News for hackers. Stuff that matters.

A comment on Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage. Parent comment

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by python273 on Thursday June 24, 2021 @02:14AM (#27614504)
The same thing happened to me a few years ago. I used DigitalOcean's Docker image and it had some message about UFW in motd, so I assumed it works with Docker. So I created a container with passwordless mongodb and it got wiped in a few hours.

And DO still have this in motd for newly created droplets:

  Welcome to DigitalOcean's 1-Click Docker Droplet.
  To keep this Droplet secure, the UFW firewall is enabled.
  All ports are BLOCKED except 22 (SSH), 2375 (Docker) and 2376 (Docker).
Full motd: https://pastebin.com/cdaecHU8

Though it links to https://do.co/3j6j3po and it mentions ufw problem:

> Note: The default firewall for the Docker One-Click is UFW, which is a front end to iptables. However, Docker modifies iptables directly to set up communication to and from containers. This means that UFW won’t give you a full picture of the firewall settings. You can override this behavior in Docker by adding --iptables=false to the Docker daemon.

[ Parent | on HN ]
Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by jbuhbjlnjbn on Thursday June 24, 2021 @03:39AM (#27614905)
So the makers know of the security issue, but still leave it in by default? That's bad. Either fix the issue, or put warnings all over the place that cannot be missed to inform the user.

This is just what another poster commented on, sacrificing security for ease of use.

[ Parent | on HN ]
Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by python273 on Thursday June 24, 2021 @04:37AM (#27615205)
Yeah, I reported it to DO support and suggested to add a warning, but seems like it was never added.

  DigitalOcean Support Thursday, March 15, 2018 9:53 PM
  Hello,
  
  Thank you very much for bringing this to our attention.
  
  I will create an internal escalation to our images team to review this. :)
  
  [...]
[ Parent | on HN ]