How do hackers hack MongoDB instances?
This week I got my mongodb instances hacked two times. Since it is a test database there is no damage. But my question is how it possible?
I've setup a unique password for my db? If the hacker can figure out my password, is it not possible they can hack every other accounts on the internet too?
I've hosted my db on AWS. And my port is open to connect from anywhere. I know it shouldn't be kept like that. I am only doing it since it is a test db. My biggest question is how easy is to a hacker to break passwords?
This is the document hacker left on my db:
"All your data is a backed up. You must pay 0.021 BTC to 1Di1cM1QgTxZuwsxp9nRBc6UXUAhbMN7YX 48 hours for recover it. After 48 hours expiration we will leaked and exposed all your data. In case of refusal to pay, we will contact the General Data Protection Regulation, GDPR and notify them that you store user data in an open form and is not safe. Under the rules of the law, you face a heavy fine or arrest and your base dump will be dropped from our server! You can buy bitcoin here, does not take much time to buy https://localbitcoins.com or https://buy.moonpay.io/ After paying write to me in the mail with your DB IP: recmydb+1j117@onionmail.org and you will receive a link to download your database dump."
Any tips on protecting aws EC2 instances also welcome. Thank you.
We really discourage people doing this, there are so many potential attack vectors. If you want a secure test cluster we provide a free tier in MongoDB Atlas which serves many people's low end needs and doesn't expose all the attack vectors associated with an EC2 instance. Easier to manage and more secure to boot.
See https://www.mongodb.com/cloud/atlas/register2 to sign up.
So many possibilities. You could have a weak password, they could have exploited a mongo vulnerability, most likely they hacked your VM which has a much larger attack surface.
What else is running on the EC2 instance? What kind of access to the public Internet have you enabled for it?
Does the test database contain sensitive data? If not, you can ignore the ransom.