Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes if you publish a known insecure service like mongodb, on the standard port, on a well known VPS provider you can expect it to be automatically compromised within hours if not minutes.

As others commented, scanning the whole Internet is even not a problem so scanning a "limited" part where you are likely to see these services pop up is even less of a problem.

I think the takeaway is that you cannot hide in the masses on the Internet anymore, 10-20 years ago you could throw up a insecure server and it could be fine for a long time.

Nowadays you must assume someone will find and try to login to your service, even if you put it on a non-standard port.

Also, if it's a HTTPS service take note they when you get a certificate you will be announcing that domain to the whole world and publish it to a searchable database (for example https://crt.sh/ ).



If you want to secure your on-premise MongoDB we publish a checklist here https://docs.mongodb.com/manual/administration/security-chec...

better still use MongoDB Atlas and get our best security practices baked in.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: