Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

511–520 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#511

Post by lallysingh »

gwright wrote: post #451
lallysingh wrote: post #379

Earlier quoted context omitted.

The folks hit didn't have backups (if they did, well anyone can restore them), nor did they secure their db. One is forgivable. Both together get no sympathy from me. Rather disgust that some of them had PII from customers that trusted them.

More justification that this is an appropriate way to teach people a lesson. You don't seem to care at all what the impact might be on those affected. You are in affect encouraging the criminal behavior because the ends justify the means, apparently. While I understand the concern that organizations aren't taking proper care to protect their data I think legitimizing vigilante punishment for those mistakes is a very…

I'm a huge thought-criminal. A threat to the state!

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#512

Post by zentiggr »

octodog wrote: post #308
Drakim wrote: post #84

Earlier quoted context omitted.

It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? The company could take a huge financial hit and people might lose their jobs because of their practices being exposed.

Your comparison isn't fair - blowing the whistle is supposed to be a last resort. Internal disclosure and attempting to fix the issue collaboratively is always the first step. This attack is indiscriminate and is without warning, so it eliminates the possibility for database owners to fix the problem in good faith.

Finally, after years and years and years of being told over and over and the bottom line never improving.

I got doxxed with the Equifax breach. How many other companies in the world will take someone's word that they are me based on that data, and what potential is there for my life amongst millions of others to go completely sideways because of companies who won't addmit the systems are broken?

I say the house is already burning, but maybe throwing some fireworks into the blaze will convince the right parties to finally put the damn fire out.

Beyond sick and tired of breach after breach after breach after "oh, there were millions of voter records showing publicly" "no, defaults to no security"

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#513

Post by dvcrn »

monksy wrote: post #263

This is what happens when you lay off all of your sysadmins because "the cloud", move that role to devops and then downsize that to a subduty of a developer.

Every cloud database provider I can think of gives you random initial credentials from the getgo

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#514

Post by nix23 »

rewq4321 wrote: post #504
nix23 wrote: post #501

Earlier quoted context omitted.

>Everyone's servers were exposed to heartbleed No just my Webserver/HAProxy. The difference is, don't expose services that are not meant to face the Inet directly. Production-Type Webservers are, SSH, VPN, HAProxy etc are. Databases, devel-webservers, NFS, Samba are not! Sure even the best hardened Service can have vulnerabilities, but that's how life is, better have a door with a key than one without, even when some…

> don't expose services that are not meant to face the Inet directly I did not (in the slightest) suggest that people should do this. I was commenting on the "free-ness" of the lesson (read the comment I was replying to). It could have been more "free" with a little more effort. Straight-up deletion wasn't the only option.

>Straight-up deletion wasn't the only option.

No but a good one.

>It could have been more "free" with a little more effort.

Even White-Hats work not for free (for companys). Don't build Cars if you don't know how a break work, don't build IT-Services if you have no the slightest idea how to secure them.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#515

Post by quadrifoliate »

JosephRedfern wrote: post #492
stedaniels wrote: post #460

Earlier quoted context omitted.

That was edited in afterwards. https://stackoverflow.com/posts/63067062/revisions whilst it very well may be a personal project, it certainly wasn't "very clear".

Maybe he edited it to clarify after strangers on the internet got him in trouble at work having implied that his employer had suffered a data breach?

Yeah, imagine if someone started stalking you on the Internet and making up random assumptions about your employer based on the questions you asked on a question-and-answer site. Oh and wait, they are doing this slanderous gossip under a pseudonym themselves, so you can't even call them out personally!

Stuff like this is what drives away underrepresented groups from engaging on the internet. Maybe everyone who upvoted and participated in the uninformed speculation from 'user5994461 should reconsider.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#516

Post by duckmysick »

blaser-waffle wrote: post #507
duckmysick wrote: post #480

Earlier quoted context omitted.

Where can I find a tutorial or a guide about it for, let's say, Ubuntu? Would this be a good start: https://www.digitalocean.com/docs/networking/vpc/how-to/enab...

The DO tutorial is a good start, but as another poster mentioned further down, check out: https://github.com/konstruktoid/hardening note: the DO tutorial will hold your hand a little; the hardening doc expects a (minor) degree of familiarity

Thanks. I saw this git repo earlier and it looks interesting (even though most of my machines are on LTS 18).

I don't see anything about subnets in there though. Did I miss something?

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#518

Post by rewq4321 »

nix23 wrote: post #514
rewq4321 wrote: post #504

Earlier quoted context omitted.

> don't expose services that are not meant to face the Inet directly I did not (in the slightest) suggest that people should do this. I was commenting on the "free-ness" of the lesson (read the comment I was replying to). It could have been more "free" with a little more effort. Straight-up deletion wasn't the only option.

>Straight-up deletion wasn't the only option. No but a good one. >It could have been more "free" with a little more effort. Even White-Hats work not for free (for companys). Don't build Cars if you don't know how a break work, don't build IT-Services if you have no the slightest idea how to secure them.

Fair, but I don't think you've added much to the thread here.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#519

Post by nix23 »

rewq4321 wrote: post #518
nix23 wrote: post #514

Earlier quoted context omitted.

>Straight-up deletion wasn't the only option. No but a good one. >It could have been more "free" with a little more effort. Even White-Hats work not for free (for companys). Don't build Cars if you don't know how a break work, don't build IT-Services if you have no the slightest idea how to secure them.

Fair, but I don't think you've added much to the thread here.

Same same ;)

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#520

Post by Grue3 »

andrewstuart wrote: post #232

Can someone how/explain why databases are left open?

Docker overriding iptables rules, in my case. I was using somebody else's project distributed via docker-compose config, which made the port for elasticsearch public, which I was not aware of (I don't normally use docker or elasticsearch). Luckily I was able to regenerate the data stored in elasticsearch, though I had to do it twice because it got wiped again after regeneration and then I had to google what the hell is going on.
Post reply on HN