MongoDB Hacked in 13 seconds demanding for ransom

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM3RrQ7ct6l67yOe5gYYcqqtZ7uqmOTa-2Gn3IK-6GnuP_5drlgq214myKQEqRc6-8cTvHbkmgct3gYNOCVwcUCNuNMWwt5zBQW6rxdlu9gvyhTePv1M82P6H4skau8qTcb_HPu6m9pJI/s1600/mongodb-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="325" data-original-width="683" height="302" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM3RrQ7ct6l67yOe5gYYcqqtZ7uqmOTa-2Gn3IK-6GnuP_5drlgq214myKQEqRc6-8cTvHbkmgct3gYNOCVwcUCNuNMWwt5zBQW6rxdlu9gvyhTePv1M82P6H4skau8qTcb_HPu6m9pJI/s640/mongodb-hacked.jpg" width="640" /></a></div> <br /> The hackers have been exploiting unprotected MongoDB for the last couple of years, based servers to steal data and hold the exposed databases for ransom. In order to raise awareness, <b>hackers leaked 36 million records of internal data collected from several vulnerable servers.</b><br /> <br /> <br /> The IT security researchers from German firm Kromtech conducted an experiment in which they purposely left a MongoDB database exposed to the public and kept an eye on the incoming connections, to determine and measure the depth of attacks against MongoDB,.<br /> <br /> <br /> The matter seriousness can be understood by the fact that in July of 2015 John Matherly of Shodan, <b>the world’s first search engine for the Internet of Things (IoT devices) revealed that there are over 30,000 unprotected MongoDB databases exposed for public access</b>.<br /> <br /> <b>Honeypot</b>: Which is a security mechanism set to detect and counteract attempts at unauthorized use of information systems.<br /> <br /> The honeypot database contained 30GB of fake data. Little did they know, it took only three hours for hackers to identify the database before wiping out its data in just 13 seconds and leaving a ransom note demanding 0.2 Bitcoin according to Kromtech’s blog post.<br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSmn-WPs3HTyuG4VUdaVUsWn_d9XLO1Sjopze1P-TfmGzhXZfiL4TwwXZ8VUBX2_sRdaThLcY2Bh1uEP5-q5m26OzAkdaEyhyphenhyphenfrdL9gNLAQnSFpOpgZzS3UVk_5R0aakxJwdpdQHb0zsw/s1600/ramsom-note.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="110" data-original-width="702" height="100" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSmn-WPs3HTyuG4VUdaVUsWn_d9XLO1Sjopze1P-TfmGzhXZfiL4TwwXZ8VUBX2_sRdaThLcY2Bh1uEP5-q5m26OzAkdaEyhyphenhyphenfrdL9gNLAQnSFpOpgZzS3UVk_5R0aakxJwdpdQHb0zsw/s640/ramsom-note.png" width="640" /></a></div> <br /> Here it is noteworthy that in January 2017, hackers held several MongoDB databases for ransom and demanded 0.2 Bitcoin in return. It is unclear if the hackers who took over the honeypot database are part of the same group. However, according to Kromtech’s Chief Communication Officer Bob Diachenko, the attack on their database has been traced back to China.<br /> <br /> The researchers are certain that only an automated script can complete such task within 13 seconds.<br /> <br /> “The attacker connects to our database first, then drops the databases to delete them, drops the Journals to erase their tracks, creates a database called Warning with Readme collection and the Solution Record, then drops the Journals again to cover their tracks. This was all completed in just thirteen seconds, leading to the conclusion that this was the work of an automated script,” noted Kromtech researchers.<br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikc-ITCUJqScaHHfQxcIDKQNrql0zulaDQCWFOyDraoqbf7dHvVMBrc2mVGBw7joiAJ5CUatOiNogBu4owoGBJGlFLr0WmlA-AiVpU52BW7F0lbQRDyDBjIbJ8mS-6_k3EW4S4LJT2u6c/s1600/mongodb-hacked-in-13-seconds.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="419" data-original-width="768" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikc-ITCUJqScaHHfQxcIDKQNrql0zulaDQCWFOyDraoqbf7dHvVMBrc2mVGBw7joiAJ5CUatOiNogBu4owoGBJGlFLr0WmlA-AiVpU52BW7F0lbQRDyDBjIbJ8mS-6_k3EW4S4LJT2u6c/s640/mongodb-hacked-in-13-seconds.jpg" width="640" /></a></div> <br /> <b>The <a href="https://mackeepersecurity.com/post/how-long-does-it-take-for-a-mongodb-to-be-compromised">researchers </a>are advising </b>users to secure their database since exposed MongoDB servers are still at risk. <b>Another important aspect</b> of <b>ransom attacks against MongoDB is that hackers are simply deleting the database therefore even if victim pays them off, their data will never be returned.</b> Therefore, keep a back up of your data and never pay ransom in such cases.</div>

Cyber Attack Cyber Crime database Hacking News MongoDB MongoDB Hacked in 13 seconds demanding for ransom

The hackers have been exploiting unprotected MongoDB for the last couple of years, based servers to steal data and hold the exposed data...

Read more »