These MongoDB instances weren't exposed due to whatsoever flaw inwards its software, merely due to a misconfiguration (bad safety practice) that allow whatsoever remote assailant access MongoDB databases without using whatsoever particular hacking tool.
MongoDB afterwards resolved the consequence inwards the adjacent version of its software past times setting unrestricted remote access past times default inwards the configuration, thousands of site administrators convey non updated their servers yet.
But trust me, they'll instantly regret this!
Influenza A virus subtype H5N1 Hacker is instantly hijacking in addition to wiping out unsecured MongoDB databases, merely keeping a re-create of those databases for quest administrators a ransom of 0.2 Bitcoins (nearly US$211) to render the lost data. So, admins without backups are left inwards a bind.
In fact, the rising cost of Bitcoin fifty-fifty hints at some of its troubles. At the fourth dimension od writing, 1 Bitcoin = USD1063.93.
Security researcher in addition to co-founder of the GDI Foundation Victor Gevers (@0xDUDE) discovered the attacks in addition to notified exposed non-password-protected MongoDB installations to owners via Twitter.
Gevers identified nearly 200 instances of a MongoDB installation that's been erased in addition to held for ransom, field this publish reached roughly 2,000 databases equally of 4:00 p.m, equally reported past times John Matherly, the Founder of Shodan, where many exposed MongoDB databases tin privy live on found.
These attacks convey been going on for over a week, targeting servers all over the world. It is believed that instead of encrypting the data, the assailant who goes past times the cite "harak1r1," ran a script that replaced the content of the database amongst the attacker's ransom note.
While accessing i of the opened upward servers, Gevers constitute that inwards house of the database content, at that spot is alone i table, named "WARNING," which reads:
"SEND 0.2 BTC TO THIS ADDRESS 13zaxGVjj9MNc2jyvDRhLyYpkCh323MsMq AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !"
xvi Victims Already Paid the Ransom
It appears that about xvi organizations thus far convey paid the ransom to the attacker.
Matherly has been exposed MongoDB installations since 2015, allowing an assailant to remotely access the databases over the Internet without the demand of whatsoever cast of authentication.
Matherly said the bulk of publicly exposed 30,000 MongoDB instances run on cloud servers such equally Amazon, Digital Ocean, Linode, in addition to Internet service in addition to hosting provider OVH in addition to produce thus without authentication, making cloud services buggier than datacenter hosting.
How to Know if You've Been Hacked?
- Check the MongoDB accounts to run into if no i added a cloak-and-dagger (admin) user.
- Check the GridFS to hold off if soul stored whatsoever files there.
- Check the log files to run into who accessed the MongoDB.
How to Protect Yourself?
- Enable authentication that provides you lot 'Defense inwards depth' if your network is compromised. Edit your MongoDB configuration file — auth = true.
- Use firewalls — Disable remote access to the MongoDB, if possible. Admins are advised to purpose firewalls to protect the MongoDB installations past times blocking access to port no. 27017.
- Configure Bind_ip — Limit access to the server past times binding local IP addresses.
- Upgrade — Administrators are strongly recommended to upgrade their software to the latest release.
