Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

341–350 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#341

Post by achillean »

MauranKilom wrote: post #335

The part that confuses me here is that everybody seems to take in stride that all these public-facing databases are already tracked and indexed. Like, how does https://www.shodan.io/search?query=meow+indices know all this? What am I missing here? Is this attack literally "attempt access each database listed on shodan.io and destroy it if that works"? I might be missing some major aspect (I certainly hope so), but isn…

It has already happened in the past. Repeatedly. There's news coverage about this at least once a year. And it doesn't require using Shodan as there are plenty of open-source tools for scanning the Internet nowadays.

For example, this was from the same news website a few years ago:

https://www.bleepingcomputer.com/news/security/massive-wave-...

I've also written about it many times:

https://blog.shodan.io/its-the-data-stupid/

https://blog.shodan.io/its-still-the-data-stupid/

https://blog.shodan.io/the-hdfs-juggernaut/

https://blog.shodan.io/elastic-data-exposure-grows-to-3-2-pb...

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#342

Post by abbadadda »

asdfasgasdgasdg wrote: post #81
petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…

lol im sorry but this is probably not the best go-to example of real world consequences:

> What if one of the databases has a record of credits you've purchased at your local spin studio?

p.s. bobby tables did it first

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#343

Post by moooo99 »

user5994461 wrote: post #289
pramodhs wrote: post #280

Earlier quoted context omitted.

I'm working on a personal project and not at all related to my work. I accidentally kept ports open :facepalm, sorting things out now :)

Recommend to setup two subnets in your project. One public and one private. This prevents this sort of issues, instances in the private subnet simply don't get a public IP, they can't be reached over the internet. For reference, the standard practice in a company is to have a (third) separate subnet for databases, with zero internet access (no NAT gateway). Connection must be explicitly opened from/to database client…

> Recommend to setup two subnets in your project. One public and one private.

This is very good advice. We recently had a uni project where we had to use a MongoDB database. Somebody just apt-get installed a mongodb onto a DO droplet called it a day. Two days later the only remaining records prompted us to transfer x amount of BTC to a adress that was store in our DB. It just contained dummy data, but it is worrying that something like this apparently happens to lots of companies as well.

The only thing I find weird is that ElasticSearch itself does not offer a way to handle authentication, it was just enabled by a plugin that was paid (it seems like its free now).

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#344

Post by Linkd »

quasarj wrote: post #256
vulcan01 wrote: post #196

Earlier quoted context omitted.

Ah, I see. So no need to find a static IP to use :) Thank you.

I mean, if the database is not directly available on the internet, that would be a great help as well.

Agreed, password is the bare minimum.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#345

Post by tremon »

heretoo wrote: post #322

Hippocratic Oath: "First, do no harm".

And the Hippocratic oath applies to online vigilantes how, exactly? Right now, I think these actions are causing more good than twenty years of lacklustre legislation have done, worldwide.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#346

Post by ljm »

pramodhs wrote: post #280
user5994461 wrote: post #74

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

I'm working on a personal project and not at all related to my work. I accidentally kept ports open :facepalm, sorting things out now :)

First thing I always do on any new VPS is to sort out SSH (disable root login, disable password login), set up fail2ban, install and configure ufw... and if I need to set up something like redis or similar, make sure it only listens to internal connections and also that it is decently auth'd. For deployment and other things I make users that can only write to certain directories; no sudo. It's nothing new or special but it gets lost in distributed systems.

It's a lot more work when doing it in the cloud and spinning up these things from docker containers in K8S...but you're entirely to blame if you don't know what you're deploying and don't understand any of the potential threats.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#347

Post by achillean »

AznHisoka wrote: post #211

Is there an inexpensive service out there that does “mock” attacks if you give it a bunch of host names and ports? I know it’s something you could create yourself but would be nice to have a third party try to connect to your databases and immediately alert you if it was able to gain access. Would especially be useful if you were tinkering with firewall/security settings and accidentally opened something up.

Shodan Monitor will do it and if you're only keeping track of https://www.shodan.io/store/member). You just provide an IP/ network/ domain and we'll notify you if anything changes or becomes vulnerable. It's basically Google Alerts but for network ports:

https://monitor.shodan.io

Disclaimer: I'm the founder of Shodan.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#348

Post by MauranKilom »

achillean wrote: post #341
MauranKilom wrote: post #335

The part that confuses me here is that everybody seems to take in stride that all these public-facing databases are already tracked and indexed. Like, how does https://www.shodan.io/search?query=meow+indices know all this? What am I missing here? Is this attack literally "attempt access each database listed on shodan.io and destroy it if that works"? I might be missing some major aspect (I certainly hope so), but isn…

It has already happened in the past. Repeatedly. There's news coverage about this at least once a year. And it doesn't require using Shodan as there are plenty of open-source tools for scanning the Internet nowadays. For example, this was from the same news website a few years ago: https://www.bleepingcomputer.com/news/security/massive-wave-... I've also written about it many times: https://blog.shodan.io/its-the-dat…

Jeez, that's a pretty impressive dumpster fire. And it's been going for half a decade. Kudos for keeping track of it and periodically doing your part in reminding the world.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#349

Post by theevilsharpie »

IAmEveryone wrote: post #332
rectang wrote: post #27

If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…

That's just victim blaming. The same logic applies to every crime: "lock your doors if you don't want your TV to be stolen!". It also works at any level of security: "Lock your doors and hire guards if you don't want clever thieves breaking a window..." But if you require everyone to take adequate measures to physically secure their houses, you don't even need laws and morality! And while this may provide the sort of…

> But if you require everyone to take adequate measures to physically secure their houses, you don't even need laws and morality!

If laws and morality were sufficient protection against malicious actors, I might agree with you.

However, in a world where cyber vandals are often beyond any accessible jurisdiction (and may even be supported by their local authorities), laws and morality are clearly not effective at keeping unauthorized users out of private systems. As such, the responsibility for keeping private information secure naturally falls on the people running the systems.

Putting up a network firewall (or at least requiring authentication) would have prevented the damage described in the OP, and is a rudimentary security measure that has been common practice for decades. The people who suffered significant damage from this attack should strongly consider outsourcing system administration to someone who knows what they're doing.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#350

Post by heretoo »

tremon wrote: post #345
heretoo wrote: post #322

Hippocratic Oath: "First, do no harm".

And the Hippocratic oath applies to online vigilantes how, exactly? Right now, I think these actions are causing more good than twenty years of lacklustre legislation have done, worldwide.

That was aimed at everyone on this thread that feels comfortable with deleting databases that they don't own.

Vigilantes make their own choices, but professionals are judged by their reputation. As I've said elsewhere, I challenge anyone, especially professionals, to tweet "I will delete your data if you don't secure it" and to add it to your resume/CV as a strength.

Post reply on HN