Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

451–460 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#451

Post by gwright »

lallysingh wrote: post #379
gwright wrote: post #278

Earlier quoted context omitted.

Not sure why you are focusing on the PII scenario. The original report seems to say it is just "unsecured databases" and not databases that have PII information posted. You are also making an subtle assumption that the service is being administered by a 3rd party. Could be that the service is being administered by the owner of the data. In any case it is still wrong to delete the data.

The folks hit didn't have backups (if they did, well anyone can restore them), nor did they secure their db. One is forgivable. Both together get no sympathy from me. Rather disgust that some of them had PII from customers that trusted them.

More justification that this is an appropriate way to teach people a lesson. You don't seem to care at all what the impact might be on those affected. You are in affect encouraging the criminal behavior because the ends justify the means, apparently.

While I understand the concern that organizations aren't taking proper care to protect their data I think legitimizing vigilante punishment for those mistakes is a very problematic stance.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#452

Post by dredmorbius »

KMag wrote: post #432
dredmorbius wrote: post #429

Earlier quoted context omitted.

Given that "unsecured" means "data are accessible and modifiable by anyone", creating tremendous externalities for all referenced in the data, , I'm happy with deletion. FTA: One of the first publicly known examples of a Meow attack is an Elasticsearch database belonging to a VPN provider that claimed not to keep any logs.

In some cases, I might be tempted to agree with you, but this is blindly being applied by an automated attack. What if some of that deleted data is volunteer-canvassed anonymized survey data of homeless people, and its loss sets back a homeless relief program by months, resulting in several people freezing to death this winter?

The data may be modified at any time without a trace, rendering it void.

Secure your damned database.

The fault and responsibility lie with the deploying organisation and tools vendor. Meow is just the messenger.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#453

Post by hhjj »

KMag wrote: post #432
dredmorbius wrote: post #429

Earlier quoted context omitted.

Given that "unsecured" means "data are accessible and modifiable by anyone", creating tremendous externalities for all referenced in the data, , I'm happy with deletion. FTA: One of the first publicly known examples of a Meow attack is an Elasticsearch database belonging to a VPN provider that claimed not to keep any logs.

In some cases, I might be tempted to agree with you, but this is blindly being applied by an automated attack. What if some of that deleted data is volunteer-canvassed anonymized survey data of homeless people, and its loss sets back a homeless relief program by months, resulting in several people freezing to death this winter?

Then people should feel bad their negligence did cost lives.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#454

Post by KingOfCoders »

ljm wrote: post #346
pramodhs wrote: post #280

Earlier quoted context omitted.

I'm working on a personal project and not at all related to my work. I accidentally kept ports open :facepalm, sorting things out now :)

First thing I always do on any new VPS is to sort out SSH (disable root login, disable password login), set up fail2ban, install and configure ufw... and if I need to set up something like redis or similar, make sure it only listens to internal connections and also that it is decently auth'd. For deployment and other things I make users that can only write to certain directories; no sudo. It's nothing new or special…

When is didn't know better, I was always bitten by Docker circumventinging ufw.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#455

Post by gwright »

jessaustin wrote: post #408
gwright wrote: post #380

Earlier quoted context omitted.

So your argument is that any random person is in a position to evaluate whether someone else's "data shouldn't exist" and take unilateral action to delete it? And are you suggesting that in this particular case the person launching this attack is taking time to evaluate the nature of the data before taking action? > I'll just assume that all the "victims" who don't want to go into too much detail about the "lost" dat…

I didn't just invent this idea that businesses are careless with data their customers would prefer to be kept private. Basically every breach we ever hear about features this prominently. Somehow we've created an economy in which there exists a vast asymmetry between corporations who pad their books a few percentage points by abusing their position and the humans who suffer such abuses. The fact that the publicity of…

You seem entirely focused on PII concerns and arguing as if the only organizations affected by this incident are "giant companies". That doesn't seem to be the case. I haven't seen any suggestion that this incident is focused on that type of data.

As much as I agree with all the concerns posted here about how data should be protected better I don't think it is necessary to excuse and legitimize the unauthorized access along the way.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#456

Post by andai »

mulmen wrote: post #449

Seem like this could be easily reconfigured to do the opposite. Leave the databases but overwrite all the existing data then write dummy data until disk is exhausted. Does that cross another ethical line?

You mean, to make data recovery impossible?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#457

Post by donmcronald »

52-6F-62 wrote: post #183
donmcronald wrote: post #55

Earlier quoted context omitted.

> But I would feel bad if someone's small business had to shut down or lose a bunch of money because they lost all their customer data. Don't. When businesses of any size cut corners and provide services they aren't qualified to provide, it gives them an advantage compared to businesses that try to do it properly. They make more money or charge less and can often out compete competent owners. They'll also be the firs…

Said small businesses might have no idea their data wasn’t secure. That would be on whoever developed their technology, not necessarily the business. Not all small businesses with customer or sales data is a technology company.

Good point. You're right. I was really only thinking about tech companies that are doing their own deployments, but I guess there's plenty of room for collateral damage where people don't deserve it.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#458

Post by KMag »

dredmorbius wrote: post #452
KMag wrote: post #432

Earlier quoted context omitted.

In some cases, I might be tempted to agree with you, but this is blindly being applied by an automated attack. What if some of that deleted data is volunteer-canvassed anonymized survey data of homeless people, and its loss sets back a homeless relief program by months, resulting in several people freezing to death this winter?

The data may be modified at any time without a trace, rendering it void. Secure your damned database. The fault and responsibility lie with the deploying organisation and tools vendor. Meow is just the messenger.

But if they had used the password changes API to assign random passwords to all accounts, as suggested, then the data couldn't be modified. Am I missing something?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#459

Post by lmm »

scarface74 wrote: post #441
lmm wrote: post #435

Earlier quoted context omitted.

> So if someone purposefully for some reason goes in and configures their router to map a port to a specific internal IP address to allow internet traffic to their ES cluster it isn’t secure? That's not what I'm talking about. Suppose your router receives a packet whose destination is that internal IP address. Then it's going to send it there, unless it's configured to block that traffic. > So am I also “obscuring” m…

That's not what I'm talking about. Suppose your router receives a packet whose destination is that internal IP address. Then it's going to send it there, unless it's configured to block that traffic. What router is set up by default to route traffic from the internet to a private IP address unless the traffic initiated from the private IP address? Someone would have to purposefully configure their router to do it. Of…

Any router designed for professional environments won't second-guess your networking setup. Either it will route everything by default or it will deny everything by default and route only those routes you've specifically added, but either way it's not going to do anything differently just because one side or the other is an RFC1918 private address.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#460

Post by stedaniels »

nomel wrote: post #364
user5994461 wrote: post #74

Works great. You can already find questions on Stack Overflow from people getting their database deleted https://stackoverflow.com/questions/63067062/elastic-search-... Edit: The person raising that question is working for Atlassian (Jira), looks like Atlassian got their database deleted lol

This edit is speculation. > I'm running an elastic search for a personal project on google-cloud and I use as a search index for my application. He very clearly says it’s a personal project. Trying to learn new topics outside of your direct responsibilities, while employed, is very common in the software industry. Not everyone that works at a company is involved in databases at that company.

That was edited in afterwards. https://stackoverflow.com/posts/63067062/revisions whilst it very well may be a personal project, it certainly wasn't "very clear".
Post reply on HN