MongoDB Ransack – Over 33,000 Databases Hacked

Keep on Guard!


Ah our favourite database in the news again, being hailed as the MongoDB Ransack a whole bunch of people have turned the insecure MongoDB default configuration into a ransom opportunity. They are deleting/stealing databases and soliciting bitcoin payments to return the data.

MongoDB Ransack - Over 33,000 Databases Hacked

With multiple actors doing the same stuff though it’s hard to know who is legit, and it seems some are just deleting the databases and asking for payment without even having the data.

MongoDB databases are being decimated in soaring ransomware attacks that have seen the number of compromised systems more than double to 27,000 in a day.

Criminals are accessing, copying and deleting data from unpatched or badly-configured databases.

Administrators are being charged ransoms to have data returned. Initial attacks saw ransoms of 0.2 bitcoins (US$184) to attacker harak1r1, of which 22 victims appeared to have paid, up from 16 on Wednesday when the attacks were first reported.

However, some payments could be benign transfers designed to make it appear victims are paying.

Norway-based security researcher and Microsoft developer Niall Merrigan says the attacks have soared from 12,000 earlier today to 27,633, over the course of about 12 hours.

Merrigan and his associates have now logged some 15 distinct attackers. One actor using the email handle kraken0 has compromised 15,482 MongoDB instances, demanding 1 bitcoin (US$921) to have files returned. No one appears to have paid. Merrigan says he is investigating “OSINT and finding different IOCs as well the actors involved”.


It’s not the first time we’ve talked about this too, back when BeautifulPeople.com was hacked it was due to MongoDB and it’s great defaults (listening on all interfaces, including public Internet-facing IP addresses) and not forcing any kind of authentication by default.

Yah you can say it’s the users’ problem, the features are there – but how hard is it to have secure defaults? Newer versions have fixed this, from what I know – but still, the mess caused by their dubious decisions is pretty widespread.

All told, a whopping 99,000 MongoDB installations are exposed, Gevers says.

MongoDB security is a known problem: up until recently, the software’s default configuration is insecure. Shodan founder John Matherly warned in 2015 that some 30,000 exposed MongoDB instances were open to the internet without access controls.

In the Antipodes, the Australian Communications and Media Authority has been reporting exposed MongoDB installations since July 2015 using intelligence provided by the ShadowServer nonprofit.

Bruce Matthews, manager of the agency’s cyber security and unsolicited communications enforcement section, told Vulture South it has insight into IP ranges covering 90 percent of Australia.

He says the number of exposed MongoDB databases in Australia appears to remain steady.

“We report open and vulnerable services to AISI who can pass on the information to the operator of the service,” Matthews says. “It is important that the information is passed on.”

It’s not terribly hard to fix either, assuming it installed on the same server as the web host (if not why else would a DB have a Public IP?), just bind it to localhost and enable authentication for all databases.

The problem now is all these ‘agile’ tools, DevOps deploying gists on Github and automated server creation means developers with no clue about security are rolling up database servers and just using them. I blame the MEAN stack.

Source: The Register

Posted in: Database Hacking, Privacy

, , ,


Latest Posts:


OWASP ZSC - Obfuscated Code Generator Tool OWASP ZSC – Obfuscated Code Generator Tool
OWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script.
A Look Back At 2017 – Tools & News Highlights A Look Back At 2017 – Tools & News Highlights
So here we are in 2018, taking a look back at 2017, quite a year it was. Here is a quick rundown of some of the best hacking/security tools released in 2017, the biggest news stories and the 10 most viewed posts on Darknet as a bonus.
Spectre & Meltdown Checker - Vulnerability Mitigation Tool For Linux Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux
Spectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Hijacker - Reaver For Android Wifi Hacker App Hijacker – Reaver For Android Wifi Hacker App
Hijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app.
Sublist3r - Fast Python Subdomain Enumeration Tool Sublist3r – Fast Python Subdomain Enumeration Tool
Sublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.
coWPAtty Download - Audit Pre-shared WPA Keys coWPAtty Download – Audit Pre-shared WPA Keys
coWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys.


One Response to MongoDB Ransack – Over 33,000 Databases Hacked

  1. R.zDB2-er January 26, 2017 at 6:53 am #

    Go MainFrame, zDB2 Baby!