Earlier quoted context omitted.
depends on the data. it could be public records
Good.
Oops no welfare for you!
I understand that some people won't learn without encouragement but it's not a good thing for all.
New ‘Meow’ attack has deleted almost 4k unsecured databases
331–340 of 544 posts
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#332If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…
That's just victim blaming. The same logic applies to every crime: "lock your doors if you don't want your TV to be stolen!".
It also works at any level of security: "Lock your doors and hire guards if you don't want clever thieves breaking a window..."
But if you require everyone to take adequate measures to physically secure their houses, you don't even need laws and morality!
And while this may provide the sort of negative reinforcement you are hoping for, actual damages in each case are going to be all over the place. That makes this one of the worst possible punishments. Imagine the penalty for speeding is a random outcome somewhere between a stern reminder and the death penality. There would be nothing fair and little useful about that, even though it does follow the same basic principle of do bad -> be harmed.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#333Earlier quoted context omitted.
The top-voted answer links to this HN page. I'm stuck in an infinite loop.
Nah, you're just in an unbounded recursion - don't worry, I can already now tell you that it ends with stack overflow.
Nah stack overflow learned their lesson and switched over to free monads.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#334If you really believe this action is warranted, as I've read on this thread, I challenge you to tweet under your real name "I will delete your data if you don't secure it", and add it to your resume/CV as one of your strengths.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#335The part that confuses me here is that everybody seems to take in stride that all these public-facing databases are already tracked and indexed. Like, how does https://www.shodan.io/search?query=meow+indices know all this? What am I missing here?
Is this attack literally "attempt access each database listed on shodan.io and destroy it if that works"?
I might be missing some major aspect (I certainly hope so), but isn't this like wondering why all those fireworks that people keep storing on the streets were eventually set off by some kid with a mask? Why isn't the question "why didn't this happen sooner"?
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#336Earlier quoted context omitted.
Good.
Oops no welfare for you! I understand that some people won't learn without encouragement but it's not a good thing for all.
This attack uses public write access, which is how they can delete stuff. I think we can agree that this is not good, and I also think we can agree that a database shouldn't be exposed as-is without an application layer or API on top
Ultimately, companies like MongoDB and Elasticsearch are culpable for selling database technology that is insecure by default, presumably because that's the easiest way to boost their metrics for the VC overlords.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#337I can't believe people are victim blaming the db admins for not knowing about vulnerability. What good comes of destroying the db instead of talking about the vulnerability to the open source projects? Coincidentally shodan; that I've never heard of.
There's a difference between a vulnerability, and a common misconfiguration that usually comes from a "make it work first, security later" mindset. The good that comes from destroying the DB is: a) the data is no longer exposed to the Internet, where more malicious actors could take it, affecting the customers of the incompetent company b) ignoring it stops being a viable option - leaking your customer's data all ove…
So, you've answered "what good comes of it".
For completeness, would you mind answering, "what bad comes of it?"
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#338why are only meme databases affected?
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#339It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag... ). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "n…
> It's illegal in the real world, and should be illegal in the digital world It is illegal in the USA. And is easily an arguable civil case as well. The problem is identifying the perportrator. Organizations are only way to hold poor actors accountable. Bad PR and going out of business cause data critical to operations has all been deleted are strong incentives. Unfortunately businesses typically lobby for harsh laws…
Bad PR works to an extent, but bad PR can be combatted with good PR, not necessarily with changes. I think an independent regulator would be useful; one that can testify that a company is following best practices for data, etc. Although if the regulators don't have any teeth, or if they don't have a clear benefit for companies to allow a regular, comprehensive, internal audit, it definitely won't gain any adoption.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#340Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol
I wonder how much customer info they were leaking before then.
The question was posted early Friday morning. If this drove their services, I suspect a lot of us would've known about it a lot sooner than now...