server that was leaking detailed personal details of nearly half a
million Indian citizens… thanks to another MongoDB database
instance that company left unprotected on the Internet accessible
to anyone without password.
In a report shared with The Hacker News, Bob
Diachenko disclosed[1] that two days ago he
found a 4.1 GB-sized highly sensitive database online, named
“GNCTD,” containing information collected on 458,388
individuals located in Delhi, including their Aadhaar
numbers and voter ID numbers.
Though it’s not clear if the exposed database is linked to the
Government of National Capital Territory of Delhi (GNCTD),
Diachenko found that the database contains references and email
addresses with “transerve.com” domain for users registered with
“senior supervisor,” and “super admin” designations.
Based upon the information available on Transerve
Technologies website, it is a Goa-based company that
offers geospatial technology-based SaaS solutions and specializes
in smart city solutions and advanced data collection
technology.
The company’s data collector, location intelligence and precision
mapping tool help businesses and Governments to utilize
Geo-location data to make smart decisions intelligently.
The leaked database contains the following tables:
- EB Users (14,861 records)
- Households (102,863 records)
- Individuals (458,388 records)
- Registered Users (399 records)
- Users (2,983 records)
“It remains unknown just how long database was online and if anyone
else accessed it,” Diachenko said.
registered users includes email addresses, hashed passwords and
usernames for administrator access.
collection which was basically a pretty detailed portrait of a
person, incl. health conditions, education, etc.,” Diachenko said.
“Households collection contained fields such as ‘name’, ‘house
no’, ‘floor number’, ‘geolocation’, area details, ’email_ID’ of a
supervisor, ‘is the household cooperating for survey’ field, ‘type
of latrine’, ‘functional water meter’, ‘ration card number’,
‘internet facility available’ and even ‘informan name’ field.”
When Transerve didn’t respond to the responsible disclosure sent
via email, Diachenko contacted Indian CERT, which further
coordinated with the company to take its exposed database offline
immediately.
“The danger of having an exposed MongoDB or similar NoSQL databases
is a huge risk. We have previously reported that the lack of
authentication allowed the installation of malware or ransomware on
thousands of MongoDB servers,” Diachenko said.
“The public configuration allows the possibility of
cybercriminals to manage the whole system with full administrative
privileges. Once the malware is in place, criminals could remotely
access the server resources and even launch a code execution to
steal or completely destroy any saved data the server
contains.”
MongoDB is the most popular, open-source NoSQL database used by
companies of all sizes, from eBay and Sourceforge to The New York
Times and LinkedIn.
This isn’t the first time when MongoDB instances are found
exposed to the Internet. In recent years, we have published several
reports where unprotected database servers have already exposed
billions of records.
None of this is MongoDBs fault, as administrators are always
advised to follow the security
checklist[2] provided by the MongoDB
maintainers.
On older versions of MongoDB before version 2.6.0, the default
configuration makes the database listening on a publicly accessible
port, where admins are supposed to reconfigure it appropriately for
online use, but, unfortunately, many don’t.
References
- ^
disclosed
(securitydiscovery.com) - ^
security checklist
(docs.mongodb.com)
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/7ELM5egcaAA/mongodb-delhi-database-leaked.html