Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Several thousand MongoDBs without access control on the Internet [pdf]

cispa.saarland

Post reply on HN
Print view View original

1–10 of 45 posts

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#2

Post by m8rl »

German IT-news-site heise.de is reporting on it, I guess there'll be an english translation soon.

http://www.heise.de/security/meldung/Studenten-entdecken-Tau...

Original (German language) press release is here: http://www.uni-saarland.de/nc/en/news/article/nr/12173.html

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#3

Post by fabian2k »

m8rl wrote: post #2

German IT-news-site heise.de is reporting on it, I guess there'll be an english translation soon. http://www.heise.de/security/meldung/Studenten-entdecken-Tau... Original (German language) press release is here: http://www.uni-saarland.de/nc/en/news/article/nr/12173.html

And it's not just small stuff either, 8 million phone numbers and addresses in one case. That is beyond embarrassing.

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#5

Post by patio11 »

This can also happen with Memcached, Redis, and for that matter SQL databases. If you find it on your servers, you should be very, very alarmed. (Assume that any attacker with arbitrary access to any of these owns the box. [+]) One easy-ish way to make sure you don't inadvertently leave a port open is to use iptables and deny inbound connections to everything but 22, 80, and 443 by default.

This is part of the Slicehost VPS setup guide that PickledOnion wrote back in the day, and it's still one of the first things I do when I get a new box. (Typically right after locking down SSH with a key requirement.)

Edit to add:

http://articles.slicehost.com/2008/4/25/ubuntu-hardy-setup-p... http://articles.slicehost.com/assets/2007/9/4/iptables.txt [+] You might think "Well, that requires the existence of both a vulnerability in the server and a local privilege escalation exploit", but in practice, you can assume that the attacker has access to both of these. They also probably aren't trying to get into your box, specifically -- your box is merely one of the several thousand Redis instances on the Internet that they're firing e.g. a specially corrupted Unicode string to get a buffer overrun on, at which point they will -- in a mostly automated fashion -- run metasploit (or similar ratware) and turn that into a root shell.

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#9

Post by spacecowboy_lon »

fabian2k wrote: post #3
m8rl wrote: post #2

German IT-news-site heise.de is reporting on it, I guess there'll be an english translation soon. http://www.heise.de/security/meldung/Studenten-entdecken-Tau... Original (German language) press release is here: http://www.uni-saarland.de/nc/en/news/article/nr/12173.html

And it's not just small stuff either, 8 million phone numbers and addresses in one case. That is beyond embarrassing.

Lol I remember finding back in 92 that the ITU's gopher server had all of my employers x.500 directory - a more inocent time :-)
Post reply on HN