Finding MongoDB instances without any authentication

Re:Finding MongoDB instances without any authentication by nevi-me on Sunday July 19, 2015 @02:42PM (#9912319)

Am I right that HackedDB could be because someone who noticed the lack of authentication created such database?

If I can connect to an instance without auth, I can also create a DB and collections etc.

[ Parent | on HN ]

Re:Finding MongoDB instances without any authentication by achillean on Sunday July 19, 2015 @03:12PM (#9912442)

Yes, it could be that there was somebody before me that already noticed this issue and decided to exploit it :-/ I saw on Twitter that there actually was a talk in 2013 at DEFCON about these sorts of problems in NoSQL, so in certain circles it's been known for a while just not acted upon.

[ Parent | on HN ]

Re:Finding MongoDB instances without any authentication by tracker1 on Sunday July 19, 2015 @05:36PM (#9912914)

It's still surprising... I've used MongoDB a few times, but I was always well aware to put it behind a firewall and setup basic auth.

I'm not really one for super fine grained security at the database level, but you should at least have some level of connection controls in place.

iptables isn't that hard.

[ Parent | on HN ]