Home » Cybersecurity » SBN News » 12,000+ unsecured MongoDB databases deleted by Unistellar attackers

12,000+ unsecured MongoDB databases deleted by Unistellar attackers

by Vincy Davis on May 21, 2019

Attackers looking for exposed database servers use BinaryEdge or Shodan search engines to delete them and usually demand a ransom for their ‘restoration services’. MongoDB is not new to such attacks, previously in September 2017 MongoDB databases were hacked, for ransom.

Also, earlier this month, Security Discovery researcher Bob Diachenko found an unprotected MongoDB database which exposed 275M personal records of Indian citizens. The record contained a personal detailed identifiable information such as name, gender, date of birth, email, mobile phone number, and many more. This information was left exposed and unprotected on the Internet for more than two weeks.

Database with 250M+ very detailed Indian resumes that I reported a week ago was dropped by malicious actors. As per my investigation, database was not part of any company but rather scraped data collected by unknown org/person. pic.twitter.com/Z4776FOz9C
— Bob Diachenko (@MayhemDayOne) May 8, 2019

The latest attack on MongoDB database was found out by Sanyam Jain, an independent security researcher. Sanyam first noticed the attacks on April 24, when he initially discovered a wiped MongoDB database. Instead of finding the huge quantities of leaked data, he found a note stating: “Restore ? Contact : [email protected]”.

It was later discovered that the cyber-extortionists have left behind ransom notes asking the victims to get in touch, if they want to restore their data. Two email addresses were provided for the same: [email protected] or [email protected]. This method to find and wipe databases in such large numbers is expected to be automated by the attackers. The script or program used to connect to the publicly accessible MongoDB databases is also configured to indiscriminately delete every unsecured MongoDB it can find and later add it to the ransom table.

In a statement to Bleeping Computer, Sanyam Jain says, “the Unistellar attackers seem to have created restore points to be able to restore the databases they deleted”

Sponsorships Available

Bleeping Computer have stated that there is no way to track if the victims have been paying for the databases to be restored because Unistellar only provides an email to be contacted and no cryptocurrency address is provided. Bleeping Computer also tried to get in touch with Unistellar to confirm if the wiped MongoDB databases are indeed backed up and if any victim have already paid for their “restoration services” but got no response.

How to secure MongoDB databases

MongoDB databases are remotely accessible and access to them is not properly secured. These frequent attacks highlight the need for an effective protection of data. This is possible by following fairly simple steps designed to properly secure one’s database. Users should take the simple preventive measure of enabling authentication and not allowing the databases to be remotely accessible.

MongoDB has also provided a detailed manual for Security. It includes various features, such as authentication, access control, encryption, to secure a MongoDB deployments. There’s also a Security Checklist for administrators to protect the MongoDB deployment. The list discusses the proper way of enforcing authentication, enabling role-based access control, encrypt communication, limiting network exposure and many more factors for effectively securing MongoDB databases.

To know more about this news in detail, head over to Bleeping Computer’s complete coverage.