Comment by conesus | Hacker News Reader

Comment by conesus | Hacker News Reader

Parent Full thread

In case anybody's interested, here's what the "hack" looks like:

    nbset:PRIMARY> show dbs
    READ__ME_TO_RECOVER_YOUR_DATA   0.000GB
    admin                           0.000GB
    local                          16.471GB
    newsblur                        0.718GB
    
    nbset:PRIMARY> use READ__ME_TO_RECOVER_YOUR_DATA
    switched to db READ__ME_TO_RECOVER_YOUR_DATA
    
    nbset:PRIMARY> show collections
    README
    system.profile
    
    nbset:PRIMARY> db.README.find()
    { "_id" : ObjectId("60d3e112ac48d82047aab95d"), "content" : "All your data is a backed up. You must pay 0.03 BTC to XXXXXXFTHISGUYXXXXXXX 48 hours for recover it. After 48 hours expiration we will leaked and exposed all your data. In case of refusal to pay, we will contact the General Data Protection Regulation, GDPR and notify them that you store user data in an open form and is not safe. Under the rules of the law, you face a heavy fine or arrest and your base dump will be dropped from our server! You can buy bitcoin here, does not take much time to buy https://localbitcoins.com or https://buy.moonpay.io/ After paying write to me in the mail with your DB IP: FTHISGUY@recoverme.one and you will receive a link to download your database dump." }

> you face a heavy fine or arrest

Heavy fine yes but not arrest AFAIK. Anyway this is a script programed to scary the target.

Do you even store personal data inside that database?

From their Twitter feed: mongodb is just RSS feed data, personal data is in postgres and wasn’t accessible to the script kiddy

And would you take that statement at face value from a company that just left their docker based mongo instance Internet public? It’s safe to assume that your info has already been leaked, but situations like this are why that assumption is safe.

I suppose we'll find out if/when the data will be leaked as the hacker claims?

If you give out your personal information to, for example, newsblur- the odds are very, very good that this wasn’t the first time you’ve entrusted a company to protect your privacy, and whether you realize it yet or not- you have already been sorely disappointed.

> Heavy fine yes but not arrest AFAIK.

Newsblur is an American org. GDPR is a foreign law that has no relevance to American firms lol.

<insert Saruman "you have no power here" meme>

> GDPR is a foreign law that has no relevance to American firms lol.

I couldn't agree more with the spirit of your comment, but sadly the reality may be somewhat more nuanced:

GDPR in the USA https://www.cookiebot.com/en/gdpr-usa/

"The GDPR has extra-territorial scope, which means that websites outside of the EU that process data of people inside the EU are obligated to comply with the GDPR. ... In fact, the very first GDPR enforcement was against a Canadian company... being a website in the US does not exempt you from GPDR compliance and the territorial distance will not protect you from its enforcement either."

Reminded me of:

CISA amendment would allow US to jail foreigners for crimes committed abroad https://www.theguardian.com/technology/2015/oct/22/cybersecu...

There's no sadly here, it's the opposite. In your world Facebook could still abuse European's privacy.

In my world, I would not be committing a crime if I, someone who has never stepped foot in Asia, criticised the Chinese Govt.

https://www.axios.com/china-hong-kong-law-global-activism-ff...

In other news, a company selling a GDPR compliance service is trying to scare companies into buying their service. Shocking to see!

In reality, a US business with no EU presence only has to follow US laws. The only "enforcement" power the EU has would be to order the website to be blocked in the EU, and I'm pretty sure they can't even do that.

There's something about this threat that really is awful. The legal extortion angle. We'll turn you over to the regulator if you don't give us money. Aside the fact they can take the money and package you to the regulator anyway, with complete impunity, it seems like the regulation needs to be revised in some way to take this very serious threat out of the hands of people who will abuse it.

This is just an another reason why user data should be dealt with very carefully, not a reason to nerf the legislation designed to dissuade people being careless.

Agree with user and customer data being handled with care, but I do not like seeing criminals using the law to further a criminal enterprise. That is problematic.

This is horrific. So the hacker is claiming to have a copy of our data. 0.03 BTC is less than $1000. Regardless of you being able to restore from backups, I assume you're paying the ransom to hopefully avoid the leak, right?

Paying a ransom marks you as will-pay. The price will keep rising till they find your limit.

The data is already leaked, let your users know what was leaked and recover from there.

See also: 80% of orgs that paid the ransom were hit again https://news.ycombinator.com/item?id=27552611

You misunderstand.

I paid Samuel and entrusted him with my data. Not too much, but enough for it to matter. When faced with a massive leak like this, he downplays everything, calls the hacker a "script kiddie" and calls this "good practice for what will be the first of many sleepless nights", looking at it only from a "service disruption" perspective.

So far we've gotten no indication of what's been leaked, if it contains deleted feeds, or what he's doing to prevent the data from being leaked by the hacker, if anything. He's been solely focused on restoring the service and ignoring the leak. Compared to not having access to an RSS reader for any random period of time, the leak is orders of magnitude more serious to me and I'd wager to most of Newsblur customers.

I honestly don't care if paying a ransom or interacting with the hacker makes him more likely to be targeted in the future, his duty towards his customers was to keep their private data private and not only he failed at that, but he doesn't even seem to register that as his main priority. As far as I'm aware, if he allows the data to leak publicly, then there's no "recovering from there", he's not getting any more of my money.

I'm on the same side of the argument as you and indeed I believe I feel as strongly about it as you. Especially in regards to brushing it off, calling them script kiddies[1], generally being "well aw shucks aren't I great for not deleting my copy of the data, I'm so great"[2] about the whole thing grinds my gears too.

I'm saying whoever is ransoming the data already has the data, the data is out of Newsblur's control, therefore the data is already leaked.

The data leak is past tense. It has already happened, not will happen. No amount of money will undo that. If that means they've lost you as a customer, that's how it is.

What we now need to know is what data was leaked?

[1]: which to be fair Newsblur, they are, but if a script kiddie hacks you using something so basic as a missing firewall rule.. Arguably not knowing Docker's quirks but using it anyway is the same damn thing as what script kiddies do. Sys kiddie if you will.

[2]: Why is that cause for celebration? Do you not have backups?

There is a material difference to users between a single attacker having (and possibly ignoring) a data dump, and that attacker publishing that dump publically, or selling it to someone who plans to exploit its contents.

The attacker has offered to not publish if they are paid. Their word probably isn't worth much, but $1,000 seems like an affordable sum for a business to gamble on them being honest about it. And if Newsblur doesn't fix their security problems they'll be targeted again either way.

As someone who has a decade of data in Newsblur, if there's any chance that an affordable ransom will keep my data from spreading further I want Samuel to take it.

The fact that you believe paying the ransom is even an option shows that you really aren't even qualified to be discussing this topic. People with your mindset are a big part of the reason that ransomware is still going strong. The other big part is people who don't run their systems correctly in the first place.

Giving them $1000 confirms the value, allowing them to list the dump at a higher price than the usual $10-50 spammers would pay (each) for the email addresses alone

Looks like this is an automated campaign:

https://www.shodan.io/search?query=READ__ME_TO_RECOVER_YOUR_...

People used to break into systems because they were smart and curious, now we've got these fucking cockroaches holding people ransom.

This happened to us on a test DB as well and from what we've seen on the network traffic they was not much there, less than 1MB or something. So you can be sure they have not stored your data and you will not be able to recover anything. Pretty expected from someone who only ask so little.

0.03 BTC?! Someone is doing this for a lousy thousand dollar? Unbelievable.

> Unbelievable

Really? If they ask 100K dollars they are probably not going to be paid. So, just hijack 100 servers and assure that they will pay (since 1K dollars is "not" much if you are running a business).

Curious this got downvoted so quickly, maybe your "hacker" is among us now!

Have you contacted the relevant authorities?

What happened to your service is the security equivalent of the scholar's mate. It's important to be able to lose with dignity and move on.

Your adversary was unsophisticated but this incident was your fault.

"XXXXXXFTHISGUYXXXXXXX" is right lol

Reply on news.ycombinator.com