Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ‘Meow’ attack has deleted almost 4k unsecured databases

bleepingcomputer.com

Post reply on HN
Print view View original

521–530 of 544 posts

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#521

Post by strogonoff »

quadrifoliate wrote: post #515
JosephRedfern wrote: post #492

Earlier quoted context omitted.

Maybe he edited it to clarify after strangers on the internet got him in trouble at work having implied that his employer had suffered a data breach?

Yeah, imagine if someone started stalking you on the Internet and making up random assumptions about your employer based on the questions you asked on a question-and-answer site. Oh and wait, they are doing this slanderous gossip under a pseudonym themselves, so you can't even call them out personally! Stuff like this is what drives away underrepresented groups from engaging on the internet. Maybe everyone who upvote…

I expect if the author learns about this exchange he would never ask a question that has even a remote possibility of inviting speculation about levels of his knowledge or practices at a company where he happens to work at the time (in other words, pretty much any question at all) using his name.

That kind of public ridicule and possible resulting flak from management is why more and more developers participate in knowledge exchange by asking questions from under a throwaway pseudonym (much like user5994461), and only answer or edit other questions from accounts that connect to their identity in any way.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#522

Post by boomlinde »

asdfasgasdgasdg wrote: post #81
petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…

> Like, how does the local mom and pop correctly evaluate a person's IT chops?

Not my problem.

> The nephew says they can set up their website for cheap, and they want to be nice, so they give him the job. Turns out he's a newb and later their database gets deleted and you are on here saying that's a good thing? Hrm. I don't agree.

Mom and pop prefer nepotism over skill, credentials and reputation, without even a second opinion. There is a reason that this is frowned upon (and has been for at least some 2000 years before mom and pop were born), regardless of the domain.

On the off chance that their database doesn't contain any personally identifying information on their customers, this is an idiot tax. In any other case, their loss is completely justified when compared to the potential losses, abuse and manipulation of their customers that come with exposing their PII to the public.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#523

Post by jessaustin »

gwright wrote: post #455
jessaustin wrote: post #408

Earlier quoted context omitted.

I didn't just invent this idea that businesses are careless with data their customers would prefer to be kept private. Basically every breach we ever hear about features this prominently. Somehow we've created an economy in which there exists a vast asymmetry between corporations who pad their books a few percentage points by abusing their position and the humans who suffer such abuses. The fact that the publicity of…

You seem entirely focused on PII concerns and arguing as if the only organizations affected by this incident are "giant companies". That doesn't seem to be the case. I haven't seen any suggestion that this incident is focused on that type of data. As much as I agree with all the concerns posted here about how data should be protected better I don't think it is necessary to excuse and legitimize the unauthorized acces…

Wealthy interests built the system, but they're not the only abusive actors within it. It would not surprise if smaller firms completely failed to protect the data of other parties more often than larger firms did so. The best way for database operators to prevent unauthorized access and deletion is to secure their databases in some way. The best way for anyone else to prevent abusive access is to delete unsecured databases. Working together, this problem will be solved eventually.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#524

Post by nkrisc »

ivanhoe wrote: post #489
nkrisc wrote: post #433

Earlier quoted context omitted.

That sounds reasonable, but you'd think most people would also be concerned about their databases being publicly accessible in the first place, yet here we are.

I don't think this is the case of people not being concerned, but simply the ignorance on their part about the setup. People just presume that the defaults are safe, and never bother getting into the details.

At the risk of arguing "no true Scotsman," someone who is concerned about security likely wouldn't make assumptions about defaults. Or rather, someone appropriately paranoid about security concerns would not trust defaults without at least reviewing them.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#525

Post by achillean »

emilburzo wrote: post #466
achillean wrote: post #347

Earlier quoted context omitted.

Shodan Monitor will do it and if you're only keeping track of https://www.shodan.io/store/member ). You just provide an IP/ network/ domain and we'll notify you if anything changes or becomes vulnerable. It's basically Google Alerts but for network ports: https://monitor.shodan.io Disclaimer: I'm the founder of Shodan.

I'm using this and really love it, but it's annoying if you want to use a domain name instead of IPs, because if the DNS records change the old IPs stay in with the new ones.

That shouldn't be happening, can you confirm? It should flush out the old ones based on the current DNS information. The whole point is to automatically update the alerts based on the latest DNS information so you don't need to manage that yourself.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#526

Post by AnIdiotOnTheNet »

nix23 wrote: post #490
creato wrote: post #426

Earlier quoted context omitted.

I wonder how many of the deleted databases are just people learning with databases of dummy data?

Nice, now they learn never expose a DB directly to the net additionally...bonus points ;)

Except of course they probably already knew that, they just accepted to risk to their toy database as a trade-off for the convenience of being able to directly access it over the internet.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#527

Post by AnIdiotOnTheNet »

nkrisc wrote: post #318
tdeck wrote: post #197

Earlier quoted context omitted.

Why not just rename all the tables or something? That's enough to get the developer's attention without being so destructive.

Because if it's not destructive they have no reason to pay attention. Change names back and it's business as usual.

Which is precisely why it is ok for me to enter your unsecured garage window and slash all your tires.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#528

Post by jfk13 »

sgift wrote: post #484
jfk13 wrote: post #143

Earlier quoted context omitted.

How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.

It's easy to say "you could have just emailed them" when you are not the one doing this for years without things getting better. Often admins flat out ignore you. Even if not they usually do nothing. And if they do something it takes ages.

I don't doubt that for a moment; I have also reported issues of various kinds -- not this specific one -- that have gone unresolved for ages.

That still doesn't justify vandalism.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#529

Post by zamalek »

petee wrote: post #5

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be deleted than stolen and shared. If the owner doesn't have proper backups AND can't secure a database, they have no business hosting such data, period. IMHO.

> [Article] They could be the work of a vigilante trying to give administrators a hard lesson in security by raining destruction on unsecured data.

It could be a person attempting to prevent the data from falling into the wrong hands. Problem is: once it's deleted, you have no idea whether your data was stolen and shared. A better option would be to first send a copy to Have I Been Pwned.

Re: New ‘Meow’ attack has deleted almost 4k unsecured databases

#530

Post by emilburzo »

achillean wrote: post #525
emilburzo wrote: post #466

Earlier quoted context omitted.

I'm using this and really love it, but it's annoying if you want to use a domain name instead of IPs, because if the DNS records change the old IPs stay in with the new ones.

That shouldn't be happening, can you confirm? It should flush out the old ones based on the current DNS information. The whole point is to automatically update the alerts based on the latest DNS information so you don't need to manage that yourself.

It was happening at least until June 6 2020, I removed that particular domain after that.

If you want I can re-add it and ping you if it happens again. (where can I ping you?)

I also had a support ticket around that time about this but never got an answer, guess it got lost.

Post reply on HN