Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

blog.newsblur.com

Post reply on HN
Print view View original

51–60 of 117 posts

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#51

Post by yjftsjthsd-h »

nickstinemates wrote: post #25
glintik wrote: post #5

Lol, that’s the same footgun I discovered myself when was checking open ports. Who that wise guy in Docket team who decided to pass default firewall rules and open containers ports to public?

> Who that wise guy in Docket team who decided to pass default firewall rules and open containers ports to public? This is pure ignorance and slandering the Docker team for it seems weird.

What's ignorant about it? Or wrong, for that matter, since it can't be "slander" if it's true. Docker does bypass default firewall rules and expose container ports to the public. If I run anything else on a server (apache2, say), and tell it to bind to 0.0.0.0:80, it doesn't matter, because the firewall will block it. If I tell a docker container to bind to 0.0.0.0:80, it magically skips over any other protections and immediately exposes itself to the world.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#52

Post by Kwpolska »

wkdneidbwf wrote: post #41
chrismeller wrote: post #33

This is why you shouldn't be using Docker in production. It's a great tool, but it's simply not designed for that kind of environment. Edit: note I said Docker specifically, nothing about containerization.

what. docker isn’t the problem here. dbs on public subnets, and the lack of monitoring for accidental db exposure are the actual issues here.

And running a database without authentication.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#53

Post by xwdv »

Mogzol wrote: post #38
jacquesm wrote: post #9

It's a pity that the chances of nailing the perps is so low. Obviously docker and the person that put this together share some of the blame but: the original internet would have never gotten off the ground if it wasn't for people cooperating with each other rather than to try to tear things down all the time. And with the chances of your average script kiddie/hacker/idiot getting caught being lower than a typical bik…

> NewsBlur is useful, destroying it serves no purpose at all. And make no mistake: the hacker clearly aimed to simply destroy it and pretend they have copied the data, so they were more than willing to do just that, wanton destruction for a miserly amount of money. Whoever did this may think they're l33t and cool but I personally think they are utter trash. I doubt this was even specifically targeted at NewsBlur. Rea…

It’s not better, but at least it wasn’t personal, which would be worse.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#54

Post by yjftsjthsd-h »

wkdneidbwf wrote: post #41
chrismeller wrote: post #33

This is why you shouldn't be using Docker in production. It's a great tool, but it's simply not designed for that kind of environment. Edit: note I said Docker specifically, nothing about containerization.

what. docker isn’t the problem here. dbs on public subnets, and the lack of monitoring for accidental db exposure are the actual issues here.

> docker isn’t the problem here

I mean... if they weren't using docker it would have been fine, but because they used docker it wasn't fine. That reads like docker is the problem. That further layers could have mitigated it doesn't make docker not the problem.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#55

Post by convolvatron »

nickstinemates wrote: post #25
glintik wrote: post #5

Lol, that’s the same footgun I discovered myself when was checking open ports. Who that wise guy in Docket team who decided to pass default firewall rules and open containers ports to public?

> Who that wise guy in Docket team who decided to pass default firewall rules and open containers ports to public? This is pure ignorance and slandering the Docker team for it seems weird.

thats a really weird take. the whole point of developing and using infrastructure projects like docker is to package up best practices and let other people leverage them without becoming experts themselves.

maybe its fair to say that we shouldn't attempt to find an individual to blame. but that doesn't mean docker as an organization didnt screw up here

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#57

Post by nubinetwork »

jacquesm wrote: post #45
Mogzol wrote: post #38

Earlier quoted context omitted.

> NewsBlur is useful, destroying it serves no purpose at all. And make no mistake: the hacker clearly aimed to simply destroy it and pretend they have copied the data, so they were more than willing to do just that, wanton destruction for a miserly amount of money. Whoever did this may think they're l33t and cool but I personally think they are utter trash. I doubt this was even specifically targeted at NewsBlur. Rea…

Well, someone controls those tools and someone is on the receiving end of that bitcoin address.

They'll just run the money through one of those mixing services and you'll never know where the money went.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#58

Post by throwaway744678 »

bastawhiz wrote: post #14
QuinnyPig wrote: post #7

Earlier quoted context omitted.

They becomes a highly effective denial of service vector if you’re not careful.

> if you’re not careful. I don't think there's a way to avoid a DOS vector even if you're careful. If someone can access your database directly, they can make enough attempts to lock a user. The only way to be careful is to avoid public access to the db. But if you do that effectively, you don't have the issue of accounts getting locked. It's a dubious argument to ever lock an account as a safety measure. Arguably, d…

Fail2ban is a good mitigation strategy, blocking the IP address after N failed attempts (obviously, it does not protect completely from a determined attacker controlling a network of bots but it raises the bar significantly)

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#59

Post by throwaway744678 »

andybak wrote: post #48
nickstinemates wrote: post #29

Earlier quoted context omitted.

Use `docker network` or the equivalent in the docker-compose file. Not taking time to think about how the software works is not the fault of the software.

If everyone designed software like you are advocating then we'd be even worse off. What's wrong with "users should be careful" and "software shouldn't contain footguns"?

Software following the path of least surprise is a good rule of thumb.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#60

Post by nickjj »

Am I missing something? The article wrote:

> When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world

But the blog post doesn't mention how Docker "helpfully inserted an allow rule". Is this because NewsBlur ran the container using the -p 27017:27017 flag without reading the docs around what publishing a port does?

You don't need to publish a port for (2) containers to talk to each other, they can do that over a private Docker network that both containers belong to (something Docker Compose does for you by default). You can also choose to -p 127.0.0.1:27017:27017 which will only publish the port so that only localhost can access it, something like this is handy if you publish a web port to localhost so nginx not running in Docker can connect to it.

Post reply on HN