Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

381–390 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#381

Post by glenstein »

pessimizer wrote: post #234
glenstein wrote: post #208

Earlier quoted context omitted.

Why is the person doing the deleting so low, relatively speaking, in your ranking of people's responsibility for them doing the deleting? Also, do you think that this person or persons would refrain from deleting the data if they had the opportunity, but it qualified as a "good idea" to keep online? I.e. they might review, say, medical records, spend some time thinking to themselves whether it was 'necessary' to be o…

For me, it's because the odds of this person showing up quickly approach 1 as time approaches infinity, and that person's effect would be nil if it weren't for necessary causes 1) through 19). Blaming the person that hacked you is like blaming the individual rock that sinks your boat when you navigate too close to a rocky shore. The rock may have done 100% of the damage to your boat, but if it hadn't been that rock,…

Rocks don't have moral agency. And the comment they replied to I think was clearly about the blameworthiness of the bad actor.

So I guess problem I'm having is with the equivocation between cause-and-effect responsibility and moral responsibility, which I think was exploited here to indulge in a fun little switcheroo by talking about something they didn't mean.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#382

Post by bigiain »

p1necone wrote: post #302
cryptoz wrote: post #292

Earlier quoted context omitted.

Vandalism is not a good public service. > I’d much rather have my data deleted until it’s secured than have it stolen by someone else There are multiple logical fallacies in this sentence. First is the use of the world 'until' which is ambiguous here; it suggests that your data can be 'undeleted' after the DB has been secured or you would rather not have any data stored anywhere that is not secured. Either option to…

I assume the comment was partially in jest. But this would actually work well if it was consistent and fast. If databases get wiped before you have time to put anything important in them then noone gets hurt.

> But this would actually work well if it was consistent and fast.

So not too concerned about partition tolerance, huh?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#383

Post by lotsofpulp »

jessaustin wrote: post #357
lotsofpulp wrote: post #294

Earlier quoted context omitted.

The problem could be easily solved by Visa/MC/Discover/Amex implementing chip and pin, or at least 2FA SMS authorization. Bestbuy.com has it working somehow.

These people can't configure a firewall. How are they going to implement payments in the secure fashion you suggest?

I meant that Visa/MC/Discover/AmEx should be forcing the use of chip and Pin or other 2FA methods.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#384

Post by edoceo »

ZephyrBlu wrote: post #313
edoceo wrote: post #266

Earlier quoted context omitted.

Run OpenVAS against your infrastructure. It's free cost, nearly free in time. Edit: I also do this as a service, have for years, and hammer my own system monthly.

Ironically, when I go their website I get a warning because their certificate has expired. https://openvas.org/

Oof, and it expired today. I'm going to slide into their DMs.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#385

Post by bigiain »

KMag wrote: post #370
moooo99 wrote: post #343

Earlier quoted context omitted.

> Recommend to setup two subnets in your project. One public and one private. This is very good advice. We recently had a uni project where we had to use a MongoDB database. Somebody just apt-get installed a mongodb onto a DO droplet called it a day. Two days later the only remaining records prompted us to transfer x amount of BTC to a adress that was store in our DB. It just contained dummy data, but it is worrying…

> The only thing I find weird is that ElasticSearch itself does not offer a way to handle authentication, it was just enabled by a plugin that was paid (it seems like its free now). "Wierd" is an interesting euphemism for "irresponsible." Defaults are very important. Insecure by default is insecure for 90+% of deployments.

I have _some_ sympathy for ElasticSearch and Redis, having designed/built their software under the assumption it isn't ever intended to be publicly accessible over the internet.

I have a bunch of fairly important personal documents in a filing cabinet with no lock. And I'm perfectly fine with that. I wouldn't keep it in my front yard, because that's obviously stupid, but keeping it inside behind my locked door and upstairs in my office? A perfectly acceptable risk (for me and my files).

I do agree that ElasticSearch do a quite poor/irresponsible job of pointing out their cabinet has no lock. I think Redis do a better job, but are seriously let down by all the internet tutorials that just say "sudo yum install redis" as a minor intermediate step in getting example-todo-list-de-jour working - without even a footnote explaining that anybody who actually visited the redis site now has instructions on how to p0wn your box. ( http://antirez.com/news/96 ) I do think the "Securing Redis" section of this page - https://redis.io/topics/quickstart - deserves to be much closer to the top - I'd have put it before the how to download/install/start instructions myself (though I _think_ recent versions of redis only bind to localhost in the default config, maybe?)

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#386

Post by umvi »

dawnerd wrote: post #126
nisa wrote: post #60

Earlier quoted context omitted.

It's also easy to get bitten by Docker. You can secure your server with iptables/ufw only to discover that docker happily punches through your firewall and you need to filter on the DOCKER-USER chain - and even that was broken: https://unrouted.io/2017/08/15/docker-firewall/ https://github.com/docker/for-linux/issues/690

Seriously this is the most annoying thing ever, especially if someone on your team things you need to expose the ports to redis in a docker compose. I’ve come back from a weekend where my redis instance was being used for crypto mining. Anything that is insecure by default in 2020 should be killed off IMO.

Secure by default is super onerous though. What if I just want to try out something before committing to it, do I really need to jump through a bunch of security hoops?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#387

Post by ac42 »

cdrini wrote: post #195

It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag... ). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "n…

1) This is not the "real world".

2) Even if it were, and my twenty-something assistant left my shop door open at night consistently, to me, the question of the legality of the resulting damage would be rather secondary.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#388

Post by bigiain »

mdoms wrote: post #330
user5994461 wrote: post #74

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

Atlassian is not on Google Cloud, they are an AWS shop. I suspect this is an unrelated personal project.

How much would you bet against that guy having fairly highly privileged AWS IAM access in Atlassian's account?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#389

Post by tdeck »

nkrisc wrote: post #318
tdeck wrote: post #197

Earlier quoted context omitted.

Why not just rename all the tables or something? That's enough to get the developer's attention without being so destructive.

Because if it's not destructive they have no reason to pay attention. Change names back and it's business as usual.

IDK, if someone kept changing the table names in my DB every week I'd probably throw a password on it, even if I were really lazy. Most of these people probably didn't realize their DBs were unsecured, and that gets the point across quickly (particularly if the new table names are chosen instructively).

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#390

Post by snorrah »

umvi wrote: post #386
dawnerd wrote: post #126

Earlier quoted context omitted.

Seriously this is the most annoying thing ever, especially if someone on your team things you need to expose the ports to redis in a docker compose. I’ve come back from a weekend where my redis instance was being used for crypto mining. Anything that is insecure by default in 2020 should be killed off IMO.

Secure by default is super onerous though. What if I just want to try out something before committing to it, do I really need to jump through a bunch of security hoops?

Yes, so that you always keep security in mind.
Post reply on HN