I wonder about the motive. Why would anybody do this without blackmailing or even telling people. Maybe it was a frustrated sysadmin... :/
For fun.
New ‘Meow’ attack has deleted almost 4k unsecured databases
431–440 of 544 posts
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#432Earlier quoted context omitted.
If meant as a public service, it would have been much less destructive to use the change passwords API [0] to set random passwords for all of the users. [0] https://www.elastic.co/guide/en/elasticsearch/reference/curr...
Given that "unsecured" means "data are accessible and modifiable by anyone", creating tremendous externalities for all referenced in the data, , I'm happy with deletion. FTA: One of the first publicly known examples of a Meow attack is an Elasticsearch database belonging to a VPN provider that claimed not to keep any logs.
In some cases, I might be tempted to agree with you, but this is blindly being applied by an automated attack. What if some of that deleted data is volunteer-canvassed anonymized survey data of homeless people, and its loss sets back a homeless relief program by months, resulting in several people freezing to death this winter?
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#433Earlier quoted context omitted.
Because if it's not destructive they have no reason to pay attention. Change names back and it's business as usual.
IDK, if someone kept changing the table names in my DB every week I'd probably throw a password on it, even if I were really lazy. Most of these people probably didn't realize their DBs were unsecured, and that gets the point across quickly (particularly if the new table names are chosen instructively).
That sounds reasonable, but you'd think most people would also be concerned about their databases being publicly accessible in the first place, yet here we are.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#434Earlier quoted context omitted.
online databases that can be written and deleted by anyone on the internet are no good at all. The data can't be trusted. Of course no welfare for you! All I do is to replace all the names with my name and I can take all the welfare in the whole country! Or for example, doing a search for names and replacing all female names with male names ... how can you trust a database like that? Making decisions based on a writa…
Consider Facebook/Twitter as anyone-writable databases. Your comments translate perfectly.
Facebook, Twitter, or even Mediawiki, don't permit any random IP address full database access. (Or had better not.)
Rather, for the first two, large numbers of agents may request access limited to a specific account, with limited capabilities granted.
Even Mediawiki, with an extraordinarily open access model (painfully so in most cases) has checks on extensive abuse, and gradations of permissions.
Suggesting that any of these are comparable to full DBA access as the Meow attack (with considerable merits0 targets suggests an exceeding poor grasp of distinctions or misreading of GP's comment.
You can do better.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#435Earlier quoted context omitted.
> Any NAT would be stateful and the communication would have had to be initiated from the cluster. Only if the router is configured that way - and you don't need NAT to configure it like that. If the router is open then you just set the destination address to the address of the server you want it to go to. (As for getting it to the router you either find a way onto the same segment, explicitly specify it as a routing…
Only if the router is configured that way - and you don't need NAT to configure it like that. If the router is open then you just set the destination address to the address of the server you want it to go to. (As for getting it to the router you either find a way onto the same segment, explicitly specify it as a routing hop, use ip-in-ip...). So if someone purposefully for some reason goes in and configures their rou…
> So if someone purposefully for some reason goes in and configures their router to map a port to a specific internal IP address to allow internet traffic to their ES cluster it isn’t secure?
That's not what I'm talking about. Suppose your router receives a packet whose destination is that internal IP address. Then it's going to send it there, unless it's configured to block that traffic.
> So am I also “obscuring” my IP address when I am testing an API locally and I configure it to only listen on 127.0.0.1:3000?
No, quite the opposite. Listening only on the loopback interface is a real security mechanism. Binding to 127.0.0.1 achieves that (though there have been bugs in the past; binding explicitly to the loopback device is better).
> Oh no, I just told you my IP address!
That's exactly my point! The address doesn't matter, the actual network routing is what matters. Same thing if you're running an actual airgapped network: what makes it safe is the fact that it's physically disconnected, not that you used particular addresses on it.
Real-life example: the UK military's internal servers have real IP addresses in the 25.0.0.0 range. Probably some of them are insecure. But it doesn't matter because, even though they have public IP addresses, you have no way to send packets to those IP addresses, because they've got proper firewalling in place. It's no different from if they were running a private network - except that it means they don't have to mess around with NAT, if someone connects from a VPN they don't have to worry about address collisions.... IPv6 works the same way.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#436Any statements by Shay Banon?
Crickets AFAICT: https://twitter.com/kimchy
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#437Earlier quoted context omitted.
Either the data is something public (name, address, etc) in which case, whatever. Or it's data that was gathered (in line of business, for example) and its destruction is anywhere from more secure to an inconvenience. Or it's data that was aggregated beyond legitimate use (hey, FAANG) and by all means, tear it the hell up and throw it away.
Why do you feel it is important to characterize the nature of the data? The unauthorized deletion is wrong regardless of the nature of the data.
I think I'm having a somewhat uncharacteristic relativist thought... I feel that the indiscriminate and nearly unregulated collection of any data any company feels like grabbing hold of _should_ be countered.
I feel like the wrongness of deleting unsecured data is a pittance compared to the crapload of other wrongs that have been visited upon us 'products' by failures of diligence or desire or consequence.
I would very much like to hear, if it turns out to be so, that the operators of 'meow' are selectively targeting more likely corporate data, especially with customer/user data, but in the end I'm still ok with the idea of burn it all and let the DB vendors and IT staff who let their asses hang out explain why security was so low on their priority lists.
And yes, I'll take some potential difficulties in my own life due to unexpected deletion complications in the process. I'm not asking anyone else to accept anything I'm not going to be okay with myself.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#438Seems like kind of a public service
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#439Earlier quoted context omitted.
Well, it's just another attempt at monetizing the product. Nowadays, companies and developers expect everything to be OSS (and I love it) yet it's incredibly expensive to develop SW (and very few people do OSS just because of passion--I tried and failed miserably). Locking RBAC and TLS behind a paid subscription is a sure way to force companies with security teams to pay for it (or not to use it). This particular les…
> Well, it's just another attempt at monetizing the product. Don't make excuses for their shitty business practices.
The thing is that no one cares. It's a cultural issue. If Elastic makes it "harder" to get off the starting line by setting secure defaults, they'll get their lunch eaten by a fork called EasyElastic that people perceive as "easier".
This probably isn't an excuse for Elastic anymore, but it's how Elastic was born ("easier than Solr!" -- they didn't invent full-text search, after all) and it's how whatever supplants Elastic will be born. Why is MySQL dominant over Postgres even though "referential integrity" didn't come to the game until v5? Why Docker over jails or OpenVZ? etc. People adopt technology because it's fashionable and it becomes fashionable in part because it's perceived as easy to use. Security and ease-of-use are not quite true opposites, but there's definitely some intrinsic tension.
We have a lot of hapless practitioners in the space and the root problems here won't go away until we get some standards. Better solutions usually lose because crappy stuff focuses more effort on marketing and an "easy" onboarding process, where better stuff focuses on the operational complications of the real world.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#440Earlier quoted context omitted.
It's not a matter of "cutting corners." Think of all of the small businesses that recently moved online due to store closures. These businesses simply do not have the budget required to create something comparable to, say, Best Buy's e-commerce. Sure, Shopify might come close, but how do you think Mom and Pop will find and create an e-commerce solution?
That’s the very definition of cutting corners. If they aren’t confident of their ability to operate safely they need to either hire a professional or go without - just as not wanting to pay a plumber doesn’t exempt you from meeting the health code or saving on accountants will be a get out of jail free card when you get audited. If it sounds like I’m unsympathetic, yes, that’s true. Playing around with building your…
Think how easy it is to take advantage of grandma for "tech support," whether it be from India or at a seedy computer repair shop. It wouldn't surprise me to hear that the majority of small business owners have never heard of Shopify or Wix, as they are more likely to turn to someone they trust, whether that be a "tech-literate" cousin or a local service. Keep in mind that many of these businesses didn't even have websites a few months ago, let alone e-commerce solutions. Not everyone lives in SV or NYC and is perennially exposed to their ads.
I agree that these businesses shouldn't be doing this by themselves, but the tech industry shares some culpability. It should be ingrained in people's heads to think of security first. Most people outside the SV bubble are still using [SO or pet's name]123 as their password. I go to a university in NYC. I've tried to convince several (college) friends to use password managers to no avail. This isn't just a problem endemic in old people. Someone needs to "mainstream" good security. A good start would come from, say, Apple, by including security keys with new iPhones, as much of a pipe dream as that might be.