4 ms·

It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building c

by Drakim 6y ago

It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? The company could take a huge financial hit and people might lose their jobs because of their practices being exposed.

asdfasgasdgasdg 6y ago
Sometimes the best path forward does harm, sure. It's just hard for me to agree that deleting these databases is the harm-minimizing path. One example of a less harmful path that comes to mind immediately is installing a random password on the unsecured database and emailing the domain owner the password. That would cause downtime but it would limit the irreversible damage. You could even say that you will delete the database if it is found again with an unsecured password, if you wanted to add some stick to your carrot. It does not seem like this attack has harm-minimization in mind.
- deleted 6y ago
  [deleted]
- pojzon 6y ago
  What you propose is illegal in most 1st/2nd world countries. In mine, the company could thank you and then put you straight to jail for 30 years. Unfortunately very few small businesses run sade reporting programs and often react with attack.
  - wolco 6y ago
    So is deleting a database. Putting a password and emailing the admin would solve the password problem. But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.
    - TeMPOraL 6y ago
      The problem is with the e-mailing part. A mom&pop is unlikely to track you down if you lock out their DB, but they'll likely report you to police if you contact them about it.
      - Wowfunhappy 6y ago
        Is an email from an anonymous address easier to trace than remote database commands?
        edoceo 6y ago
        Yes. You need good logging on the vulnerable DB to trace the command - and if your DB is vulnerable it's a good bet you forgot the logging too. Emails have a bunch of info in the headers, so there is more meta-data in the email it self. Neither is perfect for finding the culprit but one scenario has zero meta-data and the other has some.
    - jfk13 6y ago
      How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.
      - vincnetas 6y ago
        “Fix auth”. Add item to todo list and just forget because there are other more pressing tasks to do.
      - achillean 6y ago
        Unfortunately it's rarely that simple. If you look at the currently exposed MongoDB instances you'll see that most of them are in the cloud without any obvious attribution. You could email the cloud providers and see if they will reach out to the end-user but chances are they already know about it. Here's an article I wrote on that subject, although it was related to industrial control systems: https://blog.shodan.io/taking-things-offline-is-hard/ https://blog.shodan.io/taking-things-offline-is-hard/
  - asdfasgasdgasdg 6y ago
    I certainly think the most legal approach is to do nothing except notify, or maybe nothing at all. But if you must modify the database, locking it reversibly is more defensible morally.
    - 908087 6y ago
      A large portion of your notifications would go ignored, and some portion of your notifications would likely trigger the owners of those databases to go on the attack against you.
- cheerlessbog 6y ago
  Or just set everyone's password to the same thing eg SecureMe
phkahler 6y ago
>> but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? No. The equivalent would be exploiting their buildings weakness to cause them to collapse - maybe with people in them. Pointing out a vulnerability is not the same as demonstrating it. That said, a demonstration will get their attention more.
octodog 6y ago
Your comparison isn't fair - blowing the whistle is supposed to be a last resort. Internal disclosure and attempting to fix the issue collaboratively is always the first step. This attack is indiscriminate and is without warning, so it eliminates the possibility for database owners to fix the problem in good faith.
- zentiggr 6y ago
  Finally, after years and years and years of being told over and over and the bottom line never improving. I got doxxed with the Equifax breach. How many other companies in the world will take someone's word that they are me based on that data, and what potential is there for my life amongst millions of others to go completely sideways because of companies who won't addmit the systems are broken? I say the house is already burning, but maybe throwing some fireworks into the blaze will convince the right parties to finally put the damn fire out. Beyond sick and tired of breach after breach after breach after "oh, there were millions of voter records showing publicly" "no, <insert product name> defaults to no security"

by Drakim 6y ago

asdfasgasdgasdg 6y ago

Sometimes the best path forward does harm, sure. It's just hard for me to agree that deleting these databases is the harm-minimizing path. One example of a less harmful path that comes to mind immediately is installing a random password on the unsecured database and emailing the domain owner the password. That would cause downtime but it would limit the irreversible damage. You could even say that you will delete the database if it is found again with an unsecured password, if you wanted to add some stick to your carrot. It does not seem like this attack has harm-minimization in mind.

deleted 6y ago
[deleted]
pojzon 6y ago
What you propose is illegal in most 1st/2nd world countries. In mine, the company could thank you and then put you straight to jail for 30 years. Unfortunately very few small businesses run sade reporting programs and often react with attack.
- wolco 6y ago
  So is deleting a database. Putting a password and emailing the admin would solve the password problem. But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.
  - TeMPOraL 6y ago
    The problem is with the e-mailing part. A mom&pop is unlikely to track you down if you lock out their DB, but they'll likely report you to police if you contact them about it.
    - Wowfunhappy 6y ago
      Is an email from an anonymous address easier to trace than remote database commands?
      - edoceo 6y ago
        Yes. You need good logging on the vulnerable DB to trace the command - and if your DB is vulnerable it's a good bet you forgot the logging too. Emails have a bunch of info in the headers, so there is more meta-data in the email it self. Neither is perfect for finding the culprit but one scenario has zero meta-data and the other has some.
  - jfk13 6y ago
    How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.
    - vincnetas 6y ago
      “Fix auth”. Add item to todo list and just forget because there are other more pressing tasks to do.
    - achillean 6y ago
      Unfortunately it's rarely that simple. If you look at the currently exposed MongoDB instances you'll see that most of them are in the cloud without any obvious attribution. You could email the cloud providers and see if they will reach out to the end-user but chances are they already know about it. Here's an article I wrote on that subject, although it was related to industrial control systems: https://blog.shodan.io/taking-things-offline-is-hard/ https://blog.shodan.io/taking-things-offline-is-hard/
- asdfasgasdgasdg 6y ago
  I certainly think the most legal approach is to do nothing except notify, or maybe nothing at all. But if you must modify the database, locking it reversibly is more defensible morally.
  - 908087 6y ago
    A large portion of your notifications would go ignored, and some portion of your notifications would likely trigger the owners of those databases to go on the attack against you.
cheerlessbog 6y ago
Or just set everyone's password to the same thing eg SecureMe

phkahler 6y ago

>> but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? No. The equivalent would be exploiting their buildings weakness to cause them to collapse - maybe with people in them. Pointing out a vulnerability is not the same as demonstrating it. That said, a demonstration will get their attention more.

octodog 6y ago

Your comparison isn't fair - blowing the whistle is supposed to be a last resort. Internal disclosure and attempting to fix the issue collaboratively is always the first step. This attack is indiscriminate and is without warning, so it eliminates the possibility for database owners to fix the problem in good faith.

zentiggr 6y ago
Finally, after years and years and years of being told over and over and the bottom line never improving. I got doxxed with the Equifax breach. How many other companies in the world will take someone's word that they are me based on that data, and what potential is there for my life amongst millions of others to go completely sideways because of companies who won't addmit the systems are broken? I say the house is already burning, but maybe throwing some fireworks into the blaze will convince the right parties to finally put the damn fire out. Beyond sick and tired of breach after breach after breach after "oh, there were millions of voter records showing publicly" "no, <insert product name> defaults to no security"