Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

441–450 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#441
post #435

Earlier quoted context omitted.

Only if the router is configured that way - and you don't need NAT to configure it like that. If the router is open then you just set the destination address to the address of the server you want it to go to. (As for getting it to the router you either find a way onto the same segment, explicitly specify it as a routing hop, use ip-in-ip...). So if someone purposefully for some reason goes in and configures their rou…

> So if someone purposefully for some reason goes in and configures their router to map a port to a specific internal IP address to allow internet traffic to their ES cluster it isn’t secure? That's not what I'm talking about. Suppose your router receives a packet whose destination is that internal IP address. Then it's going to send it there, unless it's configured to block that traffic. > So am I also “obscuring” m…

That's not what I'm talking about. Suppose your router receives a packet whose destination is that internal IP address. Then it's going to send it there, unless it's configured to block that traffic.

What router is set up by default to route traffic from the internet to a private IP address unless the traffic initiated from the private IP address? Someone would have to purposefully configure their router to do it.

Of course someone can purposefully configure an insecure system.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#442
post #133

Earlier quoted context omitted.

In construction and landscaping work those companies are usually licensed, bonded and insured. If they fuck up the work there's obvious financial recourse. Also, the measure of them fucking up is generally a lot clearer for physical labor and for mom and pop businesses, getting construction work inspected by a 3rd party is usually more straightforward and cheaper. In software, financial recourse generally means you h…

I don't how it is in the US, but in my country an audit that would reveal such an obvious lack of security costs no more than the equivalent of a single minimum salary - usually much less. On top of that several companies that offer such services are widely known because their media presence is mostly articles about vulnerabilities in routers, phones, operating systems etc. I hail from a post-communist country so I a…

I'm not sure what your country's going rates are but for the US, a small business might budget a few thousand dollars total for their website. A minimal security audit that would catch missing or stupid security would basically double their expenses. Unless they truly needed some custom feature they'd take one look at a security auditor's quotes and then go sign up for Wix or Squarespace immediately. It's not that the services don't exist, its just that they're expensive and typical non-technology business websites don't really need that much put into them.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#443

Earlier quoted context omitted.

I assume the comment was partially in jest. But this would actually work well if it was consistent and fast. If databases get wiped before you have time to put anything important in them then noone gets hurt.

Yeah, it's bad for the industry right now, but this is just a transition period! Once we get through the pain of losing a few databases, the new steady state where nobody's data is stored in world-writable databases will be better for everyone, and that will be worth the cost. Consider if this happened five years ago, it would have had a smaller cost than happening today. And it was probably going to happen at some p…

If you have Docker then make sure you have a firewall on top of it, otherwise it will expose pretty much what any docker user wants !

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#444

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

I'm working on a personal project and not at all related to my work. I accidentally kept ports open :facepalm, sorting things out now :)

[deleted]

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#445

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

I'm working on a personal project and not at all related to my work. I accidentally kept ports open :facepalm, sorting things out now :)

[deleted]

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#446
post #396
post #156

Earlier quoted context omitted.

Curious, why do you use Mongo? Does it give you something that a JSONB column in Postgres wouldn’t?

A JSONB column in Postgres doesn't have: - Proper replication in its first-class, default configuration - Automatically managed cluster membership - Seamless automated failover - First-class async client libraries in many languages - A non-awful query language Focusing on the JSON is beside the point (though it is a convenience). Wake me up when you've got a properly distributed database.

No post body was provided.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#447

Earlier quoted context omitted.

These are not emacs commands. They aren't even unix shell commands. They are TTY commands, some of them dating back to the dot matrix teletype terminals. My favorite is ^U, which 90% of the time lets you start over on a password prompt when you are sure you just fat fingered but not sure how badly.

I think you might be conflating these (or maybe I should say the gp is). Nevertheless. Do you have a reference to the history of key combos like ctrl f, b, n, p and a and e? Those are typically referred to as emacs style navigation and I am genuinely unaware of history of those as common tty control codes outside of emacs for cursor movement. They weren’t dec vt control codes. Ctrl-U was though and even has ASCII ass…

> Do you have a reference to the history of key combos like ctrl f, b, n, p and a and e? Those are typically referred to as emacs style navigation and I am genuinely unaware of history of those as common tty control codes outside of emacs for cursor movement.

I've always heard of it as an ASCII control character and gets its history from Unix interpretations of really old IBM keyboards which got its history from typewriters. I've literally never used emacs for anything other than ^X to exit; I'd rather use cat than emacs. I use vim. But ^H has worked for me as intended on a serial console and on telnet.

Some diving through wikipedia:

[0] says: Pressing the backspace key on a computer terminal would generate the ASCII code 08, BS or Backspace, a control code which would delete the preceding character. That control code could also be accessed by pressing Control-H, as H is the eighth letter of the Latin alphabet.

[1] says: In some typewriters, a typist would, for example, type a lowercase letter A with acute accent (á) by typing a lowercase letter A, backspace, and then the acute accent key. This technique (also known as overstrike) is the basis for such spacing modifiers in computer character sets such as the ASCII caret (^, for the circumflex accent).

[2] says: Unix (command line and programs using readline): Ctrl+H = Delete previous character

[3] supports [0] and says: Caret notation is a notation for control characters in ASCII. The notation assigns ^A to control-code 1, sequentially through the alphabet to ^Z assigned to control-code 26 (0x1A). Often a control character can be typed on a keyboard by holding down the Ctrl and typing the character shown after the caret.

However, it's worth noting that it also says The meaning or interpretation of, or response to the individual control-codes is not prescribed by the caret notation.

But, despite that, ASCII describes control character 8 as backspace [4] [5].

According to this Wikipedia article, work on ASCII began in 1960 and its first release in 1963 [6].

Emacs' first release was in 1985 [7].

I suggest that perhaps in your bubble control sequences are referred to as emacs style navigation even if it's not necessarily the most historically accurate. I'm glad you're working with *nix enough to be familiar with emacs and there's always new old things to learn. There's a lot of history to learn and understand.

[0] https://en.wikipedia.org/wiki/Backspace#%5EH

[1] https://en.wikipedia.org/wiki/%5EH

[2] https://en.wikipedia.org/wiki/Control_key#Table_of_examples

[3] https://en.wikipedia.org/wiki/Caret_notation

[4] https://en.wikipedia.org/wiki/Control_character#In_ASCII

[5] https://en.wikipedia.org/wiki/ASCII_control_characters#Delet...

[6] https://en.wikipedia.org/wiki/ASCII

[7] https://en.wikipedia.org/wiki/Emacs

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#448

Earlier quoted context omitted.

Recommend to setup two subnets in your project. One public and one private. This prevents this sort of issues, instances in the private subnet simply don't get a public IP, they can't be reached over the internet. For reference, the standard practice in a company is to have a (third) separate subnet for databases, with zero internet access (no NAT gateway). Connection must be explicitly opened from/to database client…

> Recommend to setup two subnets in your project. One public and one private. This is very good advice. We recently had a uni project where we had to use a MongoDB database. Somebody just apt-get installed a mongodb onto a DO droplet called it a day. Two days later the only remaining records prompted us to transfer x amount of BTC to a adress that was store in our DB. It just contained dummy data, but it is worrying…

ElasticSearch does offer authentication.

Most of our services were created like a POC & deployed to production, & I joined my company fairly recently.

We had a planned release this week to secure ES. And Saturday, we got "meow"ed

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#450
post #330

Earlier quoted context omitted.

Atlassian is not on Google Cloud, they are an AWS shop. I suspect this is an unrelated personal project.

How much would you bet against that guy having fairly highly privileged AWS IAM access in Atlassian's account?

Atlassian's IAM privileges were pretty damn strict from what I remember when working there.
Post reply on HN