News for hackers. Stuff that matters.

A comment on Finding MongoDB instances without any authentication.

Re:Finding MongoDB instances without any authentication by _pdp_ on Sunday July 19, 2015 @12:31PM (#9911689)
This information is dangerous :)

A while back I published research on open, unauthenticated ICA (Citrix) instances that could be found by doing basic google queries. I was able to find a lot of interesting targets including some belonging to military and government organisations. I published my findings regarding the discovery without including any details. The blog post was very vague. Anyway, it doesn't take a rocket scientist to figure out what's going on once you know the basics. Someone did exactly this and wrecked a few systems. I was contacted later by the effected organisations holding me directly responsible for the damage that was inflicted. I had no involvement whatsoever but the information that I provided was crucial for the discovery of these targets. This was when I realised that regardless how cool is to publish security research you should always take the necessary steps to ensure that no one is harmed.

[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by achillean on Sunday July 19, 2015 @03:42PM (#9912561)
I've tried to reach out for a few years now and spoke about it at every opportunity but for some reason people just aren't interested in looking at databases. Most of these MongoDB instances are running old versions and given the popularity of the project I suspect that this is a tiny fraction of deployments. Btw I'm still trying to find contacts at some organizations that are affected, but it's actually surprisingly difficult to reach somebody that is in charge of security :-/ Especially with servers hosted in the cloud doing attribution is difficult!

Edit: Btw I've also tried repeatedly to get some press coverage of this issue with reporters, but nobody was interested in covering this problem.

[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by Twirrim on Sunday July 19, 2015 @01:00PM (#9911810)
They're entirely responsible for the damage that was inflicted. Attempting to shift the blame to you is childish at best.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by _pdp_ on Sunday July 19, 2015 @01:34PM (#9911986)
Maybe, but there is such thing as responsible disclosure.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by vacri on Sunday July 19, 2015 @05:40PM (#9912929)
This is a victim-blaming myth. The prime responsibility for the damage is the person who did the damage. Not the discloser, and not the victim.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by alex_anglin on Sunday July 19, 2015 @06:41PM (#9913131)
Maybe, but running unauthenticated databases on the public internet is negligent at best.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by latch on Sunday July 19, 2015 @08:08PM (#9913370)
No. It could be simple ignorance. Or an accident.

In your world, what is it at worst? Criminal? Capital?

[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by alex_anglin on Sunday July 19, 2015 @09:23PM (#9913571)
Agreed that it could be either of those things. I'm not trying to excuse criminal behavior at all, rather stating that if one puts an unauthenticated database on the internet, it's going to be compromised. For software professionals, my opinion is that to do so would be negligent.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by mentat on Sunday July 19, 2015 @11:58PM (#9913924)
An ignorance is an excuse for compromising your company or customer's data in exactly what situations? Let's just all cover our eyes and not look, then the data will be safe I'm sure.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by threatofrain on Monday July 20, 2015 @04:00AM (#9914576)
Of course it depends on the context. I don't know if it's reasonable to expect a small family clinic, therapist, or dental office to secure their client information. It seems that people just mass scan the internet looking for already known vulnerabilities.

However, if it's a mid-sized business handling important information, like payment information, then I do think there ought to be a standard of dutiful behavior, because otherwise who pays for the externalities?

[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by vacri on Monday July 20, 2015 @08:00PM (#9919886)
It could also be leftover testing systems that haven't been torn down yet, with nothing interesting in them. The internet is full of them.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by SamReidHughes on Monday July 20, 2015 @03:27AM (#9914470)
Why shouldn't we blame victims too? Should we not blame victims of shark attacks that swim in shark-infested waters?
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by vacri on Monday July 20, 2015 @03:47AM (#9914540)
Have another go at interpreting my comment.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by nemothekid on Sunday July 19, 2015 @04:28PM (#9912708)
I remember (maybe it was the same service shodan) a year ago, looking at its scanning interface and seeing my instance of my toy database listed as open. I didn't think anything of it, and was too lazy to do anything about, but I've been aware for quite some time now that people will do ip scans against common ports.

This later came back to bite me in the ass when I started messing around with elasticsearch. Elasticsearch had a pretty nasty default that let you run arbitrary code from its query api and within hours my box was compromised.

[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by realusername on Sunday July 19, 2015 @04:29PM (#9912713)
That's exactly the reason why I'm not reporting anything anymore. The legal aspect is just really badly designed for this kind of situation. If I find something opened or unsecured by mistake, I just go somewhere else and don't report anything so this way I don't risk anything. That's sad because it's not helping anyone but I just don't want to handle any legal stuff.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by redcalx on Sunday July 19, 2015 @04:55PM (#9912785)
Sure, that's the legal environment we find ourselves in, and in many respects it's short sighted and counter productive, i.e. it actually fosters weak security in critical settings and the chance of those weaknesses being taken advantage of by malicious entities.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by stevekemp on Sunday July 19, 2015 @03:55PM (#9912596)
I did the same thing, spidering for open rsync shares:

http://blog.steve.org.uk/secure_your_rsync_shares__please_.h...

Some scary stuff out there, freely available with minimal effort. Of course with rsync things were generally read-only, but even so lots of family financial-data, and pictures.

[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by greglindahl on Sunday July 19, 2015 @01:47PM (#9912050)
blekko's search engine received a lot of automated queries looking for that kind of info -- that and SEO ranking research were our top 2 types of automated search.
[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by eugeneionesco on Sunday July 19, 2015 @09:18PM (#9913560)
>always take the necessary steps to ensure that no one is harmed.

That is always publish anonymously.

[ Parent | on HN ]
Re:Finding MongoDB instances without any authentication by yeukhon on Sunday July 19, 2015 @11:16PM (#9913844)
This is known for many years so author is not the first to acknowledge that problem (just do an online search). This is a known operational problem / must-avoid / best practice for Mongo deployment.
[ Parent | on HN ]