MongoDB database deleted automatically

Question

I am very confused with the MongoDB behavior I am facing these days. I am running a MEAN(MongoDB, Express, Angular, NodeJS) application on a windows live server. Two times it happened that the whole database my application is connected with is deleted automatically. I have no clue what is happening with it. I have searched the web but found no answer on it. I am using Monk for the MongoDB.

How can I detect the problem with it?

Answer 1

Hey It is a virus attack read this article https://www.bleepingcomputer.com/news/security/mongodb-apocalypse-professional-ransomware-group-gets-involved-infections-reach-28k-servers/

Actually more then 28k mongodb server have been attacked by the community and they have either deleted the database or have encrypted them. Now they are demanding Bit coin for giving backup.

Now the Question arises that is mongoDb safe as so many database have been deleted or encrypted

Answer is YES Mongodb is completely safe the reason behind this was the lack of security measures used by the programmers.

1. You should only open the port of the server that are required example in Amazone web server (AWS) some programmers Open all the ports of security groups stop doing that.

Now come to the solution of the problem.

Do check mongod.conf file on the server:

When we install mongodb a file name mongod.conf is automatically generated on the server. you can check it by following command.

cd /etc/
sudo vim mongod.conf

in this image you will find bindIp is 127.0.0.1 which is a localhost means only this server is allowed to use the database in your case this must be 0.0.0.0 which allow the hackers to get access to your data and delete all the files so just update the bindIp to 127.0.0.1 and it wont happen as of now.

Even you can use mongo Authentication use this link for further reference https://docs.mongodb.com/manual/tutorial/enable-authentication/