Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by herpderperator on Thursday June 24, 2021 @01:47AM (#27614353)

I'm sorry that you have to go through this, it seems inevitable these days. However, while it's nice that you're sharing your analysis of the situation, you start off by downplaying the attack and calling them a script kiddie. If for example someone finds out they can brute-force Facebook's 6-digit password reset token because they didn't put any rate-limiting in[0], are they a hacker? Is there major skill involved in doing so or just a million-iteration loop to go through all the combinations? They received a $15,000 payout indicating that Facebook values their mistake seriously (although I'd say it's worth much more given it's a guaranteed full account takeover.) So regardless of what you think of the attack, easy or not, you still made a security mistake and you should admit that first and foremost rather than brushing it off as a "script kiddie situation".

Other than that, it's commendable that you have working backups and are responding calmly and with a plan. I hope you get everything back in working order smoothly :)

[0] https://www.theverge.com/2016/3/8/11179926/facebook-account-...

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by black3r on Thursday June 24, 2021 @02:48AM (#27614645)

hackers start with a target and try to find a vulnerability. script kiddies start with a vulnerability and try to find sites vulnerable to it. it's not about the skill involved in making the exploit, it's about the effort around that.

the case you mention is more of a hacker feat because that exploit had to be crafted specifically for facebook. meanwhile in this case it was most probably someone who just continuously scans the IPv4 address space for open mongo instances and applies the same generic "exploit" against them if it finds some in a fully automatized process

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by hutzlibu on Thursday June 24, 2021 @03:53AM (#27614996)

" script kiddies start with a vulnerability and try to find sites vulnerable to it. it's not about the skill involved in making the exploit, it's about the effort around that."

The terms get clouded a bit - but in my definition a "script kiddie" is pretty much this: someone with not much skill(like a kid), but hands on some hacker tools/scripts - to find easy targets and feel powerful. And later on, try to make some money.

And they can make great effort in doing so - but they remain script kiddies. They don't really know how to hack.

Whether this was just a "script kiddie", I doubt. More a professional ransomware gang. But what op probably meant was, it was not a targeted attack.

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by tommica on Thursday June 24, 2021 @02:20AM (#27614524)

I think the "script kiddie situation" comes from the part of trying to ransom the data

[ Parent | on HN ]