Categories: Breaking NewsHackingSecurity

MongoDB admins exposed 600 terabytes of data by using un-patched versions

MongoDB administrators have exposed something like 595.2 terabytes of data by using bad poor configurations, or un-patched versions of the MongoDB.

John Matherly, the creator of Shodan, the marvelous search engine for connected devices, revealed that many MongoDB administrators have exposed something like 595.2 terabytes of data by using bad poor configurations, or un-patched versions of the MongoDB.

MongoDB is a popular alternative to SQL, open source, many companies already use it, including “The New York Times”, “Ebay”, and “Foursquare.” John Matherly argues that around 30.000 databases are exposed because administrators are using old versions of MongoDB, and these old versions fail to bind to localhost

“There’s a total of 595.2 TB of data exposed on the internet via publicly accessible MongoDB instances that don’t have any form of authentication,”

The latest version of MongoDB is 3.0.4, but until version 2.4.14 MongoDB was still listening to 0.0.0.0 by default.

This is a known problem since 2012 when Roman Shtylman raised the problem, and at the time Shtylman realized that a critical bug because MongoDB was being shipped without authentication.

Shtylman said “[Affected versions] do not have a ‘bind_ip 127.0.0.1’ option set in the mongodb.conf. This leaves a user’s server vulnerable if they are not aware of this setting. The default should be to lockdown as much as possible and only expose if the user requests it,”

Shtylman added that earlier versions of 2.6 may have the problem as well.

He came to the conclusion that most of the exposed DB are running in the cloud, hosted in Amazon, Digital Ocean, and in services such the referred ones, “My guess is that cloud images don’t get updated as often, which translates into people deploying old and insecure versions of software.”

It is not the first time that the security industry is concerned by the security of MongoDB, in February 2015 nearly 40,000 entities running MongoDB were found vulnerable to cyber attacks.

Three students from the University of Saarland in Germany, discovered that MongoDB databases running at TCP port 27017 as a service of several thousand of commercial web servers were exposed on the Internet without proper defense measures.

The German Team of experts reported that they were able to to get “read and write access” to the unsecured and vulnerable MongoDB databases without using any special hacking tools.

As usually highlighted, it is essential to proper configure every system exposed on the Internet to avoid to enlarge our surface of attack and advantage our attackers.

About the Author Elsio Pinto

Elsio Pinto is at the moment the Lead Mcafee Security Engineer at Swiss Re, but he also as knowledge in the areas of malware research, forensics, ethical hacking. He had previous experiences in major institutions being the European Parliament one of them. He is a security enthusiast and tries his best to pass his knowledge. He also owns his own blog http://high54security.blogspot.com/

Pierluigi Paganini

(Security Affairs – MongoDB , Shodan)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.