好像我们的 mongodb 测试库也被黑了 - V2EX
V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
请不要在回答技术问题时复制粘贴 AI 生成的内容
MrSong0607
V2EX    程序员

好像我们的 mongodb 测试库也被黑了

  •  
  •   MrSong0607 2017-01-10 09:15:56 +08:00 6602 次点击
    这是一个创建于 3199 天前的主题,其中的信息可能已经有所发展或是发生改变。

    因为是做测试用的,所以就没做密码,结果今天早上一看,库全被删了

    { "_id" : ObjectId("58743f490c474c53fc948a96"), "Info" : "Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip", "Bitcoin Address" : "1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF", "Email" : "[email protected]" } 
    18 条回复    2017-01-11 14:03:15 +08:00
    cnnblike
        1
    cnnblike  
       2017-01-10 09:17:39 +08:00
    MrSong0607
        2
    MrSong0607  
    OP
       2017-01-10 09:31:29 +08:00
    ```
    2017-01-09T23:47:41.105+0800 I NETWORK [conn336] end connection 223.93.176.137:45793 (10 connections now open)
    2017-01-10T07:56:22.767+0800 I NETWORK [initandlisten] connection accepted from 46.166.173.106:58901 #338 (9 connections now open)
    2017-01-10T07:56:25.204+0800 I NETWORK [initandlisten] connection accepted from 46.166.173.106:59922 #339 (10 connections now open)
    2017-01-10T07:56:26.868+0800 I COMMAND [conn339] dropDatabase admin starting
    2017-01-10T07:56:26.984+0800 I COMMAND [conn339] dropDatabase admin finished
    2017-01-10T07:56:26.984+0800 I COMMAND [conn339] command admin command: dropDatabase { dropDatabase: 1 } keyUpdates:0 writeConflicts:0 numYields:0 reslen:56 locks:{ Global: { acquireCount: { r: 2, w: 1, W: 1 } }, Database: { acquireCount: { W: 1 } } } protocol:op_query 117ms
    2017-01-10T07:56:27.423+0800 I COMMAND [conn339] dropDatabase cn_com_seo_facebook starting
    2017-01-10T07:56:29.493+0800 I COMMAND [conn339] dropDatabase cn_com_seo_facebook finished
    2017-01-10T07:56:29.493+0800 I COMMAND [conn339] command cn_com_seo_facebook command: dropDatabase { dropDatabase: 1 } keyUpdates:0 writeConflicts:0 numYields:0 reslen:70 locks:{ Global: { acquireCount: { r: 2, w: 1, W: 1 } }, Database: { acquireCount: { W: 1 } } } protocol:op_query 2070ms
    2017-01-10T07:56:29.920+0800 I COMMAND [conn339] dropDatabase cn_com_seo_mis_auth starting
    2017-01-10T07:56:30.324+0800 I COMMAND [conn339] dropDatabase cn_com_seo_mis_auth finished
    2017-01-10T07:56:30.324+0800 I COMMAND [conn339] command cn_com_seo_mis_auth command: dropDatabase { dropDatabase: 1 } keyUpdates:0 writeConflicts:0 numYields:0 reslen:70 locks:{ Global: { acquireCount: { r: 2, w: 1, W: 1 } }, Database: { acquireCount: { W: 1 } } } protocol:op_query 404ms
    2017-01-10T07:56:30.736+0800 I COMMAND [conn339] dropDatabase local starting
    2017-01-10T07:56:30.802+0800 I COMMAND [conn339] dropDatabase local finished
    2017-01-10T08:07:22.807+0800 I NETWORK [conn339] end connection 46.166.173.106:59922 (9 connections now open)
    2017-01-10T08:54:41.773+0800 I NETWORK [conn338] end connection 46.166.173.106:58901 (8 connections now open)
    ```
    davidyin
        3
    davidyin  
       2017-01-10 09:55:34 +08:00
    密码不是应该在安装的时候就设置好的吗。
    jizhidebocai
        4
    jizhidebocai  
       2017-01-10 09:55:47 +08:00
    mongo 有一个漏洞,需要用 bind_ip 做一下限制
    xiaoz
        5
    xiaoz  
       2017-01-10 10:11:45 +08:00
    没有关闭 27017 的远程访问吧?
    gouchaoer
        7
    gouchaoer  
       2017-01-10 10:42:08 +08:00
    hacker 很难再自己服务器上做备份,他这种方式估计打钱的人不多……其实他可以改变一下策略,把当前数据库的一些记录用 2 个密钥加密,留下接触方式,你接触到了可以获得一个密钥解密部分数据,要获得另一个密钥请打钱(逃
    1yndonn3u
        8
    1yndonn3u  
       2017-01-10 12:51:57 +08:00
    @davidyin mongo 不是强制要求设置密码的啊。
    tinyproxy
        9
    tinyproxy  
       2017-01-10 12:58:15 +08:00
    @lyndonneu18
    1. bind 0.0.0.0:27017
    2. 一句 use admin 直接就 admin 权限了
    davidyin
        10
    davidyin  
       2017-01-10 13:56:24 +08:00
    @lyndonneu18 设置密码不是一个基本素养吗?还需要被强制才去设置.
    soli
        11
    soli  
       2017-01-10 13:58:51 +08:00
    顺便提一句,在阿里云上 bind 192.168.x.x ,还是能在外网被访问到的。
    langmoe
        12
    langmoe  
       2017-01-10 14:09:20 +08:00
    iptables 的重要性这时候就体现出来了。。
    murmur
        13
    murmur  
       2017-01-10 14:13:15 +08:00
    这句话怎么讲,今天你支持比特币,明天黑你服务器的经费里就有你出的一部分(笑)
    mornlight
        14
    mornlight  
       2017-01-10 14:14:23 +08:00
    @soli 啊?为啥
    soli
        15
    soli  
       2017-01-10 14:48:24 +08:00
    @mornlight 不知道哈。只踩过坑,不知道阿里云啥逻辑。
    mingyun
        16
    mingyun  
       2017-01-10 23:18:55 +08:00
    前几天就爆了
    suyuanhxx
        17
    suyuanhxx  
       2017-01-10 23:48:42 +08:00 via iPhone
    我阿里云的测试机每天都被清库,反正也只是用来学习的,被删了也不管
    suyuanhxx
        18
    suyuanhxx  
       2017-01-11 14:03:15 +08:00
    我今天仔细看了下,和楼主一样,都是被这个人黑的
    关于     帮助文档     自助推广系统     博客     API     FAQ     Solana     2504 人在线   最高记录 6679       Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 26ms UTC 15:44 PVG 23:44 LAX 08:44 JFK 11:44
    Do have faith in what you're doing.
    ubao snddm index pchome yahoo rakuten mypaper meadowduck bidyahoo youbao zxmzxm asda bnvcg cvbfg dfscv mmhjk xxddc yybgb zznbn ccubao uaitu acv GXCV ET GDG YH FG BCVB FJFH CBRE CBC GDG ET54 WRWR RWER WREW WRWER RWER SDG EW SF DSFSF fbbs ubao fhd dfg ewr dg df ewwr ewwr et ruyut utut dfg fgd gdfgt etg dfgt dfgd ert4 gd fgg wr 235 wer3 we vsdf sdf gdf ert xcv sdf rwer hfd dfg cvb rwf afb dfh jgh bmn lgh rty gfds cxv xcv xcs vdas fdf fgd cv sdf tert sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf shasha9178 shasha9178 shasha9178 shasha9178 shasha9178 liflif2 liflif2 liflif2 liflif2 liflif2 liblib3 liblib3 liblib3 liblib3 liblib3 zhazha444 zhazha444 zhazha444 zhazha444 zhazha444 dende5 dende denden denden2 denden21 fenfen9 fenf619 fen619 fenfe9 fe619 sdf sdf sdf sdf sdf zhazh90 zhazh0 zhaa50 zha90 zh590 zho zhoz zhozh zhozho zhozho2 lislis lls95 lili95 lils5 liss9 sdf0ty987 sdft876 sdft9876 sdf09876 sd0t9876 sdf0ty98 sdf0976 sdf0ty986 sdf0ty96 sdf0t76 sdf0876 df0ty98 sf0t876 sd0ty76 sdy76 sdf76 sdf0t76 sdf0ty9 sdf0ty98 sdf0ty987 sdf0ty98 sdf6676 sdf876 sd876 sd876 sdf6 sdf6 sdf9876 sdf0t sdf06 sdf0ty9776 sdf0ty9776 sdf0ty76 sdf8876 sdf0t sd6 sdf06 s688876 sd688 sdf86