Finding MongoDB instances without any authentication

#1

Post by yammesicka » Sun, Jul 19, 2015, 3:13 PM UTC

Finding MongoDB instances without any authentication
blog.shodan.io

Re: Finding MongoDB instances without any authentication

#2

Post by _pdp_ » Sun, Jul 19, 2015, 4:31 PM UTC

This information is dangerous :)

A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rocket scientist to figure out what's going on once you know the basics. Someone did exactly this and wrecked a few systems. I was contacted later by the effected organisations holding me directly responsible for the damage that was inflicted. I had no involvement whatsoever but the information that I provided was crucial for the discovery of these targets. This was when I realised that regardless how cool is to publish security research you should always take the necessary steps to ensure that no one is harmed.

Re: Finding MongoDB instances without any authentication

#3

Post by jakobdabo » Sun, Jul 19, 2015, 4:44 PM UTC

Can't malware/bots use these databases for communication?

Re: Finding MongoDB instances without any authentication

#4

Post by Twirrim » Sun, Jul 19, 2015, 5:00 PM UTC

_pdp_ wrote: post #2

This information is dangerous :) A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rock…

They're entirely responsible for the damage that was inflicted. Attempting to shift the blame to you is childish at best.

Re: Finding MongoDB instances without any authentication

#5

Post by captn3m0 » Sun, Jul 19, 2015, 5:17 PM UTC

jakobdabo wrote: post #3

Can't malware/bots use these databases for communication?

Yes, but then you build your own layer of auth on top of it. Signed messages should work fine, though. Its an interesting idea, for sure.

Re: Finding MongoDB instances without any authentication

#6

Post by _pdp_ » Sun, Jul 19, 2015, 5:34 PM UTC

Twirrim wrote: post #4

_pdp_ wrote: post #2

This information is dangerous :) A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rock…

They're entirely responsible for the damage that was inflicted. Attempting to shift the blame to you is childish at best.

Maybe, but there is such thing as responsible disclosure.

Re: Finding MongoDB instances without any authentication

#7

Post by greglindahl » Sun, Jul 19, 2015, 5:47 PM UTC

_pdp_ wrote: post #2

This information is dangerous :) A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rock…

blekko's search engine received a lot of automated queries looking for that kind of info -- that and SEO ranking research were our top 2 types of automated search.

Re: Finding MongoDB instances without any authentication

#8

Post by obblekk » Sun, Jul 19, 2015, 6:37 PM UTC

FYI: if you don't want to pay shodan for search results, you could run your own port scan using masscan(https://github.com/robertdavidgraham/masscan) by running the command

  masscan -p27017 0.0.0.0/0 --excludefile data/exclude.conf

Be warned that this will scan the entire IPv4 namespace.

Re: Finding MongoDB instances without any authentication

#9

Post by nevi-me » Sun, Jul 19, 2015, 6:42 PM UTC

Am I right that HackedDB could be because someone who noticed the lack of authentication created such database?

If I can connect to an instance without auth, I can also create a DB and collections etc.

Re: Finding MongoDB instances without any authentication

#10

Post by achillean » Sun, Jul 19, 2015, 7:12 PM UTC

nevi-me wrote: post #9

Am I right that HackedDB could be because someone who noticed the lack of authentication created such database? If I can connect to an instance without auth, I can also create a DB and collections etc.

Yes, it could be that there was somebody before me that already noticed this issue and decided to exploit it :-/ I saw on Twitter that there actually was a talk in 2013 at DEFCON about these sorts of problems in NoSQL, so in certain circles it's been known for a while just not acted upon.