The blog of Shodan, the internet-wide device search engine, reporting on exposed databases, protocols, certificates and internet-scale trends.
HN links it for data on exposed MongoDB and other services, and for the favicon-hash technique used to find a hacked site's pre-production server.
By default though, MongoDB will only listen on localhost and I believe it'll show you a big warning on boot up if you don't have authentication configured. They used to listen on 0.0.0.0 by default but that was fixed many years ago.
And this issue doesn't just affect MongoDB - imo since the "webscale" days it's been a favorite to knock on but the public exposure of data happens across many technologies. Here's a comparison with a few others:
https://blog.shodan.io/elastic-data-exposure-grows-to-3-2-pb/
Previously: https://blog.shodan.io/dont-be-clever/
> For example, you might know that Shodan crawls the Internet for industrial control systems (ICS). One of the most popular protocols in ICS is called Modbus that runs on port 502. At the moment, there are about 17,000 devices listening to Modbus on the default port. It turns out there are also 700 devices listening on port 503, again a one-off sort of situation.
Probably over 20k by now
> A MongoDB database open to the outside world on a public IP address?
Maybe someone was inspired by this article?
https://blog.shodan.io/its-still-the-data-stupid/
> At the moment, there are at least 35,000 publicly available, unauthenticated instances of MongoDB running on the Internet. [...] all of the exposed databases combined account for 684.8 TB of data.
While unfortunately in french, the detailed write-up of the hack [0] is worth a read.
The first step was finding out the pre-prod sever through the hash of the site's favicon in Shodan [1]
[0] https://yggleak.top/fr/home/ygg-dossier#le-hack
[1] https://blog.shodan.io/deep-dive-http-favicon/
Seeing the "_id" : ObjectId() fields indicates to me that this is likely a mongodb instance that was available to everyone.
There's been a lot of talk about these recently[1] that I'm surprised this didn't come up sooner.
[1] https://blog.shodan.io/its-still-the-data-stupid/
"Recent" versions aren't. If you install .rpm/.deb versions you're also covered
(And anyone who deploys any service on an internet-facing server should know what they're doing)
See https://blog.shodan.io/its-the-data-stupid/