Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#41

Post by mkagenius »

DyslexicAtheist wrote: post #21
glckr wrote: post #11

Earlier quoted context omitted.

No other bad actors can get it, but we don't know if it's already been found, and now that it's gone we have no idea what data is out in the wild. And as you note, we can't trust the companies to accurately report it themselves.

maybe the authors of meow should "improve" it with a feature that reports every instance to HIBP before deleting it. that is if their intention with this malware was a benevolent one :) but I guess feature iteration in malware that is "supposed to be good" would be tricky

> reports every instance to HIBP

no, that doesn't make sense if its only meow who found it. And since there is no way to know that, it does not make sense to mail a copy to hibp

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#42

Post by unstatusthequo »

nend wrote: post #23
bhargav wrote: post #16

Earlier quoted context omitted.

This also affected people who use software for things other than businesses. People with IoT apps for their home, researchers, etc. Our field is vast and there is a large variance in people just using the basics of CS and those who keep up with standards and best practices, etc. Your statement is basically akin to someone saying that it’s fine for people to get robbed if they went out with their wallet; or worse.. ki…

>Your statement is basically akin to someone saying that it’s fine for people to get robbed if they went out with their wallet; or worse.. killed. Uhh no? The analogy would be that there's some benefit that comes from someone's wallet being destroyed, instead of stolen.

I’d say it’s closer to leaving your wallet on the street. If you don’t care to protect it you should assume someone will fuck with it.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#43

Post by acdha »

HomeDeLaPot wrote: post #30
bhargav wrote: post #16

Earlier quoted context omitted.

This also affected people who use software for things other than businesses. People with IoT apps for their home, researchers, etc. Our field is vast and there is a large variance in people just using the basics of CS and those who keep up with standards and best practices, etc. Your statement is basically akin to someone saying that it’s fine for people to get robbed if they went out with their wallet; or worse.. ki…

Yeah. I don't care if some big business loses their Elasticsearch data and their site stops working until they get it secured and re-hydrated with data from their relational database. Good, they learned a lesson. But I would feel bad if someone's small business had to shut down or lose a bunch of money because they lost all their customer data. I'd feel bad if someone lost all the data they'd been using for a persona…

I’d feel bad if someone’s hobby project was deleted. Small businesses losing customer data is only slightly more sympathetic than people getting sick because they didn’t think the health code applied to them.

If you collect it, you need to be responsible for keeping it safe. Anything affected by this is already exposed and has to be assumed to have been breached.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#44

Post by onion2k »

hobofan wrote: post #31
29athrowaway wrote: post #12

Search engines like shodan.io make it trivial to discover unsecured databases exposed to the Internet.

What I don't get about Shodan: Why aren't all unsecured databases found instantly (at the moment Shodan went online), but recurring attacks/dumps like this one that rely on it? Do they update their crawl data in waves?

People make new unsecured servers.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#45

Post by paulie_a »

HomeDeLaPot wrote: post #30
bhargav wrote: post #16

Earlier quoted context omitted.

This also affected people who use software for things other than businesses. People with IoT apps for their home, researchers, etc. Our field is vast and there is a large variance in people just using the basics of CS and those who keep up with standards and best practices, etc. Your statement is basically akin to someone saying that it’s fine for people to get robbed if they went out with their wallet; or worse.. ki…

Yeah. I don't care if some big business loses their Elasticsearch data and their site stops working until they get it secured and re-hydrated with data from their relational database. Good, they learned a lesson. But I would feel bad if someone's small business had to shut down or lose a bunch of money because they lost all their customer data. I'd feel bad if someone lost all the data they'd been using for a persona…

Personally I hope this becomes so common place that it doesnt even make the news.

Like the old days with slammer or codered

It took 13 seconds for a freshly installed windows box to be owned when it was put online. Let those days return.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#46

Post by derefr »

petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

I'm ambivalent about this action in most cases, but in some specific cases there can be a clear reason to have an exposed database: namely when the database is a guest-accessible, read-only repository of public data, i.e. the self-hosted equivalent of publishing a Google BigQuery dataset.

As someone who runs such a "public-access data library" myself, I would be slightly annoyed if someone came along and burned it down, just because it has an unpatched vulnerability.

...but if it got deleted because I left default admin creds on it, though, that'd be my own fault.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#47

Post by jmvoodoo »

derefr wrote: post #46
petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

I'm ambivalent about this action in most cases, but in some specific cases there can be a clear reason to have an exposed database: namely when the database is a guest-accessible, read-only repository of public data , i.e. the self-hosted equivalent of publishing a Google BigQuery dataset. As someone who runs such a "public-access data library" myself, I would be slightly annoyed if someone came along and burned it d…

Databases that are read only would be unaffected by this attack.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#48

Post by GekkePrutser »

It's not necessarily 'deleted', these Script Kitties just replaced some data with more valuable stuff. You can never have enough meows!

But seriously, these guys are doing us a favour. You can bet the affected companies will not expose customer data again.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#49

Post by derefr »

jmvoodoo wrote: post #47
derefr wrote: post #46

Earlier quoted context omitted.

I'm ambivalent about this action in most cases, but in some specific cases there can be a clear reason to have an exposed database: namely when the database is a guest-accessible, read-only repository of public data , i.e. the self-hosted equivalent of publishing a Google BigQuery dataset. As someone who runs such a "public-access data library" myself, I would be slightly annoyed if someone came along and burned it d…

Databases that are read only would be unaffected by this attack.

Read-only in practice, not inherently read-only in the way that e.g. CD-ROM is. Such systems still need to have their otherwise-static dataset updated "online" by an ETL pipeline agent-user. Which often means, in the DBMSes with less fine-grained security models, that such users need to have full DML (and even DDL) capabilities, rather than only insert capability.
Post reply on HN