{"id":1756,"date":"2020-08-24T18:01:44","date_gmt":"2020-08-24T12:31:44","guid":{"rendered":"https:\/\/www.tikaj.com\/?p=1756"},"modified":"2024-01-11T11:25:46","modified_gmt":"2024-01-11T05:55:46","slug":"we-scanned-5-million-ip-addresses-for-database-vulnerabilities-analysis-and-insights-2020","status":"publish","type":"post","link":"https:\/\/www.tikaj.com\/blog\/we-scanned-5-million-ip-addresses-for-database-vulnerabilities-analysis-and-insights-2020\/","title":{"rendered":"We scanned 5 million+ IP Addresses for database vulnerabilities : Analysis and Insights, 2020"},"content":{"rendered":"\n
\n\n\n\n

Recently, in the month of August 2020, our team at TIKAJ<\/a> conducted an extensive research to discover open Mongodb<\/a> instances all over the internet. Even after 8 years of being reported<\/a> Mongodb open port vulnerabilities are being exploited in wild for data breaches. With this research, we wanted to find out how educated and serious developers are about this vulnerability.<\/p>\n\n\n\n

The Statistics<\/h3>\n\n\n\n

We scanned 5 million+ IP addresses over the internet within 4 days, out of which exactly 1,42,366 servers had port 27017 open for connection. What we discovered as a result of this 4 days long research, was a whopping number of 1006 unauthenticated Mongodb server instances, either compromised or waiting to be compromised.<\/p>\n\n\n\n

Since the numbers amused us pretty well, we jumped in to get our hands dirty and reveal some more patterns in this vast data pool. Not to our surprise, out of these open unauthenticated database servers, 863 have already been compromised and breached, and are held for ransom. The total accumulative size of the discovered data is about ~ 4 Terabytes.<\/p>\n\n\n\n

\"\"<\/a>
Stats at Glance<\/figcaption><\/figure>\n\n\n\n

The discovered databases on servers include several datasets which have extensive personal information of individuals like phone number, email addresses, address, login information.<\/p>\n\n\n\n

One such databases, that caught our attention is a known Canadian Massage Service Provider Company, that has its customer\u2019s name, phone numbers, addresses, preferences, booking history and transactions database open in the internet. Moreover there are similar personal information of therapists and admins exposed via same database.<\/p>\n\n\n\n

\"\"<\/a>
Customer data leaked via a massage provider company<\/figcaption><\/figure>\n\n\n\n

More interestingly they have even pinpointed the customer addresses precisely with Geo-coordinates and other suggestive landmarks, no doubt along with the exact postal address.<\/p>\n\n\n\n

\"\"<\/a>
Customer address leaked<\/figcaption><\/figure>\n\n\n\n

In another database, an Indian Corporate Cab Service Provider, has data exposed of their travelers along with their email address, phone numbers and pickup and drop coordinates.<\/p>\n\n\n\n

\"Travel<\/figure>\n\n\n\n

Few more interesting datasets:<\/p>\n\n\n\n

\"Popular
Dataset from a popular Linkedin Bot<\/figcaption><\/figure>\n\n\n\n
\"Linkedin<\/figure>\n\n\n\n
\"Linkedin<\/figure>\n\n\n\n
\"Linkedin<\/figure>\n\n\n\n
\"Linkedin<\/figure>\n\n\n\n

The affected industry types, as we have analysed, are Personal care services, Restaurant POS, E-commerce, Transaction based systems, Transport services, Educational Institutes and many more.<\/p>\n\n\n\n

One can easily imagine, what cyber attacks can be pulled off with such variety of personal information of individuals\u200a\u2014\u200aranging from targeted social engineered phishing attacks to direct financial attacks.<\/p>\n\n\n\n

There were several server credentials exposed through various configs stored in these vulnerable databases, which can be directly exploited for complete server compromises and data breaches. <\/p>\n\n\n\n

Ransom Tale<\/h3>\n\n\n\n

The most interesting fact is that out of the discovered 1006 databases, 843 have already been compromised (i.e ~84%), held for ransom demands, and have still been unnoticed by the server owners! The attackers (being creative!) put up interesting HOW TO or README guides in collections to notify the owner of the databases that their databases have been backed up and that they must pay ransom in Bitcoins to avoid data leakage. One such pretty message is below.<\/p>\n\n\n\n

\"Ransom
Ransom demand notes on compromised databases<\/figcaption><\/figure>\n\n\n\n

Interestingly, many attackers have coupled their ransom demands with the threat of filing complaints against DB owners under General Data Protection Regulation<\/a>. One such message:<\/p>\n\n\n\n

All your data is a backed up. You must pay 0.015 BTC to xxxxxxxxxxxxxxxxxxxxxx 48 hours for recover it. After 48 hours expiration we will leaked and exposed all your data. In case of refusal to pay, we will contact the General Data Protection Regulation, GDPR and notify them that you store user data in an open form and is not safe. Under the rules of the law, you face a heavy fine or arrest and your base dump will be dropped from our server! You can buy bitcoin here, does not take much time to buy https:\/\/localbitcoins.com<\/a> with this guide https:\/\/localbitcoins.com\/guides\/how-to-buy-bitcoins<\/a><\/p><\/blockquote>\n\n\n\n

Top 5 Common database names<\/h3>\n\n\n\n