Hacker News Reader

Comment by aboutruby | Hacker News Reader

For fun:

- I see 67,569 mongodb results on shodan

- I searched for shodan API keys on a shady website known as "Github", found one that works, queried for all the mongodb databases

- Tried connecting on the first one, it works...

- What next?

edit: I guess it's a choose your own adventure game:

1) Delete all the data

2) Look up domains from IPs, find owner's emails and email them

3) Make nice stats about all the data

4) Sell the data on the black market

5) Find user's emails, and tell them they are using a service that just doesn't care

6) Just make every ~third integer off by 1

7) Mine bitcoins on them

... So many ideas, so little time

View on HN

As much of a game as it may seem, a lot of these could put you in prison.

I will go with "Let it be, hoping someone does something about it someday somehow"

Depending on your country, just loading that first one up to see if it worked could put you in prison.

In the United States, simply accessing a publicly accessible URL can put you in prison, assuming the government doesn't lose the appeal on the technicality of a choice of venue, which they won't do a second time... https://www.eff.org/press/releases/appeals-court-overturns-a...

He was convicted by a jury of his 'peers'.

My biggest problem with the justice system.

Do any of us really trust our peers?

Who would you prefer to be on the jury?

That's a much harder question and one I don't claim to have an answer to. It doesn't change the fact that I don't trust my peers. I don't trust your average American to be informed enough and educated enough to make decisions about my life. Jury of peers might as well be trial by mob.

Well, it's better than a trial by your accuser.

Not just peers, peers who didn't get out of jury duty.

Personally I think jury duty should just be mandatory (with the only exceptions being extreme circumstances) because it being so easy to get out of creates a major bias in the set of people actually doing jury duty.

As well it should.

Comparable activity: let's ride around the neighborhood and see who hides a key under a rock. Then let ourselves in and look around.

Physical analogies for security like the one you just made are useless because they don't reflect how the computers and the internet work. You can't just ping a rock and ask it if it's got a key. The rock isn't expected to exist in a world where some script kiddie in China is going to ask it if is has a key every 5min. The analogy simply falls flat on its face once you try to use it to reason about anything because existing as an internet connected device is far different than existing on private (but easily accessible) property.

If you'll refer to what I was replying to, I wasn't talking about physical security being analagous to digital security. I was saying it is illegal to attempt to open and access property that you do not own.

"Let's ride around the neighborhood and see who left all their belongings in their front yard" would be a closer example.

Imagine if your Doctor left your personal medical records lying on the ground in front of their office...

That's an absurd analogy. How are you supposed to know if a completely unauthenticated URL is meant to be private or not?

If we're going to try to force physical analogies to represent the digital, I would say it's more like every store, house, and public building looks exactly the same and you don't know if the door is locked or what's inside it until you try to open it.

I wholeheartedly disagree, despite the down votes in this community. The act of attempting to open it is what is illegal, in both situations.

You have a person cruising for keys to a house and a person cruising for keys to databases. They own neither.

But if a database is unsecured, how do you know it's not meant to be publicly accessible?

Your point is good of course, but I think the question has already been answered in society. If you aren't explicitly allowed into someone else's property, you aren't allowed.

It's not analogous because in internet protocols the server has to actively send the "property" in response to a specific request to access it. If a request is made and a response freely given with no further authentication required then it is a stretch to compare this to coming onto someone's property without invitation. Perhaps if one is accessing unauthenticated services on a private network this analogy would sort of work, but the assumption is that if you run a service that responds to random requests on the public internet you intended the responses to be public. It is more like an owner hiring someone to stand on their property and invite people in then complaining that they gave their employee poor directions and faulting the public for trespass.

I'm allowed to look at property from the street. There's nothing stopping me from walking around the neighborhood looking into everyone's property. I can even walk up to the house in most cases, and peering into windows is usually legal as well. I would even argue that trying the doors is also legal, though entering is probably illegal in most areas.

Accessing a URL is like walking around the neighborhood looking from the street. Trying different URLs is like peering into windows. Trying the door is like testing default credentials.

To make something a crime, you need to prove some kind of loss as well as intent. If there's no intent, it's likely a civil case to get restitution (e.g. you won't arrested for breaking something in a store accidentally). Likewise, you could get arrested for intent without loss (e.g. tried to break something in a store, but failed).

IMO, it should only be illegal if there's intent to harm. Likewise, if you accidentally harm something without intent (e.g. accidentally DOS a server), you should be expected to make restitution. Both need to be proven in a court of law, criminal if there's intent, civil if there isn't, and if there's no harm or intent, there's no crime.

I wouldn't try to use physical property as an analogy. You can't even see what properties there are until you enter them. If the door wasn't locked you won't know until you're already inside.

Here's an analogy I think is closer: I ask you for all your personal documents and bank account numbers. You promptly give them to me with no questions asked. Was I accessing private property improperly? If you refused and demanded I identify myself as someone authorized to have access, and then I forcibly took them from you anyway, that would be criminal.

Web addresses aren't property, I think that's the wrong analogy. The web is made of requests and responses, and you don't know what response you'll get until you make the request.

The canonical approach seems to be "encrypt the data in place, ask for Bitcoin"

boring. Configuring them all as a replica of each other is more fun

Generate records in them containing "Help, I'm trapped in the MongoDB development building and food is running out!" every couple of month :)

I'm actually curious why this wasn't done yet, or maybe I'm missing something

Reply on news.ycombinator.com