Unsecured MongoDBs taken hostage

https://news.ycombinator.com/item?id=13317045

by xyunknown • 10 years ago

83 64 10 years ago

news.ycombinator.com

!!! Important Follow-up !!!:

I've aquired the portion of the log related to the hostage taking, posted below. In particular this log shows that __no__ backup of the data was taken. So please don't pay any money!

------------------------------------------

Although my colleagues and I have already pointed out the issue of open-by-default databases in spring 2015 (look at the references), today it seems for the astonishingly first(?) time somebody took the opportunity to erase hundreds of MongoDBs leaving only this Message:

{ "_id" : ObjectId("5859a0370b8e49f123fcc7da"), "mail" : "harak1r1@sigaint.org", "note" : "SEND 0.2 BTC TO THIS ADDRESS 13zaxGVjj9MNc2jyvDRhLyYpkCh323MsMq AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !" }

Well played, system admins.

Updates:

The price for the data seems to equate to about 200 USD currently. Thanks, wereHamster.

This has been going on since at least yesterday (https://twitter.com/achillean/status/816385533538631680). Thanks, NietTim.

There have already been transactions by presumed victims: https://bitref.com/13zaxGVjj9MNc2jyvDRhLyYpkCh323MsMq . Thanks, anondon.

Please read the official security checklist by MongoDB! In particular, use passwords and don't expose on all interfaces (duh!)! https://docs.mongodb.com/manual/administration/security-checklist/

Sources/References:

The Jan '15 info paper of which I am one of the authors: https://cispa.saarland/wp-content/uploads/2015/02/MongoDB_documentation.pdf

(Jan '17) http://www.csoonline.com/article/3154190/security/exposed-mongodb-installs-being-erased-held-for-ransom.html

http://www.theregister.co.uk/2017/01/04/mongodb_installs_wiped_by_bitcoin_ransoming_script/

(German) https://www.heise.de/newsticker/meldung/Eindringling-nimmt-offenbar-MongoDB-Datenbanken-als-Geisel-3587479.html

wereHamster3• 10 years ago

At the current price, 0.2 BTC is ~200USD.

anondon• 10 years ago

Look at the btc address history: https://bitref.com/13zaxGVjj9MNc2jyvDRhLyYpkCh323MsMq

Looks like the guy pulled off these blackmailing/hostage tricks before as well.

Not to pile on to the already tense situation, would you be open to sharing how this happened, what the database contained etc, sort of like a post mortem without revealing any personally identifiable info.

xyunknown8• 10 years ago

I am not affected by this hostage taking. On the contrary, I am one of the authors of the aforementioned info paper from early '15 warning about this kind of stuff. If you want more information about the incident back then, look me up my name is Kai Greshake. The paper linked above also contains all you need to know about why this incident today happened. As a response MongoDB also updated their security guidelines back then, but refused to change the open-default mechanism and easy-to-do-wrong configuration, arguing that it was aconcious design choice.Turns out this was a bad decision, at least in my eyes, as this is not the first related incident, there were many breaches etc. based around open-default databases in the past 2 years, exposing millions of account info, voting data, and industry equipment.

dx0345• 10 years ago

Shouldn't it be possible to trace the transactions to the point where they were used to pay goods or exchange them for real money?

xyunknown8• 10 years ago

No, thats why things like BTC Tumblers/ Laundering exist.

NietTim• 10 years ago

It's been going on for quite some time already, see: https://twitter.com/achillean/status/816385533538631680

userbinator• 10 years ago

It might be entertaining to run a honeypot server that responds with some... unusual data. Does anyone know if the client they're using to do this has any vulnerabilities? ;-)

xyunknown8• 10 years ago

Shouldn't be hard to get the IP etc, as you can just connect to affected servers and review the global log. Just search for mongoDB on shodan and see for yourself.

fauria2• 10 years ago

MongoDB has a security checklist published, I think it is interesting to review it: https://docs.mongodb.com/manual/administration/security-chec...

mrweasel• 10 years ago

It's fascinating that someone installs and configures MongoDB and doesn't stop to think: "Hey, maybe this shouldn't be exposed directly to the internet". I mean you wouldn't do that with something like MySQL.

Some sort of analysis of the purpose of these directly exposed MongoDB instances could be interesting. Are they being used as a backend for JavaScript applications?

dx0345• 10 years ago

Many database systems are by default only exposed to localhost, you'd have to specifically change the settings to be able to talk to it from outside. That's at least the case for Postgres and MSSQL, not sure about MySQL.

I don't see any reason that a database should allow to listen to any address without authentication. There shouldn't be a real world application requiring this.

nkozyra2• 10 years ago

MySQL is the same with bind-address. If someone chooses to expose a db/store to the world, it would be nice if there was some automatic auth enabled. This isn't Mongo-specific, Elasticsearch is the same way.

anacrolix• 10 years ago

Yeah but webscale apps aren't vulnerable.

ryanlol• 10 years ago

I mean you wouldn't do that with something like MySQL.

Oh yeah? I dumped over 40TB of data from open MySQL instances. --skip-grant-tables is probably the most common advice for resetting your MySQL root password.

xyunknown8• 10 years ago

Aquired log of such a hostage taking, contains the IP of the hostage taker, but beware it could be obscured by a botnet or similar.

Update: in a different log he used a different server for the attack, suggesting he might be using innocent servers, therefore I removed the log.

xyunknown8• 10 years ago

Could someone more familiar with MongoDB please confirm that this does not show any backup of data? Maybe MongoDB does not log just looking up data?

jstanley• 10 years ago

The database was dropped within ~1 second of the connection, so either it was a very small database or he didn't have time to take a backup.

sebcat• 10 years ago

The IP listed in that log belongs to a DigitalOcean instance.

SillentTroll4• 10 years ago

I also have been affected by the same "hack". Turns out I have simply forgot to start mongod with --auth option, even through the I had created users for different databases, including the admin! Looks like in "non secure mode" it allows logins with existing users as well as non-authorized.

I understand why the authentication is disabled by default, but it should fail to start with a DB that has users with roles and stuff.

dx0345• 10 years ago

Why should it be disabled by default? I don't see a reason why any database system would run without auth. At installation they can always use a local user account if no password is provided.

mhotchen3• 10 years ago

I wouldn't call it a bastion of security but MySQL typically installs with a root user with no password. So how do they not have the same level of exposed data? By default only local connections are allowed. If Mongo had the same pattern then this whole calamity could have been avoided whilst still allowing the ease of setting up on local environments.

SillentTroll4• 10 years ago

- Why should it be disabled by default? I don't agree it should, but understand why it is disabled by default: for easy and quick start of development on the local machine.

SillentTroll4• 10 years ago

An solution for the people like me, that forget the --auth would be:

Situation #1, new database: Start MongoDb without any users, but as soon as the admin user is added, drop all connections and enable authentication

Situation #2, existing database: In MongoDB is started with a database, that has admin user but the authentication is not enabled, fail and exit.

achillean2• 10 years ago

How did you install MongoDB? I'm asking because by default it should only listen on localhost and I'm trying to understand whether there's a popular package/ repository that has changed that default from localhost to 0.0.0.0

tbarbugli• 10 years ago

2BTC for such felony does not sound a great deal to me

wereHamster3• 10 years ago

0.2BTC. But you have to multiply that by the number of open MongoDB installations. Tens of thousands at least. So, 20000*0.2BTC = 4000BTC if everyone pays. That's 4mil USD if everybody pays (not everybody will since many of the installations are personal or just tests running on amazon or other clouds). Still, a lot of money for little risk. BTC is pretty safe if you know what to do.

3manuek• 10 years ago

Worst thing is that the data loss impact in money is not limited to the blackmail rates. What I'm saying is that even if everyone pays and 4kBTC (4.3M USD today) is collected by the perpetrator, there are other impacts in terms of legal issues and insurance. I don't know how to calculate this, but it could be an interesting number tho.

martinald2• 10 years ago

Amazed this has taken so long. I think elasticsearch also suffers from this same 'no-auth-by-default' configuration, which is really silly.

Xylakant3• 10 years ago

Sort of. ES >= 2.0 only binds to localhost by default, so it's at least not by default exposed to the internet. Versions < 2.0 suffer from exactly that flaw: No auth, bind to all ports.

spydum• 10 years ago

I think this is still a cop out: first thing junior will do when he can't connect to his database from home is google it, then find out how to bind to all ip's. Network access is BARELY viable access control, as it's too easy to fail open.

xyunknown8• 10 years ago

Another log shows that he even connects to the same server twice sometimes, deleting his own message just to re-insert it- That means he doesn't even save which servers he deleted. Such blunt action is remarkable.

kirushik• 10 years ago

Or that "he" is an automated distributed system without strong consistency guarantees.

mathrawka• 10 years ago

So he deleted his email address or sigaint removed it:

Requested action not taken: mailbox unavailable 550 Invalid recipient

mike-cardwell2• 10 years ago

Unsurprising. On their signup page at http://www.sigaintevyh2rzvw.onion/ it says:

  Are there any rules to using this thing? Generally we are 
  pretty chill, all we ask is that you don't use our FREE 
  service to:

  Spam people
  Threaten people
  Harm people

  Everything else is cool with us.

Looks like he broke rules 2 and 3.

DyslexicAtheist• 10 years ago

"hack" is the wrong word considering we're talking about DB instances exposed to the Internet without access controls.

Please don't say "hack" when you've been auto-pwned by something that uses an OWASP TOP-10 to get you. It's carelessness, inexperience, possibly negligence or anything in between. But for sure it is not a hack!

koolba2• 10 years ago

Using "hack" to refer to this is like leaving your front door wide open and referring to being robbed as an Ocean's 11 style escapade.

simonw• 10 years ago

I'd argue this metaphor is why it IS appropriate to use the word "hack" here.

If you left your door unlocked and someone stole your stuff, that's still a robbery.

If you left your database accidentally midconfigured and someone stole your data and left you an extortion notice, that's still a "hack".

Is misconfiguring MongoDB really that different from e.g. installing a Wordpress plugin with a security flaw and getting hacked via that?

rohandighe2• 10 years ago

Hey Guys, we have been affected by this? What's the course of action that we should take? Data is pretty important to us.

mike-cardwell2• 10 years ago

Restore from backups.

rohandighe2• 10 years ago

I don't have any :(

achillean2• 10 years ago

This has been a known issue for a long time and while I hadn't seen ransomware before these open databases have been attacked previously:

https://blog.shodan.io/its-the-data-stupid/

Note that MongoDB listens on localhost unless changed by the user or the developer is using an insecure image.

Unsecured MongoDBs taken hostage

Related Stories