Ask HN: How do hackers hack MongoDB instances?

2 pointsby NithurM4 lata temu8 comments

This week I got my mongodb instances hacked two times. Since it is a test database there is no damage. But my question is how it possible? I've setup a unique password for my db? If the hacker can figure out my password, is it not possible they can hack every other accounts on the internet too? I've hosted my db on AWS. And my port is open to connect from anywhere. I know it shouldn't be kept like that. I am only doing it since it is a test db. My biggest question is how easy is to a hacker to break passwords? This is the document hacker left on my db: "All your data is a backed up. You must pay 0.021 BTC to 1Di1cM1QgTxZuwsxp9nRBc6UXUAhbMN7YX 48 hours for recover it. After 48 hours expiration we will leaked and exposed all your data. In case of refusal to pay, we will contact the General Data Protection Regulation, GDPR and notify them that you store user data in an open form and is not safe. Under the rules of the law, you face a heavy fine or arrest and your base dump will be dropped from our server! You can buy bitcoin here, does not take much time to buy https://localbitcoins.com or https://buy.moonpay.io/ After paying write to me in the mail with your DB IP: [email protected] and you will receive a link to download your database dump."

Any tips on protecting aws EC2 instances also welcome. Thank you.

8 comments

jd_mongodb4 lata temu

We really discourage people doing this, there are so many potential attack vectors. If you want a secure test cluster we provide a free tier in MongoDB Atlas which serves many people's low end needs and doesn't expose all the attack vectors associated with an EC2 instance. Easier to manage and more secure to boot.

See https://www.mongodb.com/cloud/atlas/register2 to sign up.

NithurM4 lata temu

But I am learning AWS. So I'd like to go with it.

themerone4 lata temu

So many possibilities. You could have a weak password, they could have exploited a mongo vulnerability, most likely they hacked your VM which has a much larger attack surface.

NithurM4 lata temu

What kind of mongo vulnerability? I am hosting it in AWS EC2. Is it possible to hack ec2 instance?

sylens4 lata temu

What else is running on the EC2 instance? What kind of access to the public Internet have you enabled for it?

NithurM4 lata temu

my api, and accessible from anywhere.

alam20004 lata temu

Does the test database contain sensitive data? If not, you can ignore the ransom.

NithurM4 lata temu

No sensitive data. But I want to know how this thing happens?