What's happened?
Tens of thousands of unprotected MongoDB databases have been taken hostage by hackers, who have wiped data from company servers and are demanding a ransom be paid for the safe return of the information. Some have suggested that the number of affected databases could be in the region of 27,000.
MongoDB? What's that?
MongoDB is an open source document database.
And it has a vulnerability that the hackers were able to exploit? Sheesh...
Not so fast. There are security measures built into MongoDB, it's just that some users don't bother to use them. For instance, some MongoDB administrators have been leaving their systems accessible to the open internet, without having so much as an admin password in place.
Why would anyone be running an open MongoDB instance?
Because they like living dangerously? Because they get a kick out of being reckless with people's data?
Seriously, there's no good reason. It's a crazy thing to do.
I'm sure I've heard of people breaking into unsecured MongoDB databases before and stealing data
Yup, it's not rocket science. For instance, a researcher stumbled across the details of 13 million Mac users after controversial firm MacKeeperleft them exposed for any Tom, Dick or Harry to see in an unprotected MongoDB instance.
But what's different in this case is that an intruder is not just stealing the data, they're also wiping the victim's copy and attempting to extort a Bitcoin ransom:
"SEND 0.2 BTC TO THIS ADDRESS 13zaxGVjj9MNc2jyvDRhLyYpkCh323MsMq AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !"
Might MongoDB instances that are protected by a password or are not accessible via the public internet also be at risk?
To date the attacks have only been against MongoDB instances that have been left wide open by lackadaisical administrators. In theory it might be possible to launch attacks against instances where admins have used easy-to-guess passwords, but there's no reason to believe that's likely to happen at the moment.
The message is simple - use strong, unique passwords and don't connect things to the internet unless they need to be connected to the internet.
Yes, you've heard that advice before. No, people don't seem to be getting the message. Sigh...
What is the company behind MongoDB doing about it?
I imagine it is feeling pretty frustrated that some of their users are being so careless with the software.
MongoDB Inc clearly needs to reach out to the community and underline the importance of not having unsecured instances of MongoDB running openly on the net. It has posted some advice for users on its website.
Of course, the damage is somewhat lessened if you had taken the precaution of backing up your database. If that's the case then you only have the embarrassing problem of explaining to your customers that their data has been stolen and personal information exposed, rather than be utterly incapable of doing any business.
However, if you're the kind of outfit that doesn't have an admin password for your database and leaves it open to the internet then I don't hold out much hope that you've been making backups...