Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Finding MongoDB instances without any authentication

blog.shodan.io

Post reply on HN
Print view View original

11–20 of 44 posts

Re: Finding MongoDB instances without any authentication

#11

Post by achillean »

_pdp_ wrote: post #2

This information is dangerous :) A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rock…

I've tried to reach out for a few years now and spoke about it at every opportunity but for some reason people just aren't interested in looking at databases. Most of these MongoDB instances are running old versions and given the popularity of the project I suspect that this is a tiny fraction of deployments. Btw I'm still trying to find contacts at some organizations that are affected, but it's actually surprisingly difficult to reach somebody that is in charge of security :-/ Especially with servers hosted in the cloud doing attribution is difficult!

Edit: Btw I've also tried repeatedly to get some press coverage of this issue with reporters, but nobody was interested in covering this problem.

Re: Finding MongoDB instances without any authentication

#12

Post by stevekemp »

_pdp_ wrote: post #2

This information is dangerous :) A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rock…

I did the same thing, spidering for open rsync shares:

http://blog.steve.org.uk/secure_your_rsync_shares__please_.h...

Some scary stuff out there, freely available with minimal effort. Of course with rsync things were generally read-only, but even so lots of family financial-data, and pictures.

Re: Finding MongoDB instances without any authentication

#13

Post by nemothekid »

_pdp_ wrote: post #2

This information is dangerous :) A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rock…

I remember (maybe it was the same service shodan) a year ago, looking at its scanning interface and seeing my instance of my toy database listed as open. I didn't think anything of it, and was too lazy to do anything about, but I've been aware for quite some time now that people will do ip scans against common ports.

This later came back to bite me in the ass when I started messing around with elasticsearch. Elasticsearch had a pretty nasty default that let you run arbitrary code from its query api and within hours my box was compromised.

Re: Finding MongoDB instances without any authentication

#14

Post by realusername »

_pdp_ wrote: post #2

This information is dangerous :) A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rock…

That's exactly the reason why I'm not reporting anything anymore. The legal aspect is just really badly designed for this kind of situation. If I find something opened or unsecured by mistake, I just go somewhere else and don't report anything so this way I don't risk anything. That's sad because it's not helping anyone but I just don't want to handle any legal stuff.

Re: Finding MongoDB instances without any authentication

#15

Post by joepie91_ »

Holy crap, TWO YEARS to patch an insecure default?

Sorry, but if you're using MongoDB in production, this is the point where you should start reconsidering that. Two years to patch such a gaping security hole, regardless of any 'breakage', is completely unacceptable.

Re: Finding MongoDB instances without any authentication

#16

Post by redcalx »

realusername wrote: post #14
_pdp_ wrote: post #2

This information is dangerous :) A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rock…

That's exactly the reason why I'm not reporting anything anymore. The legal aspect is just really badly designed for this kind of situation. If I find something opened or unsecured by mistake, I just go somewhere else and don't report anything so this way I don't risk anything. That's sad because it's not helping anyone but I just don't want to handle any legal stuff.

Sure, that's the legal environment we find ourselves in, and in many respects it's short sighted and counter productive, i.e. it actually fosters weak security in critical settings and the chance of those weaknesses being taken advantage of by malicious entities.

Re: Finding MongoDB instances without any authentication

#17

Post by ploxiln »

joepie91_ wrote: post #15

Holy crap, TWO YEARS to patch an insecure default? Sorry, but if you're using MongoDB in production, this is the point where you should start reconsidering that. Two years to patch such a gaping security hole, regardless of any 'breakage', is completely unacceptable.

memcached has the same default to this day - listen on all interfaces, no auth.

These things are designed for use by people running them on servers that are not directly exposed to the internet. If you're running it in a dev VM with no public address, it's fine. If you're running it on a database-optimized server in your datacenter/cloud which has a firewall only allowing connections from your web-application servers to particular ports, it's fine.

In fact I wouldn't trust mongodb auth anyway, that's not it's focus, much less its strength. Leave the auth to other mechanisms designed for it.

I try not to worry about the infinite multitude of idiots who can follow some bad advice and get some software running. No matter what you do to make things foolproof, human ingenuity comes up with better fools, and in the process you make things more complicated for people who know what they're doing.

"completely unacceptable"? no, reasonable.

Re: Finding MongoDB instances without any authentication

#18

Post by achillean »

ploxiln wrote: post #17
joepie91_ wrote: post #15

Holy crap, TWO YEARS to patch an insecure default? Sorry, but if you're using MongoDB in production, this is the point where you should start reconsidering that. Two years to patch such a gaping security hole, regardless of any 'breakage', is completely unacceptable.

memcached has the same default to this day - listen on all interfaces, no auth. These things are designed for use by people running them on servers that are not directly exposed to the internet. If you're running it in a dev VM with no public address, it's fine. If you're running it on a database-optimized server in your datacenter/cloud which has a firewall only allowing connections from your web-application servers…

Yeah... Memcached is one of the other ones that has the same problem but around 100,000 public instances... Maybe I shouldn't have even mentioned MongoDB since everybody's so focused on it now, but this sort of configuration issue affects a ton of database products.

Re: Finding MongoDB instances without any authentication

#20

Post by tracker1 »

achillean wrote: post #10
nevi-me wrote: post #9

Am I right that HackedDB could be because someone who noticed the lack of authentication created such database? If I can connect to an instance without auth, I can also create a DB and collections etc.

Yes, it could be that there was somebody before me that already noticed this issue and decided to exploit it :-/ I saw on Twitter that there actually was a talk in 2013 at DEFCON about these sorts of problems in NoSQL, so in certain circles it's been known for a while just not acted upon.

It's still surprising... I've used MongoDB a few times, but I was always well aware to put it behind a firewall and setup basic auth.

I'm not really one for super fine grained security at the database level, but you should at least have some level of connection controls in place.

iptables isn't that hard.

Post reply on HN