4 ms·
For fun: - I see 67,569 mongodb results on shodan - I searched for shodan API keys on a shady website known as "Github", found one that works, queried for all
by aboutruby 8y ago
For fun:
- I see 67,569 mongodb results on shodan
- I searched for shodan API keys on a shady website known as "Github", found one that works, queried for all the mongodb databases
- Tried connecting on the first one, it works...
- What next?
edit: I guess it's a choose your own adventure game:
1) Delete all the data
2) Look up domains from IPs, find owner's emails and email them
3) Make nice stats about all the data
4) Sell the data on the black market
5) Find user's emails, and tell them they are using a service that just doesn't care
6) Just make every ~third integer off by 1
7) Mine bitcoins on them
... So many ideas, so little time
- opportune 8y agoAs much of a game as it may seem, a lot of these could put you in prison.
- aboutruby 8y agoI will go with "Let it be, hoping someone does something about it someday somehow"
- Sendotsh 8y agoDepending on your country, just loading that first one up to see if it worked could put you in prison.
- btown 8y agoIn the United States, simply accessing a publicly accessible URL can put you in prison, assuming the government doesn't lose the appeal on the technicality of a choice of venue, which they won't do a second time... https://www.eff.org/press/releases/appeals-court-overturns-andrew-weev-auernheimer-conviction https://www.eff.org/press/releases/appeals-court-overturns-a...
- Pristina 8y agoHe was convicted by a jury of his 'peers'.
- xvector 8y agoMy biggest problem with the justice system. Do any of us really trust our peers?
- smilliken 8y agoWho would you prefer to be on the jury?
- xvector 8y agoThat's a much harder question and one I don't claim to have an answer to. It doesn't change the fact that I don't trust my peers. I don't trust your average American to be informed enough and educated enough to make decisions about my life. Jury of peers might as well be trial by mob.
- beatgammit 8y agoWell, it's better than a trial by your accuser.
- opportune 8y agoNot just peers, peers who didn't get out of jury duty. Personally I think jury duty should just be mandatory (with the only exceptions being extreme circumstances) because it being so easy to get out of creates a major bias in the set of people actually doing jury duty.
- deleted 8y ago[deleted]
- cabaalis 8y agoAs well it should. Comparable activity: let's ride around the neighborhood and see who hides a key under a rock. Then let ourselves in and look around.
- dsfyu404ed 8y agoPhysical analogies for security like the one you just made are useless because they don't reflect how the computers and the internet work. You can't just ping a rock and ask it if it's got a key. The rock isn't expected to exist in a world where some script kiddie in China is going to ask it if is has a key every 5min. The analogy simply falls flat on its face once you try to use it to reason about anything because existing as an internet connected device is far different than existing on private (but easily accessible) property.
- cabaalis 8y agoIf you'll refer to what I was replying to, I wasn't talking about physical security being analagous to digital security. I was saying it is illegal to attempt to open and access property that you do not own.
- vorpalhex 8y ago"Let's ride around the neighborhood and see who left all their belongings in their front yard" would be a closer example. Imagine if your Doctor left your personal medical records lying on the ground in front of their office...
- nkrisc 8y agoThat's an absurd analogy. How are you supposed to know if a completely unauthenticated URL is meant to be private or not? If we're going to try to force physical analogies to represent the digital, I would say it's more like every store, house, and public building looks exactly the same and you don't know if the door is locked or what's inside it until you try to open it.
- cabaalis 8y ago
- tgsovlerkhgsel 8y agoThe canonical approach seems to be "encrypt the data in place, ask for Bitcoin"
- auslander 8y agoboring. Configuring them all as a replica of each other is more fun
- deleted 8y ago[deleted]
- tetha 8y agoGenerate records in them containing "Help, I'm trapped in the MongoDB development building and food is running out!" every couple of month :)
- aboutruby 8y agoI'm actually curious why this wasn't done yet, or maybe I'm missing something