New ‘Meow’ attack has wiped thousands of unsecured databases

guest · Jul 22, 2020

New ‘Meow’ attack has wiped dozens of unsecured databases
July 22, 2020
https://www.bleepingcomputer.com/ne...tack-has-wiped-dozens-of-unsecured-databases/

Dozens of unsecured databases exposed on the public web are the target of an automated 'meow' attack that destroys data without any explanation.

A quick search by BleepingComputer on the IoT search engine Shodan has found dozens of databases that have been affected by this attack.
These attacks have pushed researchers into a race to find the exposed databases and report them responsibly before they become 'meowed.'
Click to expand...

Cat's out of the bag
The most recent publicly known example of a Meow attack is an Elasticsearch database belonging to a VPN provider that claimed not to keep any logs.
He says that the attack appears to be an automated script that “overwrites or destroys the data completely.”

Victor Gevers, the chairman of the non-profit GDI Foundation, saw this type of attack, too. He says that the actor is also attacking exposed MongoDB databases, hitting as much as they can.

“It is becoming a race to find these leaks as early as possible. This reduces the amount of time that can be spent on researching and reporting” - Victor Gevers
Click to expand...

Whoever is behind the 'meow' attacks is likely to keep on targeting unsecured databases, aggressively destroying them. Administrators should make sure that they expose only what needs to be exposed and make sure the assets are properly secured.
Click to expand...

mirimir · Jul 22, 2020

Isn't this at least partly a good thing? And for VPN logs, I really can't see the downside.

guest · Jul 25, 2020

mood said: ↑

New ‘Meow’ attack has wiped dozens of unsecured databases
July 22, 2020
https://www.bleepingcomputer.com/ne...tack-has-wiped-dozens-of-unsecured-databases/
Click to expand...

Updated (July 25, 2020):

07/25 Update: The Meow attacks continue to escalate with almost 4,000 databases deleted as of Saturday, July 25th.

A new search on Saturday using Shodan shows that more than 3,800 databases have entry names matching the 'meow' attack. More than 97% of them are Elastic and MongoDB.
While it is still not known why the threat actors are wiping databases, a security researcher named Anthr@X discovered that the attacks are being conducted via ProtonVPN IP addresses.
Click to expand...

Obstructing researchers
If behind these incidents are positive intentions, sometimes nothing good comes out of them and valuable data that could be lost in the process.

Data leaks from unsecured MongoDB and Elasticsearch instances reachable over the public internet are on a descending curve, but there is still some “very sensitive” information exposed.

As Gevers puts it, “some leaks bring bad things to the light, which need to be shared,” and wiping them brings benefits to no one.
Click to expand...

BoerenkoolMetWorst · Jul 26, 2020

mirimir said: ↑

Isn't this at least partly a good thing? And for VPN logs, I really can't see the downside.
Click to expand...

Now if they would wipe student debt databases

mirimir · Jul 26, 2020

As I recall, the goal in Fight Club was destroying data systems of credit card companies. But it wasn't realistic, because you'd also need to get the backups.

guest · Aug 7, 2020

Five ways to declaw the Meow bot
August 6, 2020
https://www.scmagazine.com/home/security-news/database-security/five-ways-to-declaw-the-meow-bot/

While the motivation behind the “Meow” bot attacks is unknown, the menace is still out there wiping out open source databases left unsecured on the internet, prompting Elastic to offer clear steps that organizations can take to safeguard their data.

The bot came on the scene about two weeks ago when it was reported that it wiped out more than 1,000 open source databases, mostly on ElasticSearch and MongoDB. The bot clears out a database, only leaving the word “Meow” in the file.
Although Josh Bressers, head of product security at Elastic, did not want to speculate on the nature of the attack, he said it was not the work of a nation state or a hacktivist nor was it financially motivated.

“Nobody has claimed responsibility,” Bressers said. “Basically they spray across the internet and randomly delete databases.”
Click to expand...

In a blog post Bressers laid out some steps security teams can take to secure their data, [...]
Because Elastic sets security for customers by default, none of the company’s paid customers’ databases were wiped out in the Meow attacks, Bressers said.
Click to expand...

Log in or Sign up

New ‘Meow’ attack has wiped thousands of unsecured databases

guest Guest

mirimir Registered Member

guest Guest

BoerenkoolMetWorst Registered Member

mirimir Registered Member

guest Guest

Log in or Sign up

New ‘Meow’ attack has wiped thousands of unsecured databases

guest Guest

mirimir Registered Member

guest Guest

BoerenkoolMetWorst Registered Member

mirimir Registered Member

guest Guest

Useful Searches