Iranian Ride-Hailing App Database Exposure

guest · Apr 18, 2019

Iranian Ride-Hailing App Database Exposure
April 18, 2019
https://securitydiscovery.com/iranian-ride-hailing-app-database-exposure/

On April 18th, during our regular security audit of nonSql databases with BinaryEdge search engine, I have discovered an open and publicly available MongoDB instance which contained astonishingly sensitive information on Iranian drivers.

I have immediately sent an alert to the Iranian CERT and also initiated own investigation with the assistance of dedicated security researchers on the ground. We were able to get in touch with a couple of drivers with an attempt to identify the owner of the database.

Danger of having exposed MongoDB or similar NoSql databases is huge. I have previously reported that the lack of authentication allowed the installation of malware or ransomware on the MongoDB servers.
The public configuration allows the possibility of cybercriminals to manage the whole system with full administrative privileges. Once the malware is in place criminals could remotely access the server resources and even launch a code execution to steal or completely destroy any saved data the server contains.
Click to expand...

Log in or Sign up

Iranian Ride-Hailing App Database Exposure

guest Guest

Log in or Sign up

Iranian Ride-Hailing App Database Exposure

guest Guest

Useful Searches