Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

361–370 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#361

Post by barkingcat »

mhh__ wrote: post #331
qrbLPHiKpiux wrote: post #327

Earlier quoted context omitted.

Good.

Oops no welfare for you! I understand that some people won't learn without encouragement but it's not a good thing for all.

online databases that can be written and deleted by anyone on the internet are no good at all. The data can't be trusted. Of course no welfare for you! All I do is to replace all the names with my name and I can take all the welfare in the whole country! Or for example, doing a search for names and replacing all female names with male names ... how can you trust a database like that?

Making decisions based on a writable database (to the world, and not just from data sources like census, etc) is utterly useless.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#362

Post by rovr138 »

ljm wrote: post #336
mhh__ wrote: post #331

Earlier quoted context omitted.

Oops no welfare for you! I understand that some people won't learn without encouragement but it's not a good thing for all.

This attack uses public write access, which is how they can delete stuff. I think we can agree that this is not good, and I also think we can agree that a database shouldn't be exposed as-is without an application layer or API on top Ultimately, companies like MongoDB and Elasticsearch are culpable for selling database technology that is insecure by default, presumably because that's the easiest way to boost their me…

Write being the important keyword

They could have altered the data and no one would have been the wiser

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#363

Post by rovr138 »

smt88 wrote: post #325
randyrand wrote: post #306

Earlier quoted context omitted.

depends on the data. it could be public records

Databases can be public and secure. If a database can be deleted, it is not secure.

It sure was public...

This is not what people mean by open data

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#364

Post by nomel »

user5994461 wrote: post #74

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

This edit is speculation.

> I'm running an elastic search for a personal project on google-cloud and I use as a search index for my application.

He very clearly says it’s a personal project. Trying to learn new topics outside of your direct responsibilities, while employed, is very common in the software industry. Not everyone that works at a company is involved in databases at that company.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#365

Post by ramraj07 »

user5994461 wrote: post #289
pramodhs wrote: post #280

Earlier quoted context omitted.

I'm working on a personal project and not at all related to my work. I accidentally kept ports open :facepalm, sorting things out now :)

Recommend to setup two subnets in your project. One public and one private. This prevents this sort of issues, instances in the private subnet simply don't get a public IP, they can't be reached over the internet. For reference, the standard practice in a company is to have a (third) separate subnet for databases, with zero internet access (no NAT gateway). Connection must be explicitly opened from/to database client…

Issue is with AWS this setup instantaneously bumps the bill up from a few dollars a month to a few tens of dollars a month. Deal-breaker for personal projects. But, you can still secure the database with whitelisted IP addresses, which is what I do.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#366

Post by jessaustin »

gwright wrote: post #329
zentiggr wrote: post #293

Earlier quoted context omitted.

Either the data is something public (name, address, etc) in which case, whatever. Or it's data that was gathered (in line of business, for example) and its destruction is anywhere from more secure to an inconvenience. Or it's data that was aggregated beyond legitimate use (hey, FAANG) and by all means, tear it the hell up and throw it away.

Why do you feel it is important to characterize the nature of the data? The unauthorized deletion is wrong regardless of the nature of the data.

...wrong regardless...

That obviously isn't true. Some data shouldn't exist: CP. Some data can exist, but it's backed-up so well that deletion is never a problem. For example, I'm not going to forget my birth date any time soon! In fact, very little of the information that businesses have about me needs preservation. I remember it all, and if I decide the business still deserves it I can give it to them again.

It is of course possible that some of this data didn't need to be kept private, and therefore shouldn't have been deleted. Maybe some medical researchers had compiled the data they needed to formulate the ultimate cure to COVID-19? (I hope they had anonymized all the patient data!) Until those researchers come forward to lament humanity's loss, I'll just assume that all the "victims" who don't want to go into too much detail about the "lost" data were playing fast and loose with their customers' private information.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#367

Post by rovr138 »

moooo99 wrote: post #343
user5994461 wrote: post #289

Earlier quoted context omitted.

Recommend to setup two subnets in your project. One public and one private. This prevents this sort of issues, instances in the private subnet simply don't get a public IP, they can't be reached over the internet. For reference, the standard practice in a company is to have a (third) separate subnet for databases, with zero internet access (no NAT gateway). Connection must be explicitly opened from/to database client…

> Recommend to setup two subnets in your project. One public and one private. This is very good advice. We recently had a uni project where we had to use a MongoDB database. Somebody just apt-get installed a mongodb onto a DO droplet called it a day. Two days later the only remaining records prompted us to transfer x amount of BTC to a adress that was store in our DB. It just contained dummy data, but it is worrying…

Regarding elasticsearch, that’s actually fine.

Just block access to it on your firewall to the public ports and require people SSH or VPN for access if needed.

It’s not

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#368

Post by AznHisoka »

achillean wrote: post #347
AznHisoka wrote: post #211

Is there an inexpensive service out there that does “mock” attacks if you give it a bunch of host names and ports? I know it’s something you could create yourself but would be nice to have a third party try to connect to your databases and immediately alert you if it was able to gain access. Would especially be useful if you were tinkering with firewall/security settings and accidentally opened something up.

Shodan Monitor will do it and if you're only keeping track of https://www.shodan.io/store/member ). You just provide an IP/ network/ domain and we'll notify you if anything changes or becomes vulnerable. It's basically Google Alerts but for network ports: https://monitor.shodan.io Disclaimer: I'm the founder of Shodan.

Thanks that’s exactly what I was looking for. I didn’t want an open source DIY option because I am lazy and just want to plug in Ips and ports.

Also just curious, what’s your annual revenue like?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#369

Post by scarface74 »

ELI5:

Way back in the early 2000s I was a young mid level developer and we had a SQL Server backed solution. There was a wide spread attack on Sql Server installations that didn’t change the default blank SA password. We were one of the companies that didn’t.

But, even then I knew not to have a publicly accessible database server. We just didn’t give the server a public IP address. Nothing fancy. We weren’t affected but I immediately changed the password.

Fast forward to 2018. The company I worked for was just starting to ramp up an in-house development staff led by a new CTO. Everything had been outsourced to a foreign agency. They had a publicly accessible ElasticSearch cluster. I wasn’t on the team responsible for it, but I know that the architect on the team knew better. Even though he didn’t setup the original cluster, he knew it was insecure and just didn’t prioritize recreating it inside our VPC.

Of course we got hacked and someone deleted everything in it. Then they decided to go ahead and recreate it inside the VPC. Luckily we didn’t use ES as a primary store and we were just offline all day while we ran the process to repopulate the cluster from our Mysql database.

Why do people keep making the same mistake? I was definitely not any world class software architect at 25 years old, but even I knew to be cautious about giving servers public IP addresses unnecessarily.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#370

Post by KMag »

moooo99 wrote: post #343
user5994461 wrote: post #289

Earlier quoted context omitted.

Recommend to setup two subnets in your project. One public and one private. This prevents this sort of issues, instances in the private subnet simply don't get a public IP, they can't be reached over the internet. For reference, the standard practice in a company is to have a (third) separate subnet for databases, with zero internet access (no NAT gateway). Connection must be explicitly opened from/to database client…

> Recommend to setup two subnets in your project. One public and one private. This is very good advice. We recently had a uni project where we had to use a MongoDB database. Somebody just apt-get installed a mongodb onto a DO droplet called it a day. Two days later the only remaining records prompted us to transfer x amount of BTC to a adress that was store in our DB. It just contained dummy data, but it is worrying…

> The only thing I find weird is that ElasticSearch itself does not offer a way to handle authentication, it was just enabled by a plugin that was paid (it seems like its free now).

"Wierd" is an interesting euphemism for "irresponsible." Defaults are very important. Insecure by default is insecure for 90+% of deployments.

Post reply on HN