12 ms·

Somehow I feel good about this. The article claims nothing good can come of deleting exposed databases, but I strongly disagree - I'd by far rather my data be d

• JaggerJo 6y ago
  agreed.
• menzoic 6y ago
  Could be both
• glckr 6y ago
  No other bad actors can get it, but we don't know if it's already been found, and now that it's gone we have no idea what data is out in the wild. And as you note, we can't trust the companies to accurately report it themselves.
  • DyslexicAtheist 6y ago
    maybe the authors of meow should "improve" it with a feature that reports every instance to HIBP before deleting it. that is if their intention with this malware was a benevolent one :) but I guess feature iteration in malware that is "supposed to be good" would be tricky
    • mkagenius 6y ago
      > reports every instance to HIBP no, that doesn't make sense if its only meow who found it. And since there is no way to know that, it does not make sense to mail a copy to hibp
  • petee 6y ago
    I think you make an important point though - deleted or not, there is no real way to know what's been exposed, and no guarantee that they'll ever admit it; so torch all the data expeditiously, and we'll just have to comb through 'successful' leaks just as always. Another side is that with their database blanked, that will force more companies to explain their downtime or complete loss of data, rather than quietly secure it again and pretend nothing happened
  • Alex3917 6y ago
    Ideally they'd report it so that password managers could warn everyone, but with just the database URI there isn't necessarily any obvious way to know what domain or business its associated with.
    • wtracy 6y ago
      If the attacker can write to the DB, then they can add entries to every table with the string "Hey your database is unsecured!"
    • GekkePrutser 6y ago
      Doesn't really matter, as long as the credential is exposed, users can be warned. No matter where it came from.
  • HappyDreamer 6y ago
    Maybe this actor A downloaded the data, then deleted the database, preventing others from accessing and selling the same data? Only A can sell this data now?
    • na85 6y ago
      So, no difference other than the company now has to explain that their database was insecure. Got it.
  • zentiggr 6y ago
    Oh, they'll have to say something when they suddenly stop doing business until a backup can get pulled, and the new db instances actually secured before putting them up again. Even a bland 'we lost parts of our data and we will have to start recovery processes. please stand by' is a signal.
• neutronman 6y ago
  +1 Any entity this irresponsible shouldn’t hold data.
• bhargav 6y ago
  This also affected people who use software for things other than businesses. People with IoT apps for their home, researchers, etc. Our field is vast and there is a large variance in people just using the basics of CS and those who keep up with standards and best practices, etc. Your statement is basically akin to someone saying that it’s fine for people to get robbed if they went out with their wallet; or worse.. killed.
  • nend 6y ago
    >Your statement is basically akin to someone saying that it’s fine for people to get robbed if they went out with their wallet; or worse.. killed. Uhh no? The analogy would be that there's some benefit that comes from someone's wallet being destroyed, instead of stolen.
    • unstatusthequo 6y ago
      I’d say it’s closer to leaving your wallet on the street. If you don’t care to protect it you should assume someone will fuck with it.
  • hobs 6y ago
    Just because its offering some useful service doesn't indemnify the ownership from the bad methods they use to deliver the service. Exposing your database to the internet with default creds is not "standards and best practices" - its highly negligent, and if you are taking people's money for such a service, I have no pity for you.
  • hddherman 6y ago
    That's not a good argument, inexperience does not excuse exposing user data.
  • petee 6y ago
    If you can't or don't know how to secure it, it shouldn't be online. My argument is more akin to a child learning not to leave their bike unattended on a city street corner overnight. I can come by pick up the bike, and tell you the dangers, but there's only one real way to learn. And clearly my opinion isn't even close to comparison with somebody being killed in a robbery.
• derefr 6y ago
  I'm ambivalent about this action in most cases, but in some specific cases there can be a clear reason to have an exposed database: namely when the database is a guest-accessible, read-only repository of public data, i.e. the self-hosted equivalent of publishing a Google BigQuery dataset. As someone who runs such a "public-access data library" myself, I would be slightly annoyed if someone came along and burned it down, just because it has an unpatched vulnerability. ...but if it got deleted because I left default admin creds on it, though, that'd be my own fault.
  • jmvoodoo 6y ago
    Databases that are read only would be unaffected by this attack.
    • derefr 6y ago
      Read-only in practice, not inherently read-only in the way that e.g. CD-ROM is. Such systems still need to have their otherwise-static dataset updated "online" by an ETL pipeline agent-user. Which often means, in the DBMSes with less fine-grained security models, that such users need to have full DML (and even DDL) capabilities, rather than only insert capability.
      • dtech 6y ago
        This attack was only possible on databases with unsecured or weakly secured read-write access.
• asdfasgasdgasdg 6y ago
  I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to their owner? Sure. But that is far from all of them. I also just think it is a little uncharitable to wish harm on people simply because whoever did their IT was inexpert at their job? Like, how does the local mom and pop correctly evaluate a person's IT chops? The nephew says they can set up their website for cheap, and they want to be nice, so they give him the job. Turns out he's a newb and later their database gets deleted and you are on here saying that's a good thing? Hrm. I don't agree.
  • Drakim 6y ago
    It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? The company could take a huge financial hit and people might lose their jobs because of their practices being exposed.
    • asdfasgasdgasdg 6y ago
      Sometimes the best path forward does harm, sure. It's just hard for me to agree that deleting these databases is the harm-minimizing path. One example of a less harmful path that comes to mind immediately is installing a random password on the unsecured database and emailing the domain owner the password. That would cause downtime but it would limit the irreversible damage. You could even say that you will delete the database if it is found again with an unsecured password, if you wanted to add some stick to your carrot. It does not seem like this attack has harm-minimization in mind.
      • deleted 6y ago
        [deleted]
      • pojzon 6y ago
• gwright 6y ago
  Would you feel the same way if someone burned your house down if you left the door unlocked? Would you support the idea of people walking through a neighborhood and checking every door in a similar way? Does your opinion change if it happened in a business district? I think it is fine to argue that doors should be locked but that doesn't mean that a crime hasn't been committed when someone takes advantage of a situation.
  • cm2187 6y ago
    I don't think the parent suggests it exonerates the hackers. Just that the clients are better off.
    • gwright 6y ago
      Better off? The idea that victims deserve to be victimized because they didn't take enough care is trotted out every time a security issue comes up on HN.
      • wolco 6y ago
        Thr victims are the unaware customers who's data has been stolen because the company wasn't providing security. If a business left the store open with the customers credit cards details on display. Anyone passing by can go in and copy that info. Someone sees this and burns the exposed records. Perhaps they helped the victim. Remember no one burned the store down or the table holding the records. They burned only the exposed records.
        • gwright 6y ago
          You don't know who was the storage vendor and who's data was being deleted and you have no idea what that data represents or what the consequences are of having to restore it. You are making several unfounded assumptions.
          • wolco 6y ago
• goatinaboat 6y ago
  Somehow I feel good about this. Frankly anyone who is still using MongoDB is professionally negligent and this was if not deserved then certainly inevitable.
• koonsolo 6y ago
  Who says it's consumer data? It can be a personal project, a blog, etc. Just because it's not secure doesn't mean you should delete the data, because where does such reasoning end? Reminds me of the super meat boy web version with database creds in client. Dev knew, but just did a quick implementation. Hacker wanted to prove his point and ruined it for everybody. Making a secure version was not worth the effort, so now because of this prick nobody could enjoy it.
• klyrs 6y ago
  > Somehow I feel good about this. For me, it's not exactly "good." But I am more upset with the database owners than I am with the kitties. Don't leave the barn door open, or this (or worse) will happen to you, and happen again. If they were instead exfiltrating and selling the data, the equation would change. I'm not saying the cats are doing good, but I do say that the "responsible adults" did the greatest harm by not cat-proofing their databases that contain PII.
• richardrk2 6y ago
  I wholeheartedly agree. I cannot think of a scenario where a company exposes my data and I would not want it to be deleted ASAP. The only thing is that such companies might not be able anymore (if data was not backed up) to email me about a “breach”.
• zbuf 6y ago
  I don't have a feeling one way or the other, but I see where you're coming from and I think there's an interesting aspect that many of the folks here seem to be missing. Were this sort of attack to become part of the "noise" of the internet (much as the continual bombarding of my SSH ports) then peoples databases would get deleted _before_ they contain any meaningful amount of data. So in practice this sort of gross vandalism is limited to the appearance of such an attack, but not ongoing. I had this the other day building OS images, which accidentally left the system a passwordless login. Within less than a few hours it was (presumably) spewing mail or doing awful things -- long before anything went anywhere near production data or any kind of trust.
• zamalek 6y ago
  > [Article] They could be the work of a vigilante trying to give administrators a hard lesson in security by raining destruction on unsecured data. It could be a person attempting to prevent the data from falling into the wrong hands. Problem is: once it's deleted, you have no idea whether your data was stolen and shared. A better option would be to first send a copy to Have I Been Pwned.