Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Finding MongoDB instances without any authentication

blog.shodan.io

Post reply on HN
Print view View original

21–30 of 44 posts

Re: Finding MongoDB instances without any authentication

#21

Post by vacri »

Twirrim wrote: post #4
_pdp_ wrote: post #2

This information is dangerous :) A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rock…

They're entirely responsible for the damage that was inflicted. Attempting to shift the blame to you is childish at best.

This is a victim-blaming myth. The prime responsibility for the damage is the person who did the damage. Not the discloser, and not the victim.

Re: Finding MongoDB instances without any authentication

#22

Post by jsmthrowaway »

joepie91_ wrote: post #15

Holy crap, TWO YEARS to patch an insecure default? Sorry, but if you're using MongoDB in production, this is the point where you should start reconsidering that. Two years to patch such a gaping security hole, regardless of any 'breakage', is completely unacceptable.

Regardless of my thoughts on MongoDB in particular, if you are relying upon authentication mechanisms built into infrastructure software so that you can put, say, MongoDB on a public IP address and communicate in the open, you are operating your infrastructure completely unacceptably. There is absolutely zero excuse for not doing this right, and if MongoDB's default fucked you here, you're not doing it right in the first place. You wouldn't put your Nest thermostat on the Internet, so why is your primary data store? And, even worse, if you've "done it right" and thrown HTTP basic authentication in front of it, you get to put your hands on your hips and say "ha! we're secure!" but you're one bypass or weak password away from losing your entire database.

I agree with you on reconsidering MongoDB in production, but administrators failing to secure their systems is not why. Authenticating to a database is an antipattern. Stop making database vendors add this shit: HTTP basic authentication against your NoSQL hotness in prod, on a public IP, is a complete waste of time. Put it in RFC 1918 space or lock down security groups like everybody else and stop losing databases like this. That's what's unacceptable.

Seriously, this stuff is bananas. Now you have to ship passwords around in your automation because you can't be bothered to deploy a real DMZ and private network. Then you have to use Ansible Vault or whatever, and the complexity just rapidly multiplies.

Re: Finding MongoDB instances without any authentication

#23

Post by rodgerd »

ploxiln wrote: post #17
joepie91_ wrote: post #15

Holy crap, TWO YEARS to patch an insecure default? Sorry, but if you're using MongoDB in production, this is the point where you should start reconsidering that. Two years to patch such a gaping security hole, regardless of any 'breakage', is completely unacceptable.

memcached has the same default to this day - listen on all interfaces, no auth. These things are designed for use by people running them on servers that are not directly exposed to the internet. If you're running it in a dev VM with no public address, it's fine. If you're running it on a database-optimized server in your datacenter/cloud which has a firewall only allowing connections from your web-application servers…

> These things are designed for use by people running them on servers that are not directly exposed to the internet.

Just as well internal attacks and fraud are never a thing, and pivoting attacks up a chain of successively less secure components never happens.

Re: Finding MongoDB instances without any authentication

#24

Post by alex_anglin »

vacri wrote: post #21
Twirrim wrote: post #4

Earlier quoted context omitted.

They're entirely responsible for the damage that was inflicted. Attempting to shift the blame to you is childish at best.

This is a victim-blaming myth. The prime responsibility for the damage is the person who did the damage. Not the discloser, and not the victim.

Maybe, but running unauthenticated databases on the public internet is negligent at best.

Re: Finding MongoDB instances without any authentication

#25

Post by joepie91_ »

jsmthrowaway wrote: post #22
joepie91_ wrote: post #15

Holy crap, TWO YEARS to patch an insecure default? Sorry, but if you're using MongoDB in production, this is the point where you should start reconsidering that. Two years to patch such a gaping security hole, regardless of any 'breakage', is completely unacceptable.

Regardless of my thoughts on MongoDB in particular, if you are relying upon authentication mechanisms built into infrastructure software so that you can put, say, MongoDB on a public IP address and communicate in the open, you are operating your infrastructure completely unacceptably. There is absolutely zero excuse for not doing this right, and if MongoDB's default fucked you here, you're not doing it right in the f…

You're missing the point. Listening on all interfaces was the default. Defaults should be secure and fail-closed, and that it takes them two years to patch that is extremely worrying.

Re: Finding MongoDB instances without any authentication

#26

Post by nodesocket »

I honestly blame DigitalOcean a bit for not providing a VPC and/or a centralized firewall. It is tedious to configure iptables rules on each server and easy to overlook and make mistakes.

Furthermore, it should be the job of the firewall to limit access to server interfaces/ports, not the services inside of servers. Binding on 0.0.0.0 seems perfectly acceptable, especially for cluster/distributed services that talk amoung themselves.

Re: Finding MongoDB instances without any authentication

#27

Post by latch »

alex_anglin wrote: post #24
vacri wrote: post #21

Earlier quoted context omitted.

This is a victim-blaming myth. The prime responsibility for the damage is the person who did the damage. Not the discloser, and not the victim.

Maybe, but running unauthenticated databases on the public internet is negligent at best.

No. It could be simple ignorance. Or an accident.

In your world, what is it at worst? Criminal? Capital?

Re: Finding MongoDB instances without any authentication

#28

Post by jsmthrowaway »

joepie91_ wrote: post #25
jsmthrowaway wrote: post #22

Earlier quoted context omitted.

Regardless of my thoughts on MongoDB in particular, if you are relying upon authentication mechanisms built into infrastructure software so that you can put, say, MongoDB on a public IP address and communicate in the open, you are operating your infrastructure completely unacceptably. There is absolutely zero excuse for not doing this right, and if MongoDB's default fucked you here, you're not doing it right in the f…

You're missing the point. Listening on all interfaces was the default . Defaults should be secure and fail-closed, and that it takes them two years to patch that is extremely worrying.

I'm not missing your point. Your point is wrong. Listening on all interfaces is acceptable because this is infrastructure software, and wiring up MongoDB on a publicly accessible and unfiltered endpoint is an antipattern, authentication scheme or not. If you choose the shitty deployment, like public IPv4, it's on you to actively configure the software to support your shitty deployment.

The default that isn't secure is your expectation of secure software regardless of the accessibility of the endpoint. You don't get to punt those assurances to MongoDB and file "unacceptable" JIRAs to add some other lightly-reviewed authentication scheme to software that doesn't need it. It's on you as an administrator to secure your database, and step one is not default permit to an endpoint on which you can find your entire database. Let me guess, you want authentication via HTTP basic for all of your backend services but rolling a CA and doing TLS client auth is outside your budget and time?

I have been doing production operations for a while. There's two schools of thought: "the defaults are unacceptable," and "I should really be applying defense in depth to protect my infrastructure and own responsibility," and I actively hire the latter. There are a lot of the former, and we're seeing their databases in this post.

Re: Finding MongoDB instances without any authentication

#29

Post by eugeneionesco »

_pdp_ wrote: post #2

This information is dangerous :) A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rock…

>always take the necessary steps to ensure that no one is harmed.

That is always publish anonymously.

Re: Finding MongoDB instances without any authentication

#30

Post by alex_anglin »

latch wrote: post #27
alex_anglin wrote: post #24

Earlier quoted context omitted.

Maybe, but running unauthenticated databases on the public internet is negligent at best.

No. It could be simple ignorance. Or an accident. In your world, what is it at worst? Criminal? Capital?

Agreed that it could be either of those things. I'm not trying to excuse criminal behavior at all, rather stating that if one puts an unauthenticated database on the internet, it's going to be compromised. For software professionals, my opinion is that to do so would be negligent.
Post reply on HN