MongoDB ransom attacks soar, body count hits 27,000 in hours

It also probably mean every connection is made with high privileges...

... opening their application to each and every kind of SQL injections.

But surely it was a test setup which entered production without changes....

Re: Had it coming...

> and they "can't" change it because it was hard coded throughout their products.

Worst case scenario, have they never heard of find/replace? Specifically "sed" will find replace text across the whole data set. Of course a poor solution compared to doing it properly, but surely better than leaving the default password across every single production "product" they sell.

> How do they find customers ? Care to name the shame ? Whistleblower and all that ...

I am actually liking the idea of having some sort of whistleblower type site, where workers can anonymously name and shame company products that are this bad. However you would have to find a way to stop companies falsely bad mouthing each others products on the site, as well as disgruntled ex-workers.

Saying that, if someone says the app is crap because it uses the default mysql password everywhere, it is easy to test that, so I guess having only "verified problems" listed could possibly work.

Re: Had it coming...

How do they find customers ? Care to name the shame ? Whistleblower and all that ...

This also means they do not have a central database connection component in their solution, which probably means "very poorly written code".

Finding customers? Plural? I saw their sales figures for the past year, and they found one. Then they decided to revamp their product management, implemented scrum, and went from dumb to dumber. Yes, the product has a lot of poorly written code, and its performance is abysmal. The remaining programmer is competent, but he's planning on leaving soon. No reason to stay.

The "root" user is "locked down" by limiting the user to local access only. However, the version of SSH is also old, and full of holes. If someone really wanted in, they'd be in.

It's sort of pointless to blow a whistle on them, as they're going downhill anyways. Amazon has a page about management principles. These guys are those principles' negation.

Re: Had it coming...

Mmh, no, even if it is an appliance doing one specific thing (how critical, BTW?), it's still a very bad design which could turn a less critical vulnerability into total havoc - and not only limited to the appliance itself.

Re: Something to note.AWS?

This "attack" needs a web-facing server, so a lot of them will be in $CLOUD.

Re: Something to note.AWS?

The original article where the hacker going under the pseudonym Har1k1r1 was targeting AWS instances. (78%)

http://www.theregister.co.uk/2017/01/04/mongodb_installs_wiped_by_bitcoin_ransoming_script/

Even if that were not the case, have a publicly open unfiltered port to any software without the understanding of the implications is just unprofessional.

Indeed, there was great talk about how secure this one was going to be. Surprise surprise there are gaping holes.

It does go to show though, that there is an issue with industry accepting poorly written/secured software. We've only had 1 customer out of double figures that picked up and commented on the lack of security.

Requesting PEN test results before purchasing would be a good way to negate some problems. Responsibility would be on the manufacturer to ensure it is of a good standard before putting it to the market. You'd also have documented tests/results to then use as a baseline to ensure compliance/security/etc.

Re: The Wordpress of Databases

Actually, here, mongodb is like a car, let's assume so ... you have never been in a car on the road, you have merely seen them drive past your porch, you know nothing about road signs, traffic lights etc .... now, you want a car, so you buy one with automatic transmission ... you do not care to read the manual to the car or the national driver's manual, coz car is "automatic" and "easy to drive", so the sales guy told you ... imagine what happens next ?

If you do not want to learn how to do it prroperly, go pay some cash to someone who does know how to do it properly.

The big issue is, these 0wned instances might get used as botnets or whatever ... especially if the owner does not pay up ...

I am all for saying John Doe might be a good mechanic, however, in this case, John has chosen to play dba and there are things you need to learn before setting up a database, and no, quick installation instructions are NOT enough ...