Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

51–60 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#51

Post by imglorp »

nickjj wrote: post #34

This reminds me of "crackit"[0] from a few years ago with Redis. A lot of folks kept their Redis server bound to 0.0.0.0 with no firewall or published port 6379 by "accident" with Docker and by default Redis uses no password. It was a lot worse than meow because with some Redis configuration magic anyone could inject their own SSH keys onto the server. This article says Redis is affected but I would be curious to see…

There were several redis remote execution holes, not just the config file one, so pretty much anybody with an open redis was going to get trouble.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=redis+remot...

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#52

Post by GekkePrutser »

bhargav wrote: post #16
petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

This also affected people who use software for things other than businesses. People with IoT apps for their home, researchers, etc. Our field is vast and there is a large variance in people just using the basics of CS and those who keep up with standards and best practices, etc. Your statement is basically akin to someone saying that it’s fine for people to get robbed if they went out with their wallet; or worse.. ki…

Just putting a password on a database is more than a 'standard', it's truly common sense. Really, even a beginner should think of this. Otherwise they shouldn't be messing with this stuff.

And if they do get 'meowed', lesson well deserved.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#53

Post by scurvy »

phoe-krk wrote: post #18
gregschlom wrote: post #14

So why is the attack being called Meow?

Seems like all that's left of a database after the attack is some generated indices or other data structures with their names ending with "meow".

Clearly fans of "Super Troopers" / BrokenLizard.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#54

Post by bhargav »

pizza234 wrote: post #40
bhawks wrote: post #32

Earlier quoted context omitted.

This is more akin to a person knowing the basics of driving a car but not which side of the road to use or what to do at a traffic light. They are a danger to themselves and others, the others in this case being the users of whatever services the unsecured databases provide. My sympathy for people learning the basics of our field and missing a few points stops when others are harmed.

Although the parent's analogy is arguably flawed, there's a very good point in the fact that there are users who are not involved in the implementation of the service - "People with IoT apps for their home". They're not drivers, to follow the driving analogy. It's unrealistic to expect that the population at large starts to pay a significant attention, in particular because the services/gadgets are a black box. How d…

Yup. My point is some people might not even know that their database is accessible from the web lol. It’s pretty easy to follow a tutorial or get something OOTB that’s not secure, so we shouldn’t be saying we’re glad this happened. Even if it’s big businesses, what if said businesses were storing important data such as health records?

I think the learn by failing is a good mentality but was hoping we can be mindful of the fact that this harms more than just the “big bad man”

Edit: Addendum for a more thoughtful discussion, it would be great if these databases and tools provided some default security OOTB requiring no configuration whatsoever. Example: rather than creating user and password with root, is rather have some CMS site generate a random one!

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#55

Post by donmcronald »

HomeDeLaPot wrote: post #30
bhargav wrote: post #16

Earlier quoted context omitted.

This also affected people who use software for things other than businesses. People with IoT apps for their home, researchers, etc. Our field is vast and there is a large variance in people just using the basics of CS and those who keep up with standards and best practices, etc. Your statement is basically akin to someone saying that it’s fine for people to get robbed if they went out with their wallet; or worse.. ki…

Yeah. I don't care if some big business loses their Elasticsearch data and their site stops working until they get it secured and re-hydrated with data from their relational database. Good, they learned a lesson. But I would feel bad if someone's small business had to shut down or lose a bunch of money because they lost all their customer data. I'd feel bad if someone lost all the data they'd been using for a persona…

> But I would feel bad if someone's small business had to shut down or lose a bunch of money because they lost all their customer data.

Don't. When businesses of any size cut corners and provide services they aren't qualified to provide, it gives them an advantage compared to businesses that try to do it properly. They make more money or charge less and can often out compete competent owners. They'll also be the first ones to brag about how brilliant they are at business (in my experience).

Small businesses are no exception. Delete away IMO.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#56

Post by Chris2048 »

on the UFO VPN leak:

> “In this server, all the collected information is anonymous and only be used for analyzing the user’s network performance & problems to improve service quality. So far, no information has been leaked.”

I can't see how you can keep enough info to analyse an individual users service, without keeping logs on their access details (source/target IPs). What BS.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#57

Post by fiddlerwoaroof »

pizza234 wrote: post #40
bhawks wrote: post #32

Earlier quoted context omitted.

This is more akin to a person knowing the basics of driving a car but not which side of the road to use or what to do at a traffic light. They are a danger to themselves and others, the others in this case being the users of whatever services the unsecured databases provide. My sympathy for people learning the basics of our field and missing a few points stops when others are harmed.

Although the parent's analogy is arguably flawed, there's a very good point in the fact that there are users who are not involved in the implementation of the service - "People with IoT apps for their home". They're not drivers, to follow the driving analogy. It's unrealistic to expect that the population at large starts to pay a significant attention, in particular because the services/gadgets are a black box. How d…

IoT is unlikely to be affected, unless the device goes out of its way to expose its database via upnp

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#58

Post by mekkkkkk »

contrarianmop wrote: post #20

I prefer this over having data stolen. Also as a rule of thumb never ever expose anything but port 80 and 443 if hosting a webapp. If you must expose services other than http/s then be sure to not leak its version, have it secured properly and _always_ up to date. The user running such services should also be a non privileged user, the daemon chrooted, and the OS should have appropriate process and filesystem permiss…

> I prefer this over having data stolen.

How do you know it wasn't?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#59

Post by GekkePrutser »

nickjj wrote: post #34

This reminds me of "crackit"[0] from a few years ago with Redis. A lot of folks kept their Redis server bound to 0.0.0.0 with no firewall or published port 6379 by "accident" with Docker and by default Redis uses no password. It was a lot worse than meow because with some Redis configuration magic anyone could inject their own SSH keys onto the server. This article says Redis is affected but I would be curious to see…

Yeah one thing though with Docker is that in some cases it injects its rules into iptables before the firewall application's.

I was using arno-iptables-firewall and this suffered from that, docker containers would be world accessible. In general I only bind them to localhost anyway, but I figured this out when testing. It doesn't seem to happen with UFW.

But I can imagine some people know how to set up a firewall but then just assume it works and don't check. This is the kind I do feel sorry for, at least they tried to protect it.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#60

Post by nisa »

rectang wrote: post #27

If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…

It's also easy to get bitten by Docker. You can secure your server with iptables/ufw only to discover that docker happily punches through your firewall and you need to filter on the DOCKER-USER chain - and even that was broken: https://unrouted.io/2017/08/15/docker-firewall/ https://github.com/docker/for-linux/issues/690
Post reply on HN