system said welcome what do you want to do? You can read everything or delete everything or add anything. So they did.

> These are not hacked databases. Yes they are. The method of the hack was 'simple' to you, but that doesn't mean it's just magically not a hack any more. These are hacked databases. > The system said welcome what do you want to do? You can read everything or delete everything or add anything. I don't understand this. Are you suggesting that the attackers were greeted by the database with an English-language legal di…

If you attempt to connect to a database the database will greet you. It can be configured to ask for a login. It can be configured to have no login. If it doesn't have a login and gives you a welcome prompt it's not called hacking. In order to hack something it needed to be secured to start with.

Databases do greet users in mostly english. Need help? Type help. On the list of things the system allows deleting data appeared to be one.

If you knock on a door and the door opens and says welcome what do you want to do (delete data, read data) and you pick delete it doesn't mean it's illegal vandalism.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#302

Post by p1necone »

cryptoz wrote: post #292
pietroglyph wrote: post #254

Earlier quoted context omitted.

Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.

Vandalism is not a good public service. > I’d much rather have my data deleted until it’s secured than have it stolen by someone else There are multiple logical fallacies in this sentence. First is the use of the world 'until' which is ambiguous here; it suggests that your data can be 'undeleted' after the DB has been secured or you would rather not have any data stored anywhere that is not secured. Either option to…

I assume the comment was partially in jest. But this would actually work well if it was consistent and fast. If databases get wiped before you have time to put anything important in them then noone gets hurt.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#303

Post by steffan »

vulcan01 wrote: post #191

I've got some Heroku projects, which don't have a static ip. How do I protect myself against this?

If you're using MongoDB Atlas, you can allow connections only from a specific subnet. Also, you should of course set a password or use x.509 certs.

If you're hosting your own DB on a cloud provider, connect using a VPC / Heroku's Private Space Peering to keep your database off of the internet.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#304

Post by steffan »

TwoBit wrote: post #244
Linkd wrote: post #193

Earlier quoted context omitted.

Simply set a secure password on any DB instances exposed to the internet.

Are the databases being meowed lacking any passwords?

At least in the case of MongoDB, yes. Listening on all interfaces and not having a password set.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#305

Post by pavel_lishin »

BossingAround wrote: post #241
lol768 wrote: post #38

Earlier quoted context omitted.

I've said it on here before, but the way in which Elasticsearch used to lock away critical security functionality (like TLS support and RBAC) behind a paid subscription whilst making just enough functionality available for free such that users could shoot their foot off is disgusting. This only ever changed after Open Distro for Elasticsearch came onto the scene and forced Elastic's hand. I entirely agree the vendors…

Well, it's just another attempt at monetizing the product. Nowadays, companies and developers expect everything to be OSS (and I love it) yet it's incredibly expensive to develop SW (and very few people do OSS just because of passion--I tried and failed miserably). Locking RBAC and TLS behind a paid subscription is a sure way to force companies with security teams to pay for it (or not to use it). This particular les…

> Well, it's just another attempt at monetizing the product.

Don't make excuses for their shitty business practices.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#306

Post by randyrand »

pietroglyph wrote: post #254
user5994461 wrote: post #74

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.

depends on the data. it could be public records

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#307

Post by gameswithgo »

pavel_lishin wrote: post #305
BossingAround wrote: post #241

Earlier quoted context omitted.

Well, it's just another attempt at monetizing the product. Nowadays, companies and developers expect everything to be OSS (and I love it) yet it's incredibly expensive to develop SW (and very few people do OSS just because of passion--I tried and failed miserably). Locking RBAC and TLS behind a paid subscription is a sure way to force companies with security teams to pay for it (or not to use it). This particular les…

> Well, it's just another attempt at monetizing the product. Don't make excuses for their shitty business practices.

Don't tell people what to do.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#308

Post by octodog »

Drakim wrote: post #84
asdfasgasdgasdg wrote: post #81

Earlier quoted context omitted.

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…

It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? The company could take a huge financial hit and people might lose their jobs because of their practices being exposed.

Your comparison isn't fair - blowing the whistle is supposed to be a last resort. Internal disclosure and attempting to fix the issue collaboratively is always the first step.

This attack is indiscriminate and is without warning, so it eliminates the possibility for database owners to fix the problem in good faith.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#309

Post by hinkley »

steffan wrote: post #299
hinkley wrote: post #230

Earlier quoted context omitted.

If memory serves, Postgres will only listen on 127.0.0.1 unless the admin password has been set. All software should work like that.

MongoDB listens only on localhost by default since 3.6 (2017)

You are allowed to judge people for taking far, far too long to do the right thing.

It indicates a pattern of poor judgement, which speaks to trust. You know they are going to let you down each time a new issue comes up.

Faulting people for being cautious around such bad actors (which I'm not saying you're doing, but the response will) speaks to your judgement, not the vendor's.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#310

Post by colonwqbang »

gwright wrote: post #288
colonwqbang wrote: post #281

Earlier quoted context omitted.

I agree, but I think it's beside the point. As engineers we have to assume that there is always someone out there looking to break into our systems. We don't get to blame them for our failure to secure our systems. For us to be angry at the hackers is as fruitless as it would be for the unhygienic cook to be angry at the bacteria.

Why are you making the assumption that I'm making the point "as an engineer" as opposed to just a citizen who thinks it is reasonable to expect people not do destroy something that doesn't belong to them? Your analogy about bacteria doesn't make any sense, we don't expect the bacteria to be actively seeking out unhygienic cooks. If you want to use your analogy it would be like having someone shake the cook's hand in…

You're presumably an engineer, I'm an engineer, this is an engineering forum. That is why I may have "assumed you made the point as an engineer".

It sounds as if you think I'm defending the attackers. I'm not. I'm pointing out that the presence of malicious actors is a fact of life on the Internet, like it or not.

I'm not going to take my analogy further. I think it's reasonably clear what I meant.

Post reply on HN