15 ms·

Database leak exposes 3.3M Hello Kitty fans

80 points by tolien 11y ago

noinsight 11y ago
So, are we going to see extortion attempts like in the Ashley Madison leak? "We know you like Hello Kitty"...
- hcf 11y ago
  Well, I seriously use my hellokitty.com email address.
- GFK_of_xmaspast 11y ago
  What's the shame in that.
- nthcolumn 11y ago
  This guy is worried. http://imgur.com/RNiWGSl http://imgur.com/RNiWGSl
- CM30 11y ago
  Not so much extortion, though it's certainly a gold mine for unscrupulous advertisers trying to sell Hello Kitty merchandise...
dpina 11y ago
> Update 2: Earlier this afternoon, Chris Vickery confirmed that the three IP addresses that were disclosing user information have been secured. The issue wasn't a hack, but a misconfigured MongoDB installation. > The source of the configuration error isn't clear, as neither the ISP nor Sanrio has answered questions on the matter. A MongoDB database open to the outside world on a public IP address?
- eli 11y ago
  i.e. the default configuration But yeah, that's not good.
  - dpina 11y ago
    Oh I see. Assumed it was like mysql/mariadb where secure_installation by default asks to remove access from outside. It also implies frontend server includes the DB, typically a sysadmin would de-couple it so this shows lack of experience.
  - nacs 11y ago
    > i.e. the default configuration The default configuration for MongoDB is to listen on localhost only. Someone changed the configuration if it was listening on a public IP.
    - gruez 11y ago
      >The default configuration for MongoDB is to listen on localhost only That's true, but I remember that change was only made recently. Before, mongo would listen on all IPs and had no passwords.
    - drzaiusapelord 11y ago
      This is only true after the Mongo people were lambasted on the web for having such a terribly insecure out of the box product. Which was fairly recently. For years the product would bind to all IP addresses. Which is insane for a default install. Feb 2015: Discovered 40,000 vulnerable MongoDB databases on the Internet http://securityaffairs.co/wordpress/33487/hacking/40000-vulnerable-mongodbonline.html http://securityaffairs.co/wordpress/33487/hacking/40000-vuln... The changes were made after this, so we're only talking a few months now.
    - eli 11y ago
      Some official distributions listened to all addresses by default (by design) until recently. https://blog.shodan.io/its-the-data-stupid/ https://blog.shodan.io/its-the-data-stupid/
- Kristine1975 11y ago
  These things happen to the best: In 2001, the World Economic Forum had their MS-SQLServer with personal data of the participants connected to the Internet. With the standard account enabled (user: "sa", password: empty). It then got "hacked" and the data leaked. German article about it: https://www.woz.ch/-41f8 https://www.woz.ch/-41f8
  - mkhpalm 11y ago
    Why is everybody immediately making these types of diversion responses regarding relational datastores to mongodb breaches? Mongo has popularity and 2 fixable issues that make the exposure numbers outweigh those of every other datastore right now. 1. There is no password prompt during installation. This was the same problem many relational databases had back in the day with default user credentials. Today, I don't know of a single relational datastore that comes with default credentials during installation. (ignoring things that shouldn't go to production like homebrew) Individually, they all said it was a "security threat" and did something about it. 2. Things like MMS or other offering from MongoDB itself expect you expose your nodes externally so they can manage things for you. This can easily be made secure... but its contradictory in nature. It suggests to somebody who probably doesn't know what they're doing on the IT or DevOps fronts to do something more easily dangerous than not... just so they can sell their vendor services to you. Its a recipe for disaster but its also easily fixable with a few design changes on their side.
    - Kristine1975 11y ago
      I guess you could read my post as "others aren't better than MongoDB", but that wasn't my intention. I merely remembered the WEF anecdote and thought I'd mention it here (although it's unfortunate I didn't find an English source for it). MongoDB is repeating the same mistakes others made 15 years ago.
      - mkhpalm 11y ago
        Apologize, wasn't really directed at you. I'm sure you've seen all the other comments related to this type of news. Sounds like we both agree that MongoDB is repeating the same mistakes others had made 15 years ago. The only difference is, back then, there was a less dramatic excuse for how it got that way.
- mortehu 11y ago
  > A MongoDB database open to the outside world on a public IP address? Maybe someone was inspired by this article? https://blog.shodan.io/its-still-the-data-stupid/ https://blog.shodan.io/its-still-the-data-stupid/ > At the moment, there are at least 35,000 publicly available, unauthenticated instances of MongoDB running on the Internet. [...] all of the exposed databases combined account for 684.8 TB of data.
MilnerRoute 11y ago
Reuters headline: "Hello Kitty fan site exposed, but no data stolen: web host" "There is no evidence any data has been stolen, the Hong Kong-based company hosting the data said on Tuesday." http://in.reuters.com/article/us-sanrio-cyberattack-idINKBN0U42B720151222 http://in.reuters.com/article/us-sanrio-cyberattack-idINKBN0...
MilnerRoute 11y ago
Found when I Googled for more information... "Hello Kitty and Minnie Mouse arrested after fight over tip money in New York's Times Square." http://www.mirror.co.uk/news/weird-news/hello-kitty-minnie-mouse-arrested-5833387 http://www.mirror.co.uk/news/weird-news/hello-kitty-minnie-m...
BooneJS 11y ago
Evening project: union Hello Kitty and Ashley Madison lists. No, some things are better left unknown.
- deleted 11y ago
  [deleted]
- Cyph0n 11y ago
  Intersection you mean.
- gotrecruit 11y ago
  not much of a "project"... seems like a simple SQL query will reveal the intersection.
- JMCQ87 11y ago
  That was my first thought, too. ^^
- whywouldyou 11y ago
  I'm not sure what compels people to download and look at any of these leaks. There's a real dichotomy between the mostly universal opinion on here that ad tracking is a terrible evil, but downloading and investigating people's private data that was illegally obtained and distributed is okay.
  - pavel_lishin 11y ago
    > the mostly universal opinion ... downloading and investigating people's private data that was illegally obtained and distributed is okay [citation needed]
    - whywouldyou 11y ago
      It's a prevalent cadence when the topic comes up. Granted, people opposed to ad tracking are likely more vocal on the topic than people for it.
  - 11y ago
nly 11y ago
> unsalted SHA-1 password hashes Can we please get password storage built in to databases as a dedicated column type already? There are N-to-infinity crappy languages and CMS's out there, but only a handful of databases. It's becoming clear that widespread standard library support for decent password hashing just isn't enough to get people moved over.
- maaku 11y ago
  That is a decent idea I've never heard of before. Have you tried submitting an issue to various database issue trackers?
  - nly 11y ago
    No, because even this would be a total cock-up. Don't give anybody your password, and just can't mess it up. So i'm not really in favour of fixing backends at all. I think the password problem is entirely the browser vendors reponsibility. Solid password authentication already exists in TLS (which you need anyway), it's just not widely implemented or exposed via browser UIs. There are too many vested interests from the big players, where the hope is that deliberately making authentication ever more burdensome for users will just lead them to give up and select 'login with Facebook/Google/Live' and hand them the keys to the kingdom.
- dopamean 11y ago
  This sounds like such an obviously great idea that I don't know how I haven't heard it before. Can someone who understands how databases are built explain why this isn't an obviously great idea?
  - nly 11y ago
    The elephant in the room is what you return when you SELECT. My POV is you should be able to verify user sign-in with something like "SELECT COUNT(*) FROM users WHERE email = 'maaku@hellokitty.com' AND password='hunter2';", which has the added bonus of not informing the client whether the query failed because the user didn't exist, or because the password was wrong. Imho, all queries for the column content should simply fail.
nemon1c 11y ago
This is the same guy that uncovered the MacKeeper user database as well, which also used MongoDB. From what I've read, he just used Shodan to uncover these instances. This isn't meant to discredit him, but it interesting how we're calling people like this "security researchers".
- dopamean 11y ago
  I don't know who Vickery is but could he not be a security researcher who uses Shodan?

80 points by tolien 11y ago

noinsight 11y ago

So, are we going to see extortion attempts like in the Ashley Madison leak? "We know you like Hello Kitty"...

hcf 11y ago
Well, I seriously use my hellokitty.com email address.
GFK_of_xmaspast 11y ago
What's the shame in that.
nthcolumn 11y ago
This guy is worried. http://imgur.com/RNiWGSl http://imgur.com/RNiWGSl
CM30 11y ago
Not so much extortion, though it's certainly a gold mine for unscrupulous advertisers trying to sell Hello Kitty merchandise...

dpina 11y ago

> Update 2: Earlier this afternoon, Chris Vickery confirmed that the three IP addresses that were disclosing user information have been secured. The issue wasn't a hack, but a misconfigured MongoDB installation. > The source of the configuration error isn't clear, as neither the ISP nor Sanrio has answered questions on the matter. A MongoDB database open to the outside world on a public IP address?

eli 11y ago
i.e. the default configuration But yeah, that's not good.
- dpina 11y ago
  Oh I see. Assumed it was like mysql/mariadb where secure_installation by default asks to remove access from outside. It also implies frontend server includes the DB, typically a sysadmin would de-couple it so this shows lack of experience.
- nacs 11y ago
  > i.e. the default configuration The default configuration for MongoDB is to listen on localhost only. Someone changed the configuration if it was listening on a public IP.
  - gruez 11y ago
    >The default configuration for MongoDB is to listen on localhost only That's true, but I remember that change was only made recently. Before, mongo would listen on all IPs and had no passwords.
  - drzaiusapelord 11y ago
    This is only true after the Mongo people were lambasted on the web for having such a terribly insecure out of the box product. Which was fairly recently. For years the product would bind to all IP addresses. Which is insane for a default install. Feb 2015: Discovered 40,000 vulnerable MongoDB databases on the Internet http://securityaffairs.co/wordpress/33487/hacking/40000-vulnerable-mongodbonline.html http://securityaffairs.co/wordpress/33487/hacking/40000-vuln... The changes were made after this, so we're only talking a few months now.
  - eli 11y ago
    Some official distributions listened to all addresses by default (by design) until recently. https://blog.shodan.io/its-the-data-stupid/ https://blog.shodan.io/its-the-data-stupid/
Kristine1975 11y ago
These things happen to the best: In 2001, the World Economic Forum had their MS-SQLServer with personal data of the participants connected to the Internet. With the standard account enabled (user: "sa", password: empty). It then got "hacked" and the data leaked. German article about it: https://www.woz.ch/-41f8 https://www.woz.ch/-41f8
- mkhpalm 11y ago
  Why is everybody immediately making these types of diversion responses regarding relational datastores to mongodb breaches? Mongo has popularity and 2 fixable issues that make the exposure numbers outweigh those of every other datastore right now. 1. There is no password prompt during installation. This was the same problem many relational databases had back in the day with default user credentials. Today, I don't know of a single relational datastore that comes with default credentials during installation. (ignoring things that shouldn't go to production like homebrew) Individually, they all said it was a "security threat" and did something about it. 2. Things like MMS or other offering from MongoDB itself expect you expose your nodes externally so they can manage things for you. This can easily be made secure... but its contradictory in nature. It suggests to somebody who probably doesn't know what they're doing on the IT or DevOps fronts to do something more easily dangerous than not... just so they can sell their vendor services to you. Its a recipe for disaster but its also easily fixable with a few design changes on their side.
  - Kristine1975 11y ago
    I guess you could read my post as "others aren't better than MongoDB", but that wasn't my intention. I merely remembered the WEF anecdote and thought I'd mention it here (although it's unfortunate I didn't find an English source for it). MongoDB is repeating the same mistakes others made 15 years ago.
    - mkhpalm 11y ago
      Apologize, wasn't really directed at you. I'm sure you've seen all the other comments related to this type of news. Sounds like we both agree that MongoDB is repeating the same mistakes others had made 15 years ago. The only difference is, back then, there was a less dramatic excuse for how it got that way.
mortehu 11y ago
> A MongoDB database open to the outside world on a public IP address? Maybe someone was inspired by this article? https://blog.shodan.io/its-still-the-data-stupid/ https://blog.shodan.io/its-still-the-data-stupid/ > At the moment, there are at least 35,000 publicly available, unauthenticated instances of MongoDB running on the Internet. [...] all of the exposed databases combined account for 684.8 TB of data.

MilnerRoute 11y ago

Reuters headline: "Hello Kitty fan site exposed, but no data stolen: web host" "There is no evidence any data has been stolen, the Hong Kong-based company hosting the data said on Tuesday." http://in.reuters.com/article/us-sanrio-cyberattack-idINKBN0U42B720151222 http://in.reuters.com/article/us-sanrio-cyberattack-idINKBN0...

MilnerRoute 11y ago

Found when I Googled for more information... "Hello Kitty and Minnie Mouse arrested after fight over tip money in New York's Times Square." http://www.mirror.co.uk/news/weird-news/hello-kitty-minnie-mouse-arrested-5833387 http://www.mirror.co.uk/news/weird-news/hello-kitty-minnie-m...

BooneJS 11y ago

Evening project: union Hello Kitty and Ashley Madison lists. No, some things are better left unknown.

deleted 11y ago
[deleted]
Cyph0n 11y ago
Intersection you mean.
gotrecruit 11y ago
not much of a "project"... seems like a simple SQL query will reveal the intersection.
JMCQ87 11y ago
That was my first thought, too. ^^
whywouldyou 11y ago
I'm not sure what compels people to download and look at any of these leaks. There's a real dichotomy between the mostly universal opinion on here that ad tracking is a terrible evil, but downloading and investigating people's private data that was illegally obtained and distributed is okay.
- pavel_lishin 11y ago
  > the mostly universal opinion ... downloading and investigating people's private data that was illegally obtained and distributed is okay [citation needed]
  - whywouldyou 11y ago
    It's a prevalent cadence when the topic comes up. Granted, people opposed to ad tracking are likely more vocal on the topic than people for it.
- 11y ago

nly 11y ago

> unsalted SHA-1 password hashes Can we please get password storage built in to databases as a dedicated column type already? There are N-to-infinity crappy languages and CMS's out there, but only a handful of databases. It's becoming clear that widespread standard library support for decent password hashing just isn't enough to get people moved over.

maaku 11y ago
That is a decent idea I've never heard of before. Have you tried submitting an issue to various database issue trackers?
- nly 11y ago
  No, because even this would be a total cock-up. Don't give anybody your password, and just can't mess it up. So i'm not really in favour of fixing backends at all. I think the password problem is entirely the browser vendors reponsibility. Solid password authentication already exists in TLS (which you need anyway), it's just not widely implemented or exposed via browser UIs. There are too many vested interests from the big players, where the hope is that deliberately making authentication ever more burdensome for users will just lead them to give up and select 'login with Facebook/Google/Live' and hand them the keys to the kingdom.
dopamean 11y ago
This sounds like such an obviously great idea that I don't know how I haven't heard it before. Can someone who understands how databases are built explain why this isn't an obviously great idea?
- nly 11y ago
  The elephant in the room is what you return when you SELECT. My POV is you should be able to verify user sign-in with something like "SELECT COUNT(*) FROM users WHERE email = 'maaku@hellokitty.com' AND password='hunter2';", which has the added bonus of not informing the client whether the query failed because the user didn't exist, or because the password was wrong. Imho, all queries for the column content should simply fail.

nemon1c 11y ago

This is the same guy that uncovered the MacKeeper user database as well, which also used MongoDB. From what I've read, he just used Shodan to uncover these instances. This isn't meant to discredit him, but it interesting how we're calling people like this "security researchers".

dopamean 11y ago
I don't know who Vickery is but could he not be a security researcher who uses Shodan?