Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

481–490 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#481

Post by dredmorbius »

KMag wrote: post #468
hhjj wrote: post #453

Earlier quoted context omitted.

Then people should feel bad their negligence did cost lives.

Both the DB admins and the attackers should both feel guilt. However, if the attackers simply assigned randomly-generated passwords to all of the accounts, then no data would be lost and the DB admins would still have their DBs temporarily become inaccessible while they figured out how to force-reset their passwords. If you're going to go for disruption, I think the suggested lockout gives a much better ratio of good…

Something tells me that this level of pain would prove insufficient for education.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#482

Post by dredmorbius »

bigiain wrote: post #469
dredmorbius wrote: post #428

Earlier quoted context omitted.

If your assumptions are repearedly demonstrated invalid they are wrong. Change them.

Personally, I reckon that applies at least as much (if not more) to the devs installing random software packages onto internet connected and un-firewalled servers - as it does to database developers who document clearly that their software is not intended and is actively unsafe to install on directly internet connected servers... Cave ne recipiens donum...

If a thing should not be run in a given configuration then it should not be runnable in that configuration.

The vendor / developer has both awareness and capability to ensure this.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#483

Post by dvfjsdhgfv »

It took way too long. When you have a company that builds a great product with no security whatsoever and makes their business model based on selling the security module on it and changes their behavior only when threatened by a competing open source product, you have to wonder when the catastrophe comes.

Note I don't blame anyone, it was just bound to happen.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#484

Post by sgift »

jfk13 wrote: post #143
wolco wrote: post #110

Earlier quoted context omitted.

So is deleting a database. Putting a password and emailing the admin would solve the password problem. But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.

How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.

It's easy to say "you could have just emailed them" when you are not the one doing this for years without things getting better. Often admins flat out ignore you. Even if not they usually do nothing. And if they do something it takes ages.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#485

Post by EE84M3i »

scarface74 wrote: post #418
lmm wrote: post #415

Earlier quoted context omitted.

> You realize you can’t get to a private IP address over the Internet right? Of course you can - most end users have private IP addresses these days, yet they somehow manage to communicate with people on the internet. A private IP address is of course not routable directly on the Internet. But routers route, and can certainly route a packet from the public internet to an RFC 1918 private address. If the routers on th…

In the case of the attack in question - how would they have initiated a command to erase the ElasticSearch cluster from the Internet? Any NAT would be stateful and the communication would have had to be initiated from the cluster. Not having a public IP address is not about “obscuring” the IP address. It’s not like so said why didn’t they have ES listening on a non standard port.

I don't agree with the GP about "routers route" (at least in the context of a cloud VPC), but a more serious problem that IS seen all the time in the wild is SSRF, and as I understand it elastisearch presents an HTTP REST interface, which makes it a fine target for such attacks (where as, say, Postgres, will not accept HTTP connections).

Relying solely on routability for authorization means that you're authorizing everything that can route to it in any context. Maybe that's fine.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#486

Post by _-___________-_ »

KMag wrote: post #458
dredmorbius wrote: post #452

Earlier quoted context omitted.

The data may be modified at any time without a trace, rendering it void. Secure your damned database. The fault and responsibility lie with the deploying organisation and tools vendor. Meow is just the messenger.

But if they had used the password changes API to assign random passwords to all accounts, as suggested, then the data couldn't be modified. Am I missing something?

Parent's point is that any conclusion one could make from the data is worthless because, being public and unsecured, it could have been modified by any Internet user at any time before a password was set.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#487

Post by _-___________-_ »

dehrmann wrote: post #264
TwoBit wrote: post #238

Earlier quoted context omitted.

I've read that there are now VPN providers that just use someone else's VPN engine. So they don't have to know wtf they are doing.

For a product that's 50% snakeoil and marketing, that approach seems reasonable? It's easier than actually doing the leg work.

Only 50%? I'd put it much closer to 100% tbh. Why people are so eager to funnel all their traffic through some of the shadiest businesses on the Internet is beyond me...

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#488

Post by rewq4321 »

sharken wrote: post #472
nomel wrote: post #364

Earlier quoted context omitted.

This edit is speculation. > I'm running an elastic search for a personal project on google-cloud and I use as a search index for my application. He very clearly says it’s a personal project. Trying to learn new topics outside of your direct responsibilities, while employed, is very common in the software industry. Not everyone that works at a company is involved in databases at that company.

And getting a lesson in security for free it seems, it sucks but security is important.

Free? It would have required more effort, but they could have encrypted all the data, and then sent the key to a well-known white-hat security researcher, or someone who could be trusted to administrate important cases (they'd of course be free to ignore it). The encryption could be done on the compromised server with a forEach, so it'd be a single request.

I think some people in this thread want to be a bit too "absolutist" about it. Everyone's servers were exposed to heartbleed, spectre, meltdown, etc so the absolutists would apparently want the whole internet deleted.

Edit: It would be helpful if down-voter could explain (I might learn something).

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#489

Post by ivanhoe »

nkrisc wrote: post #433
tdeck wrote: post #389

Earlier quoted context omitted.

IDK, if someone kept changing the table names in my DB every week I'd probably throw a password on it, even if I were really lazy. Most of these people probably didn't realize their DBs were unsecured, and that gets the point across quickly (particularly if the new table names are chosen instructively).

That sounds reasonable, but you'd think most people would also be concerned about their databases being publicly accessible in the first place, yet here we are.

I don't think this is the case of people not being concerned, but simply the ignorance on their part about the setup. People just presume that the defaults are safe, and never bother getting into the details.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#490

Post by nix23 »

creato wrote: post #426
nomel wrote: post #364

Earlier quoted context omitted.

This edit is speculation. > I'm running an elastic search for a personal project on google-cloud and I use as a search index for my application. He very clearly says it’s a personal project. Trying to learn new topics outside of your direct responsibilities, while employed, is very common in the software industry. Not everyone that works at a company is involved in databases at that company.

I wonder how many of the deleted databases are just people learning with databases of dummy data?

Nice, now they learn never expose a DB directly to the net additionally...bonus points ;)
Post reply on HN