Thousands of MongoDB databases hit with ransomware-style attacks

[midian182]

Hacking groups are breaking into thousands of systems running MongoDB database software before copying then deleting the contents. The groups are demanding between $180 to $900 worth of Bitcoins to return the data, but paying the ransom doesn’t guarantee that the databases will be restored.

It’s now estimated that a massive 27,000 internet-connected MongoDB systems have been compromised. The hackers are targeting software without a password on the administrator account, which is thought to cover around 99,000 systems.

The attacks started on December 20 when a hacker copied information from one of these open databases, deleted the original content, and left a ransom note in its place. The first hacks requested 0.2 Bitcoins (around $181) but the price increased in future instances. One group reportedly demanded one bitcoin, equal to around $905.

Worst of all, security researchers  Niall Merrigan and Victor Gevers say that some of the groups aren’t even making copies of the deleted data. The hackers are simply erasing everything and leaving ransom notes, which means the companies won’t get their databases back even if they do hand over the Bitcoins.

Furthermore, it seems that so many groups (possibly eight) are compromising MongoDB systems, the same databases are getting re-hacked and ransom notes are being replaced with versions from another team. All this means that companies have no idea which group (if any) has the data and to whom they should pay the Bitcoins.

"Right now it's bedlem [sic]," Merrigan told Bleeping Computer yesterday, "attackers are deleting each others' ransoms as quick as they pop up."  

MongoDB developers have addressed the attacks by updating the software’s security guide, which you can read here.

Permalink to story.

https://www.techspot.com/news/67700-thousands-mongodb-databases-hit-ransomware-style-attacks.html

 

[captaincranky]

Since hacking already is illegal, events like this make a strong case for making crypto-currency illegal as well. Law enforcement needs to be able to "follow the money", or this type of crime will only increase.

 

[Kibaruk]

Since hacking already is illegal, events like this make a strong case for making crypto-currency illegal as well. Law enforcement needs to be able to "follow the money", or this type of crime will only increase.

If it's "companies" that don't know Admin accounts need to be secured, either because of Lazy IT or not spending in IT...

How much of a "hack" is it if you leave your car with the window open and the keys on the ignite?

 

[Mr Dude]

Since hacking already is illegal, events like this make a strong case for making crypto-currency illegal as well. Law enforcement needs to be able to "follow the money", or this type of crime will only increase.

The hackers are targeting software without a password on the administrator account,

In this particular case, the crypto-currency isn't so much a problem as is hiring untrained monkeys, just so that you can have database "security" for peanuts. You get what you pay for, I suppose. At least the ransoms are also on the cheap.

 

[captaincranky]

If it's "companies" that don't know Admin accounts need to be secured, either because of Lazy IT or not spending in IT...

How much of a "hack" is it if you leave your car with the window open and the keys on the ignite?

Well, if you leave your keys in your car, and someone steals it, it's still "Grand Theft Auto". If the thief tries to sell it back to you, for any form of currency, the crime would be called "grand theft automobile & extortion".

Or don't you think those concepts exist in your little digital wonderland?

Just because a car thief goes for the easy score, it doesn't make him any less of a car thief.

And due to the fact information usable to create much larger financial damage and loss can be obtained by hacking, the penalties for it should be raised proportionally.

After all, if your new car is stolen, (which incidentally is getting harder and harder to do these days, WITHOUT any additional security intervention(s) on the part of the owner), the insurance company buys you a new car. (Minus the deductible, of course).

If a hacker steals your identity, NOBODY buys you a new one. So maybe hacks at these levels, should be turned into a capital offense. After all, if they hacker is dead, then you, ("by default"), get to be you again...(y)

 

[captaincranky]

In this particular case, the crypto-currency isn't so much a problem as is hiring untrained monkeys, just so that you can have database "security" for peanuts. You get what you pay for, I suppose. At least the ransoms are also on the cheap.

Since you very obviously didn't read the whole story, I'll help you to understand it. You pay the ransom and in many cases, you still don't get your data back. How the f*** is that, "on the cheap"?

 

[Kibaruk]

Well, if you leave your keys in your car, and someone steals it, it's still "Grand Theft Auto". If the thief tries to sell it back to you, for any form of currency, the crime would be called "grand theft automobile & extortion".

Data steal & cyber extortion?