Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

501–510 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#501

Post by nix23 »

rewq4321 wrote: post #488
sharken wrote: post #472

Earlier quoted context omitted.

And getting a lesson in security for free it seems, it sucks but security is important.

Free? It would have required more effort, but they could have encrypted all the data, and then sent the key to a well-known white-hat security researcher, or someone who could be trusted to administrate important cases (they'd of course be free to ignore it). The encryption could be done on the compromised server with a forEach, so it'd be a single request. I think some people in this thread want to be a bit too "abs…

>Everyone's servers were exposed to heartbleed

No just my Webserver/HAProxy. The difference is, don't expose services that are not meant to face the Inet directly.

Production-Type Webservers are, SSH, VPN, HAProxy etc are.

Databases, devel-webservers, NFS, Samba are not!

Sure even the best hardened Service can have vulnerabilities, but that's how life is, better have a door with a key than one without, even when someone is capable to open your door with a Lock-pick.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#502

Post by nix23 »

cryptoz wrote: post #292
pietroglyph wrote: post #254

Earlier quoted context omitted.

Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.

Vandalism is not a good public service. > I’d much rather have my data deleted until it’s secured than have it stolen by someone else There are multiple logical fallacies in this sentence. First is the use of the world 'until' which is ambiguous here; it suggests that your data can be 'undeleted' after the DB has been secured or you would rather not have any data stored anywhere that is not secured. Either option to…

>Vandalism is not a good public service.

It is, better than to steal the data, you know what a really bad service is? Let your Database wide open, and expose your customers data (maybe?) for everyone to read.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#503

Post by nix23 »

smt88 wrote: post #325
randyrand wrote: post #306

Earlier quoted context omitted.

depends on the data. it could be public records

Databases can be public and secure. If a database can be deleted, it is not secure.

>If a database can be deleted, it is not secure

True, but a deleted database is secure again ;)

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#504

Post by rewq4321 »

nix23 wrote: post #501
rewq4321 wrote: post #488

Earlier quoted context omitted.

Free? It would have required more effort, but they could have encrypted all the data, and then sent the key to a well-known white-hat security researcher, or someone who could be trusted to administrate important cases (they'd of course be free to ignore it). The encryption could be done on the compromised server with a forEach, so it'd be a single request. I think some people in this thread want to be a bit too "abs…

>Everyone's servers were exposed to heartbleed No just my Webserver/HAProxy. The difference is, don't expose services that are not meant to face the Inet directly. Production-Type Webservers are, SSH, VPN, HAProxy etc are. Databases, devel-webservers, NFS, Samba are not! Sure even the best hardened Service can have vulnerabilities, but that's how life is, better have a door with a key than one without, even when some…

> don't expose services that are not meant to face the Inet directly

I did not (in the slightest) suggest that people should do this. I was commenting on the "free-ness" of the lesson (read the comment I was replying to). It could have been more "free" with a little more effort. Straight-up deletion wasn't the only option.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#505

Post by thrownaway954 »

monksy wrote: post #263

This is what happens when you lay off all of your sysadmins because "the cloud", move that role to devops and then downsize that to a subduty of a developer.

i'm sure it's not that. most likely they are databases that development setup for testing or developing a quick server and just forgot to hand it over to sysops or dbas. happened all the time where i use to work.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#506

Post by ben509 »

cryptoz wrote: post #292
pietroglyph wrote: post #254

Earlier quoted context omitted.

Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.

Vandalism is not a good public service. > I’d much rather have my data deleted until it’s secured than have it stolen by someone else There are multiple logical fallacies in this sentence. First is the use of the world 'until' which is ambiguous here; it suggests that your data can be 'undeleted' after the DB has been secured or you would rather not have any data stored anywhere that is not secured. Either option to…

> There are multiple logical fallacies in this sentence.

No, there aren't any fallacies in that sentence and can't be.

The statement expresses a personal preference; to be fallacious there must be some logic that can be unsound. That is, it must start from some premises and then derive a conclusion. To find a fallacy, you have to show that at some point the conclusion does not follow from the premises.

Since it's a simple assertion, it is implicitly sound. (The graph of premises to conclusions is just a single node.) And since the author knows with certainty what his preferences are, we can take it as true. It's fruitless to argue with people about what their preferences are.

> First is the use of the world 'until' which is ambiguous here

Virtually all "fallacies" you see online are just people typing their thoughts in a hurry. Take advantage of interaction and ask them to clarify.

> Lastly, your personally preferred outcome for your personal data is not a measure for all of society, but you grant it that "public service" label as if your preference matters above everyone else's.

And as a member of the public, if it serves my interest, it is a public service to some extent.

Now, fair enough, you're trying to attack it as not being some broader notion of a public service. You have that broader notion in mind, but you don't explain what it is.

Instead you apply your internal definition through "as if..." which puts you in the territory of inventing a claim they simply never made. That's not even fallacious, it's pure fiction.

> A blind deletion of unknown data belonging to unknown people is not a public service.

You do make some claims, mostly coached as questions, that might lead to this conclusion. You never plainly state your premises, nor do you connect them to this conclusion.

So after all that, your conclusion is a non sequitur!

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#507

Post by blaser-waffle »

duckmysick wrote: post #480
user5994461 wrote: post #289

Earlier quoted context omitted.

Recommend to setup two subnets in your project. One public and one private. This prevents this sort of issues, instances in the private subnet simply don't get a public IP, they can't be reached over the internet. For reference, the standard practice in a company is to have a (third) separate subnet for databases, with zero internet access (no NAT gateway). Connection must be explicitly opened from/to database client…

Where can I find a tutorial or a guide about it for, let's say, Ubuntu? Would this be a good start: https://www.digitalocean.com/docs/networking/vpc/how-to/enab...

The DO tutorial is a good start, but as another poster mentioned further down, check out: https://github.com/konstruktoid/hardening

note: the DO tutorial will hold your hand a little; the hardening doc expects a (minor) degree of familiarity

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#508

Post by tremon »

umvi wrote: post #398
snorrah wrote: post #390

Earlier quoted context omitted.

Yes, so that you always keep security in mind.

And what if the thing I'm building isn't intended for the public internet?

Then why are you building it on the public internet?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#509

Post by scarface74 »

lmm wrote: post #459
scarface74 wrote: post #441

Earlier quoted context omitted.

That's not what I'm talking about. Suppose your router receives a packet whose destination is that internal IP address. Then it's going to send it there, unless it's configured to block that traffic. What router is set up by default to route traffic from the internet to a private IP address unless the traffic initiated from the private IP address? Someone would have to purposefully configure their router to do it. Of…

Any router designed for professional environments won't second-guess your networking setup. Either it will route everything by default or it will deny everything by default and route only those routes you've specifically added, but either way it's not going to do anything differently just because one side or the other is an RFC1918 private address.

I understand that. But, we are talking about defaults. The reason the exploits that this submission is talking about took place is because too many people didn’t change the defaults.

Assuming people took the sensible leap that private resources equal private IP address, they are not going to then go out of their way to configure their router to route their private resources.

As far as “route everything” how is it going to know how to route from a public IP address to your ES server unless you specifically tell it?

I’m sure no one who got hacked went out of their way to configure their router to make their ES cluster publicly accessible.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#510

Post by Ajedi32 »

umvi wrote: post #386
dawnerd wrote: post #126

Earlier quoted context omitted.

Seriously this is the most annoying thing ever, especially if someone on your team things you need to expose the ports to redis in a docker compose. I’ve come back from a weekend where my redis instance was being used for crypto mining. Anything that is insecure by default in 2020 should be killed off IMO.

Secure by default is super onerous though. What if I just want to try out something before committing to it, do I really need to jump through a bunch of security hoops?

Then you just pass the `--disable-all-security` flag. (Or whatever similar method the project you're using exposes to allow that.) Secure-by-default doesn't have to be complicated; it's just a way to ensure people don't shoot themselves in the foot without comprehending what they're doing.
Post reply on HN