Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Several thousand MongoDBs without access control on the Internet [pdf]

cispa.saarland

Post reply on HN
Print view View original

11–20 of 45 posts

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#11

Post by Fiahil »

fabian2k wrote: post #3
m8rl wrote: post #2

German IT-news-site heise.de is reporting on it, I guess there'll be an english translation soon. http://www.heise.de/security/meldung/Studenten-entdecken-Tau... Original (German language) press release is here: http://www.uni-saarland.de/nc/en/news/article/nr/12173.html

And it's not just small stuff either, 8 million phone numbers and addresses in one case. That is beyond embarrassing.

What is even more embarrassing, is the lack of proper acknowledgment from the French Telecommunication provider (Bouygues Telecom?) regarding the safety of their customers' data.

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#14

Post by webscale2015 »

Ah web scale developers. If only their knowledge and education went beyond "learn rails or node in 24 hours" and actually had a mandatory requirement to learn about security and responsibility. Security? Is that something we install from NPM or Gem files?

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#16

Post by LunaSea »

webscale2015 wrote: post #14

Ah web scale developers. If only their knowledge and education went beyond "learn rails or node in 24 hours" and actually had a mandatory requirement to learn about security and responsibility. Security? Is that something we install from NPM or Gem files?

Yeah, we all know how REAL software like Java and Flash are super secure right ?

Maybe just install it with Maven ?

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#17

Post by jwklemm »

neals wrote: post #12

How do I know if my access control is just local? I have a few small (pet) mongoDB projects on Digital Ocean, never spend too much time updatng and/or securing them actually.

I'd first make sure that MongoDB is locked down in your firewall. Only open port 27017 to the IPs that need it (app, secondaries, etc).

I've found Mongo's authorization setup to be pretty unintuitive, but you can find some information here: http://docs.mongodb.org/manual/core/authorization/ (IIRC, you need to setup the permissions first, then set "auth=true" in mongod.conf and restart the service.)

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#18

Post by yAnonymous »

webscale2015 wrote: post #14

Ah web scale developers. If only their knowledge and education went beyond "learn rails or node in 24 hours" and actually had a mandatory requirement to learn about security and responsibility. Security? Is that something we install from NPM or Gem files?

Doesn't have anything to do with web. Other developers are just as bad with security, but it's not so visible.

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#20

Post by patio11 »

neals wrote: post #12

How do I know if my access control is just local? I have a few small (pet) mongoDB projects on Digital Ocean, never spend too much time updatng and/or securing them actually.

Assuming you have the mongo client installed on your laptop or similar, use this in a command shell:

> mongo server.address.or.ip.goes.here

If this connects successfully, that is problematic.

Post reply on HN