Chris Vickery writes:
I was surprised to read that the crooks nabbed a MongoDB from Verizon that is being sold on the black market for $100,000. The reason I’m surprised? Well, I discovered a highly similar Verizon breach this last December.
Brian Krebs recently reported on a Verizon data breach here: https://krebsonsecurity.com/2016/03/crooks-steal-sell-verizon-enterprise-customer-data
I don’t know for sure if the bad guys in the most recent breach actually used an exploit to get the data, but I can tell you that the Verizon MongoDB that I found was completely unprotected by any password or authentication. All you needed in order to access it was a MongoDB client and the IP address.
The big difference is that the one I discovered was then responsibly disclosed to Verizon. However, it took them a month to plug the hole. It never made the news, but now I wish that I had made a bigger deal out of it. Maybe that would have spurred some changes which could have prevented the breach that Krebs wrote about.
Read more on MacKeeper.
And yes, Chris, you should have let me or Steve Ragan know and we would have covered it.