> The source of the configuration error isn't clear, as neither the ISP nor Sanrio has answered questions on the matter.
A MongoDB database open to the outside world on a public IP address?
Maybe someone was inspired by this article?
https://blog.shodan.io/its-still-the-data-stupid/
> At the moment, there are at least 35,000 publicly available, unauthenticated instances of MongoDB running on the Internet. [...] all of the exposed databases combined account for 684.8 TB of data.
German article about it: https://www.woz.ch/-41f8
1. There is no password prompt during installation. This was the same problem many relational databases had back in the day with default user credentials. Today, I don't know of a single relational datastore that comes with default credentials during installation. (ignoring things that shouldn't go to production like homebrew) Individually, they all said it was a "security threat" and did something about it.
2. Things like MMS or other offering from MongoDB itself expect you expose your nodes externally so they can manage things for you. This can easily be made secure... but its contradictory in nature. It suggests to somebody who probably doesn't know what they're doing on the IT or DevOps fronts to do something more easily dangerous than not... just so they can sell their vendor services to you. Its a recipe for disaster but its also easily fixable with a few design changes on their side.
MongoDB is repeating the same mistakes others made 15 years ago.
Sounds like we both agree that MongoDB is repeating the same mistakes others had made 15 years ago. The only difference is, back then, there was a less dramatic excuse for how it got that way.
But yeah, that's not good.
The default configuration for MongoDB is to listen on localhost only. Someone changed the configuration if it was listening on a public IP.
Feb 2015:
Discovered 40,000 vulnerable MongoDB databases on the Internet
http://securityaffairs.co/wordpress/33487/hacking/40000-vuln...
The changes were made after this, so we're only talking a few months now.
That's true, but I remember that change was only made recently. Before, mongo would listen on all IPs and had no passwords.
It also implies frontend server includes the DB, typically a sysadmin would de-couple it so this shows lack of experience.