For this problem, I'm trying to build a little api. In my opinion, HTTP Interface in the mongoDB documentation could be helpful. If you experienced same security issue, please share your solution please.

Through twitter, I heard unauthorized mongoDB instance is under ransom attack. Last night, my instance was also attacked and the attacker left this message.

    "_id" : ObjectId("58748d080c474c0f5c1a1b2e"),  
    "Info" : "Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip",  
    "Bitcoin Address" : "1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF",  
    "Email" : "kraken0@india.com"  

I looked up my system log, and found malicious activity like below. They removed my whole database, and replaced it PLEASE_READEME with above message.

2017-01-10T05:27:37.126+0000 I NETWORK  [initandlisten] connection accepted from #193 (25 connections now open)
2017-01-10T05:27:39.008+0000 I NETWORK  [initandlisten] connection accepted from #194 (26 connections now open)
2017-01-10T05:28:08.783+0000 I COMMAND  [conn194] dropDatabase local starting
2017-01-10T05:28:08.783+0000 I JOURNAL  [conn194] journalCleanup...
2017-01-10T05:28:08.783+0000 I JOURNAL  [conn194] removeJournalFiles
2017-01-10T05:28:08.793+0000 I JOURNAL  [conn194] journalCleanup...
2017-01-10T05:28:08.793+0000 I JOURNAL  [conn194] removeJournalFiles
2017-01-10T05:28:08.796+0000 I COMMAND  [conn194] dropDatabase local finished
2017-01-10T05:28:09.110+0000 I COMMAND  [conn194] dropDatabase admin starting
2017-01-10T05:28:09.110+0000 I JOURNAL  [conn194] journalCleanup...
2017-01-10T05:28:09.110+0000 I JOURNAL  [conn194] removeJournalFiles
2017-01-10T05:28:09.122+0000 I JOURNAL  [conn194] journalCleanup...
2017-01-10T05:28:09.122+0000 I JOURNAL  [conn194] removeJournalFiles
2017-01-10T05:28:09.125+0000 I COMMAND  [conn194] dropDatabase admin finished
2017-01-10T05:28:09.448+0000 I COMMAND  [conn194] dropDatabase babpicnic starting
2017-01-10T05:28:09.448+0000 I JOURNAL  [conn194] journalCleanup...
2017-01-10T05:28:09.448+0000 I JOURNAL  [conn194] removeJournalFiles
2017-01-10T05:28:09.454+0000 I JOURNAL  [conn194] journalCleanup...
2017-01-10T05:28:09.454+0000 I JOURNAL  [conn194] removeJournalFiles
2017-01-10T05:28:09.458+0000 I COMMAND  [conn194] dropDatabase babpicnic finished
2017-01-10T05:28:13.562+0000 I INDEX    [conn194] allocating new ns file /var/lib/mongodb/PLEASE_READ.ns, filling with zeroes...
2017-01-10T05:28:13.626+0000 I STORAGE  [FileAllocator] allocating new datafile /var/lib/mongodb/PLEASE_READ.0, filling with zeroes...
2017-01-10T05:28:13.628+0000 I STORAGE  [FileAllocator] done allocating datafile /var/lib/mongodb/PLEASE_READ.0, size: 64MB,  took 0.001 secs
2017-01-10T05:38:59.302+0000 I NETWORK  [conn194] end connection (25 connections now open)
2017-01-10T05:49:56.085+0000 I NETWORK  [conn193] end connection (24 connections now open)

I closed server's 27017 port, and replaced bindIP configuration to localhost. After reading mongoDB team's official blog post How to Avoid a Malicious Attack That Ransoms Your Data, I'am looking for hardening security and preventing repeated attack.

My circumstance is:

  • mongoDB 3.2, mongoDB java driver 3.2
  • instance is running on Amazon EC2 ubuntu server (OS version 16.04)
  • before ransom attack, 27017 port was opened for

My desired goal is:

  1. Adding java code for user authorization on android application.
    on mongoDB, I added root and appUser account reffering to MongoDB allow access only from local server
  2. Or, I'm considering to use socket access for mongoDB. Already I'm using socket.io nodejs application on the server for loading previous chat messages. I'm wondering it's OK for general means using mongoDB instance.

I searched through Google and Stack Overflow with keyword 'mongodb' and 'ransom', but it resulted in general security instruction pages. They're just full of news reporting without real user's solution or experience. I need practical security tutorials.

closed as unclear what you're asking by RLF, Erik, Philᵀᴹ, dezso, Daniel Vérité Jan 27 '17 at 21:06

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    The MongoDB blog post includes suggested steps. You should definitely review the Security Checklist for relevant information and tutorials. In addition to security you should also have a backup strategy in place if this is important data. What further information are you looking for? – Stennie Jan 11 '17 at 10:33
  • @Stennie thanks for your comment. I'm looking for actual example, such as blog post by whom experienced same issue. If there's nothing, I will add post on this question after reading the post. – pty115 Jan 11 '17 at 10:41
  • The official blog post and tutorials in the Security Checklist should be what you're looking for. I would follow those tutorials over a third party blog to be certain all aspects have been considered. It sounds like your Android app is directly connecting to MongoDB; is this a public or private application? You definitely want to make sure you have SSL enabled for network comms, but ideally should have your Android app talking to an API rather directly to the database. If your app is public and embeds MongoDB credentials someone could potentially extract those. – Stennie Jan 11 '17 at 10:55
  • @Stennie Oh, thanks you. If I add new java code for authentication, then it could be extracted by another attacker. I'll read mongodb security documentation and find how to build something like center-man. thanks really! – pty115 Jan 11 '17 at 12:44

I rather prefer socket connection than http interface, so I solved this issue with nodeJS socket api. If you know any possible potential problem of this method, please let me know. Here is server-side code snippet.

/* create http server with express */
var app = require('express')();
var http = require('http').Server(app);
var io = require('socket.io')(http);

/* connect to local mongoDB */
var mongo = require('mongodb').MongoClient;
var url = 'mongodb://localhost:27017/babpicnic';

io.on('connection', function(socket){

        /* event listener for : sending list of existing room */
        socket.on('existing room', function(){
                mongo.connect(url, function (err, db) {
                        var collection = db.collection('roomList')
                        var stream = collection.find().stream();
                        stream.on('data', function (room) { socket.emit('existing room', room); });


        /*  event listener for : adding new room to mongoDB */
        socket.on('new room', function(data){
                mongo.connect(url, function (err, db) {
                        var collection = db.collection('roomList');
                if (err) { console.warn(err.message); }
                                else { console.log("new chatroom was created : " + data); }

/* start http server */
http.listen(8080, function(){
  console.log('listening on localhost:8080');

thanks for reading.

Not the answer you're looking for? Browse other questions tagged or ask your own question.