Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

321–330 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#321
post #249

Earlier quoted context omitted.

The top-voted answer links to this HN page. I'm stuck in an infinite loop.

Nah, you're just in an unbounded recursion - don't worry, I can already now tell you that it ends with stack overflow.

I dunno, does Chrome implement tail call optimization? :)

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#323
post #263

This is what happens when you lay off all of your sysadmins because "the cloud", move that role to devops and then downsize that to a subduty of a developer.

I’ve seen just as many sysadmins do this as developers. It’s not a question of job title as a psychological pitfall (people who are looking for things to succeed don’t ask when they should fail) and companies not specifically retaining people with security experience because they cost more.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#324

Earlier quoted context omitted.

Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.

Vandalism is not a good public service. > I’d much rather have my data deleted until it’s secured than have it stolen by someone else There are multiple logical fallacies in this sentence. First is the use of the world 'until' which is ambiguous here; it suggests that your data can be 'undeleted' after the DB has been secured or you would rather not have any data stored anywhere that is not secured. Either option to…

If you can't look after people's sensitive data you don't deserve to have it.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#325

Earlier quoted context omitted.

Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.

depends on the data. it could be public records

Databases can be public and secure. If a database can be deleted, it is not secure.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#326

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

I wonder how much customer info they were leaking before then.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#327

Earlier quoted context omitted.

Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.

depends on the data. it could be public records

Good.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#328
post #296

After having read a number of articles talking about data leaks on a gigantic scale, I decided to check it out. Because shodan is not free to use/behind a paywall, I wrote a simple windows console tool which scans all known Azure subnets for unsecured elasticsearch instances and logs the results. I was baffled by the amount of instances this tool found within the first few hours :( To say that security in IT is getti…

Doing aggregate queries is free - only if you want to download actual data do we start charging money. You could just do the following via the CLI using a free account:

$ shodan count product:Elastic org:Azure

This entire website is powered by a free API key: https://exposure.shodan.io

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#329

Earlier quoted context omitted.

Ok, but losing "just some of your belongings" is bad also, right? When thinking about the culpability of the person deleting the data or storing the data, we have to start from the assumption that the owner of the data values it. Whatever analysis you want to put on the situation I don't think it is reasonable to start with the idea that some of the data might not be that valuable.

Either the data is something public (name, address, etc) in which case, whatever. Or it's data that was gathered (in line of business, for example) and its destruction is anywhere from more secure to an inconvenience. Or it's data that was aggregated beyond legitimate use (hey, FAANG) and by all means, tear it the hell up and throw it away.

Why do you feel it is important to characterize the nature of the data? The unauthorized deletion is wrong regardless of the nature of the data.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#330

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

Atlassian is not on Google Cloud, they are an AWS shop. I suspect this is an unrelated personal project.
Post reply on HN