Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

391–400 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#391
post #197
post #27

If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…

Why not just rename all the tables or something? That's enough to get the developer's attention without being so destructive.

Because some people just want to watch the world burn.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#392
post #97

Earlier quoted context omitted.

Would you feel the same way if someone burned your house down if you left the door unlocked? Would you support the idea of people walking through a neighborhood and checking every door in a similar way? Does your opinion change if it happened in a business district? I think it is fine to argue that doors should be locked but that doesn't mean that a crime hasn't been committed when someone takes advantage of a situat…

The first crime committed was leaving people's data out in the open. If someone had a list of names/birthdays/SSNs posted on their door, I'm not too unhappy if someone blacks out every line with the word 'meow.'

It's literally any unsecured database, not just databases containing PII.

What if you just have a toy database for a toy project on the public internet and some jerk just deletes it to "teach you a lesson"? It's like, gee, thanks...

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#394
It’s 2020, where security should be at the forefront of almost any tech endeavour. It’s not something to think about afterwards, not any more.

If, given the frequent and public attention to hacked data, you aren’t thinking about how to make sure your data is safe, there really can’t be any sympathy when you get hit by an attack that relies on zero security applied to your database.

C’mon, do we as an industry really learn NOTHING from all the hacks we’ve lived through ?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#395
post #323

Earlier quoted context omitted.

I’ve seen just as many sysadmins do this as developers. It’s not a question of job title as a psychological pitfall (people who are looking for things to succeed don’t ask when they should fail) and companies not specifically retaining people with security experience because they cost more.

It can be though. Downsizing and getting rid of specialists certainly hurts companies. There are only so many hours in the day and that desperate guy working 14-16 hours a day because of covid downsizing is eventually going to eff up no matter how talented she is.

I’m not sure exactly what you’re disagreeing with. My point was just that it’s not useful to direct criticism at a job title when there are so many examples of failures by people with any given title. I’ve seen people who are ostensibly pen-testers or auditors blithely telling others to click through important warnings or have a root-on-all-machines password to make their work easier.

Downsizing and other false economies are definitely a contributing factor. Security and reliability are easy to dismiss as expensive overhead until they suddenly aren’t.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#396
post #156

Earlier quoted context omitted.

This is why we are refactoring our database to be able to migrate to Amazon documentdb from MongoDB. Encryption at rest.... Pay up!

Curious, why do you use Mongo? Does it give you something that a JSONB column in Postgres wouldn’t?

A JSONB column in Postgres doesn't have:

- Proper replication in its first-class, default configuration

- Automatically managed cluster membership

- Seamless automated failover

- First-class async client libraries in many languages

- A non-awful query language

Focusing on the JSON is beside the point (though it is a convenience). Wake me up when you've got a properly distributed database.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#397
post #38

Earlier quoted context omitted.

I've said it on here before, but the way in which Elasticsearch used to lock away critical security functionality (like TLS support and RBAC) behind a paid subscription whilst making just enough functionality available for free such that users could shoot their foot off is disgusting. This only ever changed after Open Distro for Elasticsearch came onto the scene and forced Elastic's hand. I entirely agree the vendors…

Well, it's just another attempt at monetizing the product. Nowadays, companies and developers expect everything to be OSS (and I love it) yet it's incredibly expensive to develop SW (and very few people do OSS just because of passion--I tried and failed miserably). Locking RBAC and TLS behind a paid subscription is a sure way to force companies with security teams to pay for it (or not to use it). This particular les…

> yet it's incredibly expensive to develop SW

It _can_ be. At the same time some of the most used software in the world manages just fine without a company running paid subscription plans and locking free users out of critical security components.

ElasticSearch/MongoDB/Redis et al are trying a new model for how to create OSS with a company behind it funding all/most of the development. That's OK, and I'm super interested to see how it works out long term. But there are many many counter examples of similar sized or way bigger software projects that never needed to do this. Pretty much everything that those three databases depend on to be used in applications is OSS that never had a "paid subscription" locking access up. How useful would any of them be without Linux, or Apache/Nginx, or Ruby/Python/PHP/Perl.

My fear is that half-assed-OSS that does a _great_ job of "capturing developer mindshare" but a lousy job of securing free use of their software - is one day going to be the root cause of some _spectacularly expensive_ data breach, after which pointy haired bosses and less technical C suite suits are going to feel the full power of Oracle's golf-course-and-expensive-restaurant marketing army, and nobody in a company bigger than 10 or 12 people will ever be able to use any database with less that a half million a year license because "due diligence!" and "risk mitigation!" (and "Waygu steak with expensive whiskey" and "dirty free software hippies exposing you to data breaches!!!")

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#398
post #386

Earlier quoted context omitted.

Secure by default is super onerous though. What if I just want to try out something before committing to it, do I really need to jump through a bunch of security hoops?

Yes, so that you always keep security in mind.

And what if the thing I'm building isn't intended for the public internet?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#399

Can someone how/explain why databases are left open?

Because the open-source version of Elastic does not contain any security (not even a basic auth) and requires at least a reverse-proxy in front of it which adds difficulty of connecting two things together. And Elastic-licensed Elastic with Security needs to be configured by chaning its config file. That is apparently too complicated for most "IT specialists". :) `sudo apt-get install elasticsearch && sudo systemctl start elasticsearch` and they are done.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#400
post #27

If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…

What about developers just being competent before deploying a database on the public internet? At least google "securing X" before just pumping data in.

How about all professionals in every industry being competent before doing anything? Then we wouldn't have any issues in society.
Post reply on HN