Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

311–320 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#311

Post by [deleted] »

p1necone wrote: post #302
cryptoz wrote: post #292

Earlier quoted context omitted.

Vandalism is not a good public service. > I’d much rather have my data deleted until it’s secured than have it stolen by someone else There are multiple logical fallacies in this sentence. First is the use of the world 'until' which is ambiguous here; it suggests that your data can be 'undeleted' after the DB has been secured or you would rather not have any data stored anywhere that is not secured. Either option to…

I assume the comment was partially in jest. But this would actually work well if it was consistent and fast. If databases get wiped before you have time to put anything important in them then noone gets hurt.

[deleted]

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#312

Post by dmurray »

p1necone wrote: post #302
cryptoz wrote: post #292

Earlier quoted context omitted.

Vandalism is not a good public service. > I’d much rather have my data deleted until it’s secured than have it stolen by someone else There are multiple logical fallacies in this sentence. First is the use of the world 'until' which is ambiguous here; it suggests that your data can be 'undeleted' after the DB has been secured or you would rather not have any data stored anywhere that is not secured. Either option to…

I assume the comment was partially in jest. But this would actually work well if it was consistent and fast. If databases get wiped before you have time to put anything important in them then noone gets hurt.

Yeah, it's bad for the industry right now, but this is just a transition period! Once we get through the pain of losing a few databases, the new steady state where nobody's data is stored in world-writable databases will be better for everyone, and that will be worth the cost.

Consider if this happened five years ago, it would have had a smaller cost than happening today. And it was probably going to happen at some point, so better that it happened five years ago than today. By the same argument, better that it happened now than at any point in the future.

I'm not sure how serious I am about this argument but...at least a little bit? I guess the alternative argument is that any day now software vendors would have all moved to secure-by-default platforms where deploying a world-writable Redis in production would have been so difficult that it rarely happened.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#313

Post by ZephyrBlu »

edoceo wrote: post #266
AznHisoka wrote: post #211

Is there an inexpensive service out there that does “mock” attacks if you give it a bunch of host names and ports? I know it’s something you could create yourself but would be nice to have a third party try to connect to your databases and immediately alert you if it was able to gain access. Would especially be useful if you were tinkering with firewall/security settings and accidentally opened something up.

Run OpenVAS against your infrastructure. It's free cost, nearly free in time. Edit: I also do this as a service, have for years, and hammer my own system monthly.

Ironically, when I go their website I get a warning because their certificate has expired.

https://openvas.org/

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#314

Post by userbinator »

I wonder if you can find a remote code execution vulnerability in client libraries for one of these databases, and set up a few honeypot databases... you might be able to catch who's doing it and retaliate. The legalities of doing that are certainly questionable, but then again, so is this.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#316

Post by acdha »

atyppo wrote: post #298
acdha wrote: post #107

Earlier quoted context omitted.

That’s why I was specific about customer data: it’s basically a question of who’s harmed - if the cost is borne by the person cutting corners it’s more of a self-correcting problem.

It's not a matter of "cutting corners." Think of all of the small businesses that recently moved online due to store closures. These businesses simply do not have the budget required to create something comparable to, say, Best Buy's e-commerce. Sure, Shopify might come close, but how do you think Mom and Pop will find and create an e-commerce solution?

That’s the very definition of cutting corners. If they aren’t confident of their ability to operate safely they need to either hire a professional or go without - just as not wanting to pay a plumber doesn’t exempt you from meeting the health code or saving on accountants will be a get out of jail free card when you get audited.

If it sounds like I’m unsympathetic, yes, that’s true. Playing around with building your own database is a good learning experience but that changes once you expose other people to your mistakes. I’ve also dealt with a few small businesses and the people trying to run a business like this are always trying to save a buck - they’re the same ones who stiff contractors, avoid paying overtime, do their own taxes creatively, etc. If you have a successful business, you’ll drop a few bucks on Shopify, Wix, etc. to focus on the business rather than a distraction.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#317

Post by cryptoz »

wolco wrote: post #301
cryptoz wrote: post #276

Earlier quoted context omitted.

> These are not hacked databases. Yes they are. The method of the hack was 'simple' to you, but that doesn't mean it's just magically not a hack any more. These are hacked databases. > The system said welcome what do you want to do? You can read everything or delete everything or add anything. I don't understand this. Are you suggesting that the attackers were greeted by the database with an English-language legal di…

If you attempt to connect to a database the database will greet you. It can be configured to ask for a login. It can be configured to have no login. If it doesn't have a login and gives you a welcome prompt it's not called hacking. In order to hack something it needed to be secured to start with. Databases do greet users in mostly english. Need help? Type help. On the list of things the system allows deleting data ap…

> It can be configured to have no login. If it doesn't have a login and gives you a welcome prompt it's not called hacking. In order to hack something it needed to be secured to start with.

I very strongly disagree with this. Can you cite somewhere that unauthorized database access is not hacking if there is no password? To me and I think the law that is definitely illegal and hacking.

> If you knock on a door and the door opens and says welcome what do you want to do (delete data, read data) and you pick delete it doesn't mean it's illegal vandalism.

Yes it does! If you don’t have authorized access then that database isn’t yours and entering it is illegal.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#318

Post by nkrisc »

tdeck wrote: post #197
rectang wrote: post #27

If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…

Why not just rename all the tables or something? That's enough to get the developer's attention without being so destructive.

Because if it's not destructive they have no reason to pay attention. Change names back and it's business as usual.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#319

Post by owaty »

jrockway wrote: post #169
jb775 wrote: post #146

Earlier quoted context omitted.

What happens when mom & pop are storing your name and credit card # in plain text and then your identity gets stolen and credit ruined? Should we still be "charitable" to them and their d-bag nephew?

Your credit card number being stolen is a problem for your bank, not a problem for you. You can't steal someone's identity with a credit card number. The concern in this case is when there is some social problem with being in Mom & Pop Inc's customer database. There are probably some people that buy some things that they don't want other people to know about. When the database gets hacked and you are linked to being…

> Your credit card number being stolen is a problem for your bank, not a problem for you.

Not necessarily, depending on where you're based.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#320

Post by acdha »

gerdesj wrote: post #173
jcrawfordor wrote: post #159

Earlier quoted context omitted.

My guess would be that they went with "ports" instead of "expose" which makes it public. But even with careful composition of your docker-compose you might want to be careful, Docker can interact with iptables in surprising ways and long iptables rulesets are almost comically difficult to validate sometimes. The result is that if you're using both Docker (and even more if you use Compose, Kubernetes, some other orche…

"and long iptables rulesets are almost comically difficult to validate sometimes." Use nmap to evaluate your policy from the outside, don't try to validate it in your head by inspection.

Use Shodan.io’s monitor feature and you’ll get alerting, too.
Post reply on HN