Title: !!! Important Follow-up !!!:<p>I&#x27;ve aquired the portion of the log related to the hostage taking, posted below. In particular this log shows that __no__ backup of the data was taken. So please don&#x27;t pay any money!<p>------------------------------------------<p>Although my colleagues and I have already pointed out the issue of open-by-default databases in spring 2015 (look at the references), today it seems for the astonishingly first(?) time somebody took the opportunity to erase hundreds of MongoDBs leaving only this Message:<p>{ &quot;_id&quot; : ObjectId(&quot;5859a0370b8e49f123fcc7da&quot;),
&quot;mail&quot; : &quot;harak1r1@sigaint.org&quot;,
&quot;note&quot; : &quot;SEND 0.2 BTC TO THIS ADDRESS 13zaxGVjj9MNc2jyvDRhLyYpkCh323MsMq AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !&quot; }<p>Well played, system admins.<p>Updates:<p>The price for the data seems to equate to about 200 USD currently. Thanks, wereHamster.<p>This has been going on since at least yesterday (https:&#x2F;&#x2F;twitter.com&#x2F;achillean&#x2F;status&#x2F;816385533538631680). Thanks, NietTim.<p>There have already been transactions by presumed victims:
https:&#x2F;&#x2F;bitref.com&#x2F;13zaxGVjj9MNc2jyvDRhLyYpkCh323MsMq . Thanks, 	
anondon.<p>Please read the official security checklist by MongoDB! In particular, use passwords and don&#x27;t expose on all interfaces (duh!)!
https:&#x2F;&#x2F;docs.mongodb.com&#x2F;manual&#x2F;administration&#x2F;security-checklist&#x2F;<p>Sources&#x2F;References:<p>The Jan &#x27;15 info paper of which I am one of the authors: https:&#x2F;&#x2F;cispa.saarland&#x2F;wp-content&#x2F;uploads&#x2F;2015&#x2F;02&#x2F;MongoDB_documentation.pdf<p>(Jan &#x27;17) http:&#x2F;&#x2F;www.csoonline.com&#x2F;article&#x2F;3154190&#x2F;security&#x2F;exposed-mongodb-installs-being-erased-held-for-ransom.html<p>http:&#x2F;&#x2F;www.theregister.co.uk&#x2F;2017&#x2F;01&#x2F;04&#x2F;mongodb_installs_wiped_by_bitcoin_ransoming_script&#x2F;<p>(German) https:&#x2F;&#x2F;www.heise.de&#x2F;newsticker&#x2F;meldung&#x2F;Eindringling-nimmt-offenbar-MongoDB-Datenbanken-als-Geisel-3587479.html
Upvote: