Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by beermonster on Thursday June 24, 2021 @12:37AM (#27614032)

I think by default mongodb has no enabled access control, so there is no default user or password.

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by vultour on Thursday June 24, 2021 @08:16AM (#27616432)

Am I misunderstanding or do people launch their Mongo container without even MONGO_INITDB_ROOT_{USERNAME,PASSWORD}? It's clearly mentioned in the image README. Takes 15 seconds to set. I'd be incredibly concerned if anybody with more than a day of infrastructure experience did this, even worse on a production database.

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by pm90 on Thursday June 24, 2021 @01:27AM (#27614256)

How is this acceptable… requiring a password, even a weak one might have at least bought some time in this situation.

[ Parent | on HN ]

Re:Hacker deleted all of NewsBlur’s Mongo data and is now ho... by beermonster on Thursday June 24, 2021 @01:49AM (#27614369)

See https://acowebs.com/mongodb-security/

[ Parent | on HN ]