Why MongoDB Nodes Are Getting Hijacked and How to Secure Them

Current Situation

Recent scans show more than 50,000 MongoDB nodes worldwide are exposed on the default port 27017, with roughly half located in the United States and China. These “bare‑run” instances lack firewall rules, authentication, and authorization, making them easy targets for ransomware attacks.

Attack Methodology

Attackers follow a simple four‑step process:

Use internet‑wide scanning services such as Shodan or ZoomEye to locate open MongoDB ports.

Probe the discovered IP addresses.

If login credentials are obtained, run scripts that back up the entire database, delete journal files, and leave ransom notes.

The article does not provide detailed exploit code, focusing instead on raising awareness.

Prevention Measures

Securing MongoDB requires moving away from the default “bare‑run” configuration. The official MongoDB checklist should be followed before production deployment.

Enable Access Control and Authentication

Create an admin user in the admin database and start the server with authentication enabled.

use admin
db.createUser({
  user: "myUserAdmin",
  pwd: "abc123",
  roles: [{ role: "userAdminAnyDatabase", db: "admin" }]
})

mongod --auth --port 27017 --dbpath /data/db1
mongo --port 27017 -u "myUserAdmin" -p "abc123" --authenticationDatabase "admin"

Then create application‑level users with appropriate read/write roles:

use test
db.createUser({
  user: "myTester",
  pwd: "xyz123",
  roles: [
    { role: "readWrite", db: "test" },
    { role: "read", db: "reporting" }
  ]
})

Configure Role‑Based Access Control

Assign minimal privileges to each database user, distinguishing between authentication (verifying identity) and authorization (granting permissions).

Encrypt Communication

Enable TLS/SSL for all MongoDB connections. Community editions require installing the SSL build or upgrading; Enterprise editions include SSL out of the box.

Encrypt Data at Rest

MongoDB 3.2’s WiredTiger engine offers encrypted storage, available in the Enterprise edition; otherwise rely on OS‑level disk encryption.

Limit Network Exposure

Bind MongoDB to internal IP addresses only and disable the HTTP interface in production.

Audit System Activity

Enterprise versions provide an audit log to monitor database actions.

Run MongoDB Under a Dedicated System User

Start the database process with a non‑root operating‑system account.

Conclusion

After two high‑profile MongoDB hijack incidents, operators should audit all production nodes, apply the checklist above, and ensure that no instance is left exposed on the public internet.