SoylentNews

Phoenix666 [soylentnews.org] writes:

The rise in ransomware attacks on MongoDB installations prompted the database maker last week to issue advice on how to avoid being victimized [theregister.co.uk].

As of Sunday, security researcher and Microsoft developer Niall Merrigan identified more than 27,000 MongoDB databases [theregister.co.uk] seized by ransomware. By Tuesday afternoon Pacific Time, an online spreadsheet maintained by Merrigan and fellow security researcher Victor Gevers [twitter.com] listed 32,643 victims [google.com].

The attacks involve hackers who copy data from insecure databases, delete the original, and ask for a ransom of a few hundred dollars worth of Bitcoin to return the stolen data back to the owner.

MongoDB, like other NoSQL databases, has suffered from security shortcomings for years. Trustwave [trustwave.com] called out MongoDB in 2013. Security researcher John Matherly [shodan.io] did so again in 2015.

Where MySQL, PostgreSQL, and other relational databases tend to default to local installation and some form of authorization, MongoDB databases are exposed to the internet by default, and don't require credentials immediately by default [snyk.io].

MongoDB's security checklist is here [mongodb.com]. The company has stated it is the user's responsibility to make these changes to the default configuration.

Original Submission