During the Meow attack, around 4000 publicly available Elasticsearch and MongoDB databases were deleted.

The attack “Meow” continues to gather pace, during which unknown perpetrators are destroying data in publicly accessible unprotected installations of Elasticsearch and MongoDB. Isolated cases of data erasure (accounting for about 3% of all victims) have also been recorded for unprotected databases based on Apache Cassandra, CouchDB, Redis, Hadoop, and Apache ZooKeeper. The attack is being carried out through a bot that scans standard network ports of the DBMS. Examination of the attack on a decoy honeypot server showed that the bot connects is performed via ProtonVPN. While around 1000 remote databases were recorded on July 22, the number of affected systems tripled. rose to approximately 2500 on July 23, and yesterday has exceeded hit the mark of 3800, but has decreased today to 3750.

The cause of the problems is the opening of public access to the database without proper authentication configuration. By mistake or carelessness, the request handler is attached not to the internal address 127.0.0.1 (localhost), but to all network interfaces, including external ones. In MongoDB, this behavior is facilitated by default configuration settings, and in Elasticsearch, prior to the release 6.8 in the free version, access control mechanisms were not supported at all.

An example is story with the VPN provider UFO, which was found to have a publicly accessible Elasticsearch database of 894GB. The provider positioned itself as one that cares about user privacy and does not keep logs. Contrary to the statement, the exposed database contained logs including information about IP addresses, session ties to time, user location tags, operating system and device information, and lists of domains for injecting ads into unprotected HTTP traffic. Moreover, the database contained access passwords in plain text and session keys that allowed intercepted sessions to be decrypted.

The UFO provider was informed of the issue on July 1, but for two weeks the message went unanswered, and on July 14 another request was sent to the hosting provider, after which on July 15 the database was secured. On July 20, the database reappeared in public access at another IP. Within a few hours, almost all data in the database was deleted. Analysis of this deletion showed that it was related to a mass attack known as Meow, named after the indexes left in the database after deletion. Searching through the Shodan service showed, which means that several hundred more servers also fell victim to the deletion. The number of deleted databases is now approaching 4000.

Source: opennet.ru