[deleted]
The MongoDB hack and the importance of secure defaults
11–20 of 223 posts
Re: The MongoDB hack and the importance of secure defaults
#12Why would someone still use v2.6? There isn't much trouble to upgrade.
Based on the article at least 30.000 internet-accessible installations.
Re: The MongoDB hack and the importance of secure defaults
#13Why would someone still use v2.6? There isn't much trouble to upgrade.
The same people that run an unsecured database that's accessible over the internet.
Re: The MongoDB hack and the importance of secure defaults
#14I stumbled upon this (awesome) article that made me realize tons of things: http://www.ranum.com/security/computer_security/editorials/d...
I'm not a security expert (far from it) but I hope that I understand enough the importance of security to learn a bit about it and implement it as much as I can.
Secure defaults is now maybe the first concept I'm trying to explain to people in my company.
Re: The MongoDB hack and the importance of secure defaults
#15[deleted]
Re: The MongoDB hack and the importance of secure defaults
#16I have never used MongoDB so I admit I'm talking blind here, but can someone explain how/why a piece of highly popular software gets to version 2.6 allowing unsecured remote connections by default? Further to that is that type of thinking you want in the development process of something as critical as a database engine? It just seems amazing to me that it got so far before the community in general pushed back that th…
at v2.6 the product was only about 4 years old and underwent a lot of change during that time. (For comparison Postgres version 3 was released in 1991)
I think the main guilty parties at mongodb were/are in marketing.
technically sophisticated users understood the immaturity of the product and the tradeoffs that came with its architecture.
however it was sometimes marketed as a general purpose data store, or as an alternative to much more mature relational data stores, which was and still is an unfair comparison.
Re: The MongoDB hack and the importance of secure defaults
#17I find it interesting that there's no firewall with a default deny rule between these exposed mongodb installs and the Internet. All I can think is that most of them are on cloud services which are directly exposed. It reminds me of the fiasco with all of the directly-connected vulnerable network cameras on the Internet.
I think the problem is developers running apt-get install mongodb and assuming all other considerations, like a firewall, are somehow magically taken care of, then patting themselves on the back for not needing a sysadmin.
Re: The MongoDB hack and the importance of secure defaults
#18I find it interesting that there's no firewall with a default deny rule between these exposed mongodb installs and the Internet. All I can think is that most of them are on cloud services which are directly exposed. It reminds me of the fiasco with all of the directly-connected vulnerable network cameras on the Internet.
I think the problem is developers running apt-get install mongodb and assuming all other considerations, like a firewall, are somehow magically taken care of, then patting themselves on the back for not needing a sysadmin.
I think it's more of a case of assuming that the database wouldn't expose itself to the internet at large, because why would it? It's like buying a new car, and checking for holes in the gas tank before rolling off the lot.
Re: The MongoDB hack and the importance of secure defaults
#19Microsoft took a rash of shit some time ago (15 years?) for shipping MS Proxy Server with every port open by default. From the POV of employee-at-the-time, it took them a disappointingly long time for them to not do that anymore. Since then, I've learned to not assume that products are secure-by-default. At the same time, I kind of thought we learned our lesson and cut that shit out low these many years later. Add a…
Exchange 5.0 was an open mail relay and not possible to lock down - you actually had to pay for Exchange 5.5 in order to get relaying control.
But that's bad old NT4-era Microsoft. Not 201x MongoDB.
Re: The MongoDB hack and the importance of secure defaults
#20I find it interesting that there's no firewall with a default deny rule between these exposed mongodb installs and the Internet. All I can think is that most of them are on cloud services which are directly exposed. It reminds me of the fiasco with all of the directly-connected vulnerable network cameras on the Internet.
I think the problem is developers running apt-get install mongodb and assuming all other considerations, like a firewall, are somehow magically taken care of, then patting themselves on the back for not needing a sysadmin.
This is absolutely the problem. There are high-horse developers who've made 4 webapps using PHP and don't know anything about the system they're deploying on -- but they're rockstars disrupting the world!
They leave mysqld bound to 0.0.0.0 because they don't know any better. They SSH as root because they don't know any better. They have a default WordPress install with the config db sitting in webroot.
But hey, their website works and might one day make them some money.