{"id":56076,"date":"2017-01-12T19:02:50","date_gmt":"2017-01-12T19:02:50","guid":{"rendered":"https:\/\/www.pcmatic.com\/blog\/?p=56076"},"modified":"2017-01-12T19:02:50","modified_gmt":"2017-01-12T19:02:50","slug":"latest-ransomware-craze-holding-mongodb-databases-hostage","status":"publish","type":"post","link":"https:\/\/www.pcmatic.com\/blog\/latest-ransomware-craze-holding-mongodb-databases-hostage\/","title":{"rendered":"The Latest Ransomware Craze \u2013 Holding MongoDB Databases Hostage"},"content":{"rendered":"

As if our jobs as IT admins isn\u2019t difficult enough, hackers have taken to finding misconfigured MongoDB databases, and are holding them hostage, until a ransom has been paid. Similar to traditional ransomware, where files on a computer are encrypted until a fee has been paid, databases, are being held hostage, instead.<\/p>\n

The modus operandi is the hackers look for open ports, particularly 27017, and find MongoDB instances where security settings, such as usernames and passwords, are not set properly. Once they find the database, they back it up to their own servers, but then delete it on your server. Afterwards, they create a replacement database with names like \u201cCONTACTME\u201d or \u201cPLEASE_READ.\u201d In the ransom notes left behind, the hacker states they have saved all of the data, and if the victim wants to recover the data, they would need to send Bitcoins, an anonymous online currency, to a specific Bitcoin wallet. Once the victim pays the ransom, the victim would send an email to the hacker with their IP address. Afterwards, the hacker would restore the data.<\/p>\n

Unfortunately, this threat doesn\u2019t appear to be a one-off situation. Princeton University recently became a victim of one of the 27,000 MongoDB ransomware attacks. In their case, the database instance was wiped, and a replacement database, called PLEASE_READ, was left behind. The hacker was requesting .2 BTC, or roughly $160.58. This seems like a low price to pay for having the data restored, however, in many instances, the hackers actually do not return the data.<\/p>\n

For those of us who run MongoDB instances, please see this article<\/a> on how to avoid ransom attacks. More specifically, the Security Checklist<\/a>, written by MongoDB, states you should follow these best practices<\/p>\n