Slashdot Mirror
Over 1,800 MongoDB Databases Held For Ransom By Mysterious Attacker (bleepingcomputer.com)
An anonymous reader writes: "An attacker going by the name of Harak1r1 is hijacking unprotected MongoDB databases, stealing and replacing their content, and asking for a 0.2 Bitcoin ($200) ransom to return the data," reports Bleeping Computer. According to John Matherly, Shodan founder, over 1,800 MongoDB databases have had their content replaced with a table called WARNING that contains the ransom note. Spotted by security researcher Victor Gevers, these databases are MongoDB instances that feature no administrator password and are exposed to external connections from the internet. Database owners in China have been hit, while Bleeping Computer and MacKeeper have confirmed other infections, one which hit a prominent U.S. healthcare organization and blocked access to over 200,000 user records. These attacks are somewhat similar to attacks on Redis servers in 2016, when an unknown attacker had hijacked and installed the Fairware ransomware on hundreds of Linux servers running Redis DB. The two series of attacks don't appear to be related.
a passwordless admin interface exposed to the internet? the only story here is why it didn't happen earlier
Your database is exposed to the internet and doesn't have a password? How is it you are still employed?
-- Will program for bandwidth
... asking for 0.2 Bitcoin ($200) ransom
That seems like a modest ransom. At least he isn't greedy.
MongoDB attacks are Web Scale.
Momentarily, the need for the construction of new light will no longer exist.
If there was a CVE assigned for every stupid mongodb admin, they'd have blown Android out of the water.
You do NOT put your database on the internet! Opening your mongodb to the internet does NOT make it webscale!
Those pesky Russians are at it again.
> To this day, I fail to understand the hypocrisy in supporting the little guy against giants like Apple and Microsoft, but rooting for another giant, IBM, to decimate SCO.
Some of us pay attention to who is right and wrong, rather than deciding absolutely everything based on "big mean corporation."
SCO originally filed for misappropriation of trade secrets and unfair competition. Later, they decided breach of contract might be better. Still later, they decided maybe copyright infringement. Obviously, SCO wasn't so sure exactly what they were complaining about - not nearly as sure as you are.
They claimed that up to 0.0001% of the Linux kernel might have been derived from Unix, but refused to say which parts. As the judge began to strike down their claims unless they identified which code they were talking about, they pointed to some BSD licensed code written by Thompson - code they clearly had no copyright rights to.
When it was pointed out that Novell, not SCO, owned the Unix copyright, SCO tried to buy the copyrights from Novell. Again, Novell clearly wasn't too sure they owned the copyrights, they were trying to buy them from Novell, yet you're sure that they already owned them.
SCO then claimed that the GPL itself is illegal and unconstitutional! Which would of course mean that SCO were themselves unlawfully distributing GPL code! Yeah that annoyed some people.
SCO didn't just lose a case, they were laughed out of court repeatedly. "We're suing you for violating the copyright on Unix, but we're still trying to buy that copyright so can we have a short delay?" What!?!? It was one of the most ridiculous cases ever. That's why people didn't root for SCO, it was because SCO was engaging in ridiculous trolling that made no sense. They argued that the "offending code" was part of the Linux kernel, then argued that it wasn't. They couldn't even make up their mind.
Fuck these ransom guys. Keeping good backups is a little bit of extra work, but at least you have the option to restore, even if you've been hacked because of gross negligence / shameful ignorance / plain stupidity like this.
The idiot developers that want everything in [ insert the name of your currently favorite dev language here ] including security!
They all want a single, or better yet, no username and password on the db in question! When will the developers EVER learn, anything
Hey KID! Yeah you, get the fuck off my lawn!
You are not wrong
Good thing my copy of dBASE5 still runs like a charm under dosbox and is impervious to all this web crap. Clipper still works like a charm too ...
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
The Mongols motorcycle club have been at war with the Hells Angels for years. This might be an attempt at attacking their members.
This is equivalent to the facilities guy at work installing new doors with no locks and then a thief putting locks on all the doors with a note to pay him $200 to get the keys to the new locks; it is almost a public service in this case. Heads should roll for this stupidity, though most at the executive level have such a poor understanding of good security practices who knows.
If you disagree, please post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like
https://www.youtube.com/watch?...
It is a reflection of the software development methodology in general. MongoDB is supposed to be fast... like taking a car, yanking all the seats, the windows, the doors, the hood and trunk, all but one brake pad, and saying that it is a performance monster. Of course, the fact that it has been rendered worthless for tasks that need audibility and security is beside the point.
Wow, someone who wants to race to the bottom even quicker. Then again, what can you expect from an AC?
Technically if they had configured the security there wouldn't be a problem.
Provably false, because it is impossible to anticipate every security problem, especially since you're trying to hit a moving target. Never been done, can't be done within the heat death of the universe.
Web enabled is inevitable
Only if you're someone who wants to really screw over users, with things like all-time connections required, downloadable content, adware, etc. Local networks did just fine for a LONG time for all sorts of business applications, and both standalone and local networks for things like games and other forms of entertainment. You show the lack of imagination given by not knowing history. The internet is a symptom, and has caused more harm than good for the average person. Fake news wouldn't be possible without stupidity like Failbook and Twithead.
Honestly the economy sucks, jobs are scarce and the web offers the possibility of breaking barriers by giving the average joe global reach
First, there is a limited demand for internet-enabled jobs, and already far too many people trying to fill that demand, which is why most intenet-based jobs pay less than minimum wage by the time you account for everything. Second, we're seeing the beginning of the bursting of the second internet bubble. You can't eat virtual pizza, your bitcoin is a terrible form of currency (as seen by the 18% drop in value in 5 days, the vast majority of "App developers" still make far less than the minimum wage and that has always been the case, and always will be, because people always hope that they will be the exception.
If you want to compete with developers in India, you'll end up with their standard of living - which means a country where, like India, there are so many people without a toilet (indoor OR outdoor) that they could literally form a line from the earth to the moon - something that will NOT change over the next 40 years because poverty is both ingrained in the corruption and class structure, and because the reservoir of poverty is just too large - and of course it doesn't help that India will have more people than China in 5 years.
Also, your "ground breaking technologies" are not. Most of the "new technologies" are shit, same as ruby used to be the latest hotness. Anything based on javascript is inherently worse than Flash - at least flash doesn't need a web browser to run in, and can be easily confined either to the local machine or local network. It also requires far less ram and cpu to do the same job. This is the problem with so many of the "new technologies" - holier than swiss cheese, layered upon other layers that are also full of bloat and rot (even Flash was bloat, but nowhere near as bad as, say, chrome or firefox).
We can exist fine without the internet. Specialized networks with limited access, non-interchangeable protocols, devoted to specific tasks, are going to happen, if only because the current internet is defective by design when it comes to security - the original goal was to be as failsafe as possible, no matter how much of the intervening network was destroyed - but that also means that any node can always attack anyone and everyone. Heck, it was possible at the dawn of the internet to take Microsoft down with a dial-up modem and a 386.
Society started failing when trickle-down economics and both the left and the right started ignoring economic disparity (which includes the Clintons even before he became president, having helped dismantle some of the new deal economic protections that actually allowed the economy to grow by growing the base instead of feeding the rich - a policy Obama continued by, among other things, bailing out the car companies and
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
This is the result of poor decision making, but a hack like this is even easier with Elasticsearch.
Unless you pay for a license, Elasticsearch doesn't even offer something as simple as user/password authentication.
Seriously.
Kriston