MongoDB held for ransom

Question

My mongodb is now contained in the ransom with the message "Your database is backed up on our servers to restore sending 0.1 BTC to the bitcoin address, and then send an email with your ip server." After reading many articles, I'm still not sure what a public database means. I am currently accessing my SSH database in my own droplet with username and password and connecting through port 27017, how can a hacker access my database? Please tell me what to do to prevent this from happening in the future! thank you

Answer 1

To prevent this type of hack, you need to make your database secure.

Add the security.authorization parameter to the configuration file

security: authorization: enabled 

Before turning on, make sure you create a root user with login credentials.

Example:

 $ use admin $ db.createUser( { user: "superAdmin", pwd: "mySecurePassword", roles: [ { role: "root", db: "admin" } ] }) 

you may also need to create a separate application for each database with limited access, for more information I wrote one blog here MongoDB enable authentication .

for more information, see the MongoDB Security Best Practices and MongoDB Security Checklist