3 ms·
Am I right that HackedDB could be because someone who noticed the lack of authentication created such database? If I can connect to an instance without auth, I
by nevi-me 11y ago
Am I right that HackedDB could be because someone who noticed the lack of authentication created such database?
If I can connect to an instance without auth, I can also create a DB and collections etc.
- achillean 11y agoYes, it could be that there was somebody before me that already noticed this issue and decided to exploit it :-/ I saw on Twitter that there actually was a talk in 2013 at DEFCON about these sorts of problems in NoSQL, so in certain circles it's been known for a while just not acted upon.
- tracker1 11y agoIt's still surprising... I've used MongoDB a few times, but I was always well aware to put it behind a firewall and setup basic auth. I'm not really one for super fine grained security at the database level, but you should at least have some level of connection controls in place. iptables isn't that hard.