News for hackers. Stuff that matters.

A comment on Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage. Parent comment

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by dawnerd on Thursday June 24, 2021 @12:40AM (#27614044)
Yeah - kinda crazy theres no auth by default AND eval is allowed. Pretty trivial for someone to have it download a script and run it pretty much with free reign.
[ Parent | on HN ]
Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by slavak on Thursday June 24, 2021 @01:15AM (#27614193)
Redis doesn't accept unauthenticated external connections by default for a while now, specifically to try and eliminate this footgun.

https://github.com/redis/redis/commit/edd4d555df57dc84265fdf...

[ Parent | on HN ]
Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by SilverRed on Thursday June 24, 2021 @01:20AM (#27614221)
I had an issue where I used the redis docker image and didn't understand docker networking properly so I set the network mode as host so my other container could connect. Not knowing this had exposed redis to the world unauthenticated (in about 2018).

Eventually a kind script set a password on redis which caused me to notice and fix this issue.

[ Parent | on HN ]
Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by dawnerd on Thursday June 24, 2021 @01:19AM (#27614214)
Interesting, this definitely happened with a more recent version... Wonder if theres some other exploit at play too (could also be the containerized version?)
[ Parent | on HN ]