Thread by @0xDUDE

Responsible disclosure #4155 took 3 years, 5 months and 15 days to fix the after effect of the leaked credentials. Some breaches don't have to be big in size (as in the number of records which are exposed) to have a significant impact which can take years to fix. [1/2]

https://twitter.com/0xDUDE/status/631520323574181889

Until recently many 🇷🇺 companies were using MongoDB not securely.
Most of them are reported to the owners. The biggest issue was that @KremlinRussia_E requires remote access to businesses and used the same credentials everywhere as we found them in the thousands of open databases

One of these open databases w these Kremlin credentials was a MongoDB server holding ERDR information by @MVS_UA (RD#5019) which shows that changing a password in a system (where they had remote access) in a country with who how they are in a war with was too much effort for 🇷🇺

But also American companies operating on Russian soil like for example @Disney (RD#4790) which needed to be under governmental control was remotely accessed w the same credentials. And these were accidentally leaked by companies who had no idea who 2 run a MongoDB server securely

The bigger Russian companies which could afford proper network security like the telco company @ttk_ru had their NOC / SIEM platform exposed to the internet for years. They never responded or acted on the responsible disclosure #5047

The sad thing is that they were warned by e-mail [7 May 2016 and] did nothing. Their databases were "ransomed" in 2017 by [e-mail] and they did nothing.

shodan.io/host/95.211.11…
MongoDB logs: pastebin.com/raw/LUiXB1LC
MongoDB Ransackers: tinyurl.com/yc7supj8