V2EX = way to explore
V2EX 是一个关于分享和探索的地方
Sign Up Now
For Existing Member  Sign In
• 请不要在回答技术问题时复制粘贴 AI 生成的内容
MrSong0607
V2EX  ›  程序员

好像我们的 mongodb 测试库也被黑了

  •  
  •   MrSong0607 · Jan 10, 2017 · 6950 views
    This topic created in 3406 days ago, the information mentioned may be changed or developed.

    因为是做测试用的,所以就没做密码,结果今天早上一看,库全被删了

    {
    	"_id" : ObjectId("58743f490c474c53fc948a96"),
    	"Info" : "Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip",
    	"Bitcoin Address" : "1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF",
    	"Email" : "[email protected]"
    }
    
    18 replies    2017-01-11 14:03:15 +08:00
    MrSong0607
        2
    MrSong0607  
    OP
       Jan 10, 2017
    ```
    2017-01-09T23:47:41.105+0800 I NETWORK [conn336] end connection 223.93.176.137:45793 (10 connections now open)
    2017-01-10T07:56:22.767+0800 I NETWORK [initandlisten] connection accepted from 46.166.173.106:58901 #338 (9 connections now open)
    2017-01-10T07:56:25.204+0800 I NETWORK [initandlisten] connection accepted from 46.166.173.106:59922 #339 (10 connections now open)
    2017-01-10T07:56:26.868+0800 I COMMAND [conn339] dropDatabase admin starting
    2017-01-10T07:56:26.984+0800 I COMMAND [conn339] dropDatabase admin finished
    2017-01-10T07:56:26.984+0800 I COMMAND [conn339] command admin command: dropDatabase { dropDatabase: 1 } keyUpdates:0 writeConflicts:0 numYields:0 reslen:56 locks:{ Global: { acquireCount: { r: 2, w: 1, W: 1 } }, Database: { acquireCount: { W: 1 } } } protocol:op_query 117ms
    2017-01-10T07:56:27.423+0800 I COMMAND [conn339] dropDatabase cn_com_seo_facebook starting
    2017-01-10T07:56:29.493+0800 I COMMAND [conn339] dropDatabase cn_com_seo_facebook finished
    2017-01-10T07:56:29.493+0800 I COMMAND [conn339] command cn_com_seo_facebook command: dropDatabase { dropDatabase: 1 } keyUpdates:0 writeConflicts:0 numYields:0 reslen:70 locks:{ Global: { acquireCount: { r: 2, w: 1, W: 1 } }, Database: { acquireCount: { W: 1 } } } protocol:op_query 2070ms
    2017-01-10T07:56:29.920+0800 I COMMAND [conn339] dropDatabase cn_com_seo_mis_auth starting
    2017-01-10T07:56:30.324+0800 I COMMAND [conn339] dropDatabase cn_com_seo_mis_auth finished
    2017-01-10T07:56:30.324+0800 I COMMAND [conn339] command cn_com_seo_mis_auth command: dropDatabase { dropDatabase: 1 } keyUpdates:0 writeConflicts:0 numYields:0 reslen:70 locks:{ Global: { acquireCount: { r: 2, w: 1, W: 1 } }, Database: { acquireCount: { W: 1 } } } protocol:op_query 404ms
    2017-01-10T07:56:30.736+0800 I COMMAND [conn339] dropDatabase local starting
    2017-01-10T07:56:30.802+0800 I COMMAND [conn339] dropDatabase local finished
    2017-01-10T08:07:22.807+0800 I NETWORK [conn339] end connection 46.166.173.106:59922 (9 connections now open)
    2017-01-10T08:54:41.773+0800 I NETWORK [conn338] end connection 46.166.173.106:58901 (8 connections now open)
    ```
    davidyin
        3
    davidyin  
       Jan 10, 2017
    密码不是应该在安装的时候就设置好的吗。
    jizhidebocai
        4
    jizhidebocai  
       Jan 10, 2017
    mongo 有一个漏洞,需要用 bind_ip 做一下限制
    xiaoz
        5
    xiaoz  
       Jan 10, 2017
    没有关闭 27017 的远程访问吧?
    gouchaoer
        7
    gouchaoer  
       Jan 10, 2017
    hacker 很难再自己服务器上做备份,他这种方式估计打钱的人不多……其实他可以改变一下策略,把当前数据库的一些记录用 2 个密钥加密,留下接触方式,你接触到了可以获得一个密钥解密部分数据,要获得另一个密钥请打钱(逃
    1yndonn3u
        8
    1yndonn3u  
       Jan 10, 2017
    @davidyin mongo 不是强制要求设置密码的啊。
    tinyproxy
        9
    tinyproxy  
       Jan 10, 2017
    @lyndonneu18
    1. bind 0.0.0.0:27017
    2. 一句 use admin 直接就 admin 权限了
    davidyin
        10
    davidyin  
       Jan 10, 2017
    @lyndonneu18 设置密码不是一个基本素养吗?还需要被强制才去设置.
    soli
        11
    soli  
       Jan 10, 2017
    顺便提一句,在阿里云上 bind 192.168.x.x ,还是能在外网被访问到的。
    langmoe
        12
    langmoe  
       Jan 10, 2017
    iptables 的重要性这时候就体现出来了。。
    murmur
        13
    murmur  
       Jan 10, 2017
    这句话怎么讲,今天你支持比特币,明天黑你服务器的经费里就有你出的一部分(笑)
    mornlight
        14
    mornlight  
       Jan 10, 2017
    @soli 啊?为啥
    soli
        15
    soli  
       Jan 10, 2017
    @mornlight 不知道哈。只踩过坑,不知道阿里云啥逻辑。
    mingyun
        16
    mingyun  
       Jan 10, 2017
    前几天就爆了
    suyuanhxx
        17
    suyuanhxx  
       Jan 10, 2017 via iPhone
    我阿里云的测试机每天都被清库,反正也只是用来学习的,被删了也不管🌚
    suyuanhxx
        18
    suyuanhxx  
       Jan 11, 2017
    我今天仔细看了下,和楼主一样,都是被这个人黑的
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Solana   ·   997 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 75ms · UTC 19:25 · PVG 03:25 · LAX 12:25 · JFK 15:25
    ♥ Do have faith in what you're doing.