Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage
NewsBlur&#x27;s founder here. I&#x27;ll attempt to explain what&#x27;s happening.<p>This situation is more of a script kiddie than a hacker. I&#x27;m in the process of moving everything on NewsBlur over to Docker containers in prep for the big redesign launching next week. It&#x27;s been a great year of maintenance and I&#x27;ve enjoyed the fruits of Ansible + Docker for NewsBlur&#x27;s 5 database servers (PostgreSQL, MongoDB, Redis, Elasticsearch, and soon ML models).<p>About two hours before this happened, I switched the MongoDB cluster over to the new servers. When I did that, I shut down the original primary in order to delete it in a few days when all was well. (Thank goodness I did that! It&#x27;ll come in handy a few hours from now).<p>Turns out the ufw firewall I enabled and diligently kept on a strict allowlist with only my internal servers didn&#x27;t work on a new server because of Docker. When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world. So while my firewall was &quot;active&quot;, doing a `sudo iptables -L | grep 27017` showed that MongoDB was open the world. More info on SO[1].<p>To be honest, I&#x27;m a bit surprised it took over 3 hours from when I flipped the switch to when a script kiddie dropped NewsBlur&#x27;s MongoDB collections, and ransomed about 250GB of data. I am now running a snapshot on that old primary, just in case it reconnects to a network and deletes everything. Once done, I&#x27;ll boot it up, secondary it out, and be back in business. Let&#x27;s hope my assumptions hold.<p>[1]: <a href="https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;30383845&#x2F;what-is-the-best-practice-of-docker-ufw-under-ubuntu" rel="nofollow">https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;30383845&#x2F;what-is-the-bes...</a>