How MongoDB Attacks Happen and What UCloud Does to Secure Your Data

Background

Recently, a large number of MongoDB databases were attacked again. Over 26,000 servers have been hijacked, with hackers able to log in without authentication and delete data in bulk.

UCloud’s UDB MongoDB product was designed with security as a priority, incorporating optimizations and mandatory security measures to fundamentally prevent such attacks.

Attack Conditions

Investigation shows that compromised MongoDB instances share two conditions:

MongoDB instance allows password‑less login.

MongoDB instance is exposed to the public network.

These issues stem from MongoDB’s default configuration, which omits authentication to simplify usage. Similar risks exist for other databases, such as MySQL, when configured for password‑less public access.

UDB MongoDB Security Measures

UCloud addresses the two conditions with the following safeguards:

Mandatory authentication: users must set a strong root password and provide the correct authentication database name; the cluster also uses KeyFile authentication.

No public IP: instances are only reachable via internal VPC network IPs, with bind_ip forced to the internal address.

Additionally, UDB MongoDB offers full data backup to ensure data safety even if other attacks occur.

Authentication and Performance

Many developers disable authentication for three reasons: using default settings, lacking security awareness, and fearing performance impact.

The performance concern is valid: MongoDB 3.0+ uses SCRAM‑SHA‑1 authentication, which involves complex hash calculations that can cause CPU spikes under high‑concurrency short‑lived connections, leading to system bottlenecks.

Performance profiling (shown below) illustrates the CPU surge during authentication.

Optimization is straightforward: switch to a connection‑pooling model with long‑lived connections to reduce authentication overhead.

Conclusion

By enforcing authentication, isolating instances within a VPC, and providing robust backup and connection‑pooling strategies, UCloud’s UDB MongoDB ensures both security and performance for its users.