MongoDB is subject to continual attacks when exposed to the internet

guest · Jul 8, 2020

MongoDB is subject to continual attacks when exposed to the internet
July 8, 2020
https://www.helpnetsecurity.com/202...ntinual-attacks-when-exposed-to-the-internet/

On average, an exposed Mongo database is breached within 13 hours of being connected to the internet. The fastest breach recorded was carried out 9 minutes after the database was set up, according to Intruder.

MongoDB is a general purpose, document-based, distributed database that consistently ranks in the top 5 most-used databases worldwide. It is used by a wide range of organizations all over the globe to store and secure sensitive application and customer data.
There are 80,000 exposed MongoDB services on the internet, of which 20,000 were unsecured.
Click to expand...

How MongoDB attacks are carried out
After seeing how consistently database breaches were occurring, Intruder planted honeypots to find out how these attacks happen, where the threats are coming from, and how fast it takes place.

The research shows that MongoDB is subject to continual attacks when exposed to the internet. Attacks are carried out automatically and indiscriminately and on average an unsecured database is compromised less than 24 hours after going online.
At least one of the honeypots was held to ransom within a minute of connecting.

“Even if security teams can detect an unsecured database and recognise its potential severity, responding to and containing such a misconfiguration in less than 13 hours may be a tall order, let alone in under 9 minutes. Prevention is a much stronger defence than cure.”
Click to expand...

Intruder: 9 minutes to breach: the life expectancy of an unsecured MongoDB honeypot

guest · Jul 23, 2020

Exposed MongoDB database draws attacks within hours
July 23, 2020
https://www.computing.co.uk/news/4018152/exposed-mongodb-database-draws-attacks-hours

A Comparitech experiment led by cyber security researcher Bob Diachenko has shown that exposed databases on the internet are probed within hours of being set up.

The researchers say they put a MongoDB honeypot on the web for three months to discover who would try to access, steal and destroy the exposed data, and where those unauthorised requests come from.
According to researchers, the first attack on the bogus database came after just 7 hours and 31 minutes. In total, 428 unauthorised connections were recorded over a three-month period, between 6th December 2019 and 7th March 2020.

The researchers also recorded 137 unauthorised requests that attempted to view, scrape, and download data without authorisation; and 34 destructive requests, which modified or destroyed data on the server.
Click to expand...

Comparitech: If you expose it, they will come: our data honeypot draws hundreds of attackers

We were interested to find out the nature of these unauthorized requests and where they come from. To do so, Comparitech researchers created a MongoDB database on an unsecured server to use as a honeypot.
The experiment is similar to an earlier one in which we exposed an Elasticsearch database honeypot to see how long it would take unauthorized users to find and attack it. This study focuses on the origin and nature of those attacks.

Here’s a breakdown of what we found:
Click to expand...

guest · Aug 10, 2021

Enfilade: Open source tool flags ransomware and bot infections in MongoDB instances
August 6, 2021
https://portswigger.net/daily-swig/...mware-and-bot-infections-in-mongodb-instances

An open source tool that detects internet-facing MongoDB instances and whether they’ve been infected with ransomware or Meow malware has been launched.

‘Enfilade’ can also perform more intrusive checks whereby it scans “each configured database with collections to map potential infections”, security practitioner and advisor Aditya K Sood told The Daily Swig.
Sood developed the tool with Rohit Bansal, principal security researcher with SecNiche Security Labs, in collaboration with F5’s CTO office.
Click to expand...

Enfilade, which Sood says “is primarily focused on the network service for MongoDB communication started on TCP port 27017”, currently offers the following modules:

Scanning for internet-exposed MongoDB instances

Detection, via basic or intrusive checks, of Meow or ransomware infections

Reconnaissance and information gathering on MongoDB instances

Checking access permissions for assessing remote command execution

User enumeration

Click to expand...

According to research conducted by infosec firm Intruder, unsecured MongoDB instances are typically compromised within 24 hours of going online.

Sood and Bansal gauged the scale of the problem themselves by scanning vulnerable IP address spaces belonging to hosting providers for evidence of ransomware infections in MongoDB instances, with 3,586 infections flagged in China an US alone, as revealed in a blog post published by Sood.
Click to expand...

He expects to add more modules to the tool in the future, but in the meantime “other developers can amend and enhance the tool accordingly”.
They released the project on GitHub on Wednesday (August 4) regardless and their presentation slides are available on Sood’s blog post.
Click to expand...

Log in or Sign up

MongoDB is subject to continual attacks when exposed to the internet

guest Guest

guest Guest

guest Guest

Log in or Sign up

MongoDB is subject to continual attacks when exposed to the internet

guest Guest

guest Guest

guest Guest

Useful Searches