Given some VPN's and other secure services that got used in Hong Kong turned out to have open logs as just resold services.
So one wonders how many people will be positively effected by this.
New ‘Meow’ attack has deleted almost 4k unsecured databases
371–380 of 544 posts
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#372Earlier quoted context omitted.
1) you're right, I edited my message to reflect that I meant a graph traversal algorithm. 2) a visited flag on an edge? That won't support simultaneous traversals. Keeping a stack is a lot more efficient than permitting only one traversal at a time.
I‘m not sure why you‘re bringing concurrency to the table. My point still is that looking something up in a stack (did I visit this node?) costs O(n) time, so the BFS will degrade from O(m+n) to O(m*n+n). To come back to the concurrency, if you can index your edges in some way, you can also store the visited flag in a separate datastracture to support concurrent access (one „flag store“ for each access).
> I‘m not sure why you‘re bringing concurrency to the table.
Not using data structures that enable concurrency prevents performance improvements since modern hardware is, in general, more parallel than vertical.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#373Earlier quoted context omitted.
Curious, why do you use Mongo? Does it give you something that a JSONB column in Postgres wouldn’t?
I use jsonb heavily. While it is amazing, I definitely wouldn’t rely on it as a general purpose replacement for NoSQL/schemaless data storage. An example of an issue I am dealing with currently: while you can create a gin index to speed up containment queries, Postgres doesn’t keep any statistics about jsonb columns. This means the query planner will sometimes do stupid things, like using the index even for very non-…
Thanks for the detailed response. I'm curious, is the NoSQL store a canonical store of its own data? If not, how do you replicate from postgres to the secondary store?
I ask because where I work we sync postgres to a secondary store for search, but the way it's done in a piecemeal, application-specific way gives me the heebie jeebies. It almost certainly will result in that secondary store drifting. Unfortunately we can't use something like zombodb [1] as we're on amazon RDS. It seems like you know your stuff, and seeing non-deterministic consistency irritates the heck out of me!
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#374Earlier quoted context omitted.
This is why we are refactoring our database to be able to migrate to Amazon documentdb from MongoDB. Encryption at rest.... Pay up!
Curious, why do you use Mongo? Does it give you something that a JSONB column in Postgres wouldn’t?
Thank you for raising this question. Well, for my things I use MongoDB because of very convenient integration with programming languages (Go, C++ via Mongo C++) and zero hassle with schema
But I'll be happy to replace it by something else, my load is extremely small and only single requirement is to have DB as network daemon, not as embedded storage as it will be used by 2 applications (main daemon an API).
RethinkDB was really nice candidate for it but it's not alive anymore: https://rethinkdb.com/blog/rethinkdb-shutdown/
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#375Earlier quoted context omitted.
Shodan Monitor will do it and if you're only keeping track of https://www.shodan.io/store/member ). You just provide an IP/ network/ domain and we'll notify you if anything changes or becomes vulnerable. It's basically Google Alerts but for network ports: https://monitor.shodan.io Disclaimer: I'm the founder of Shodan.
Thanks that’s exactly what I was looking for. I didn’t want an open source DIY option because I am lazy and just want to plug in Ips and ports. Also just curious, what’s your annual revenue like?
We don't share revenue information but we've seen steady growth for the past 10+ years. All I can say is that Shodan is a profitable, bootstrapped business with >3.5 million users, 80%+ of Fortune 100 and thousands of universities (we let them setup monitoring for free for up to 120k IPs).
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#376If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…
That's just victim blaming. The same logic applies to every crime: "lock your doors if you don't want your TV to be stolen!". It also works at any level of security: "Lock your doors and hire guards if you don't want clever thieves breaking a window..." But if you require everyone to take adequate measures to physically secure their houses, you don't even need laws and morality! And while this may provide the sort of…
the truth is in the middle you have to take some responsibility, but yes of course some blame goes to those who also make it possible. If people just throw their hands up and say they're victims and have no responsibility to secure their systems then they will always be victims.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#377This is what happens when you lay off all of your sysadmins because "the cloud", move that role to devops and then downsize that to a subduty of a developer.
I’ve seen just as many sysadmins do this as developers. It’s not a question of job title as a psychological pitfall (people who are looking for things to succeed don’t ask when they should fail) and companies not specifically retaining people with security experience because they cost more.
It can be though. Downsizing and getting rid of specialists certainly hurts companies. There are only so many hours in the day and that desperate guy working 14-16 hours a day because of covid downsizing is eventually going to eff up no matter how talented she is.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#378Earlier quoted context omitted.
I'm working on a personal project and not at all related to my work. I accidentally kept ports open :facepalm, sorting things out now :)
First thing I always do on any new VPS is to sort out SSH (disable root login, disable password login), set up fail2ban, install and configure ufw... and if I need to set up something like redis or similar, make sure it only listens to internal connections and also that it is decently auth'd. For deployment and other things I make users that can only write to certain directories; no sudo. It's nothing new or special…
Do you know of any good resources for learning this stuff? I'm interested in being able to do this sort of thing on a small scale, but there seems to be an awful lot that I don't know I don't know.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#379Earlier quoted context omitted.
The first crime committed was leaving people's data out in the open. If someone had a list of names/birthdays/SSNs posted on their door, I'm not too unhappy if someone blacks out every line with the word 'meow.'
Not sure why you are focusing on the PII scenario. The original report seems to say it is just "unsecured databases" and not databases that have PII information posted. You are also making an subtle assumption that the service is being administered by a 3rd party. Could be that the service is being administered by the owner of the data. In any case it is still wrong to delete the data.
The folks hit didn't have backups (if they did, well anyone can restore them), nor did they secure their db. One is forgivable. Both together get no sympathy from me. Rather disgust that some of them had PII from customers that trusted them.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#380Earlier quoted context omitted.
Why do you feel it is important to characterize the nature of the data? The unauthorized deletion is wrong regardless of the nature of the data.
...wrong regardless... That obviously isn't true. Some data shouldn't exist: CP. Some data can exist, but it's backed-up so well that deletion is never a problem. For example, I'm not going to forget my birth date any time soon! In fact, very little of the information that businesses have about me needs preservation. I remember it all, and if I decide the business still deserves it I can give it to them again. It is…
So your argument is that any random person is in a position to evaluate whether someone else's "data shouldn't exist" and take unilateral action to delete it? And are you suggesting that in this particular case the person launching this attack is taking time to evaluate the nature of the data before taking action?
> I'll just assume that all the "victims" who don't want to go into too much detail about the "lost" data were playing fast and loose with their customers' private information.
Why the scare quotes? It takes some serious amount of chutzpah to advocate that it is a reasonable assumption to assume the data wasn't important and to use the lack of public complaint as evidence that the data wasn't really important. Why do you even think it was "customer" data?