Tag Info

Hot answers tagged

19

NoSQL databases are relatively new (although arguably an old concept), I haven't seen any specific MongoDB hardening guides and the usual places I look (CISSecurity, vendor publications, Sans etc all come up short). Suggests it would be a good project for an organisation, uni student, infosec community to write one and maintain it. There is some basic ...


7

Your requirements aren't cloud specific. This same solution will work with a traditional hosting. The hallmark of cloud computing is dynamic resource consumption by booting up VM's only when you need them. 1)As far as I know MongoDB doesn't support SSL. In order to have a secure connection to MongoDB you'll have to use a VPN to create a safe tunnel. ...


5

Insecure Direct Object Reference Client-Side Enforcement of Server Side Security Server-Side JavaScript Injection Also MongoDB should not be assessable to the public. It can be password protected, and passwords can be brute-forced. Client-Side js can communicate with MongoDB directly, and MongoDB can authenticate individual users. However their ...


5

There are injection attacks against MongoDB, but these are largely mitigated by using proper data adapter libraries. Nonetheless, it's worth knowing that it's possible to inject in a few ways. The first thing you've got to look out for is cases where you dynamically build a $where with JavaScript, using user input. By modifying their inputs, they may be ...


4

The answer to this (not just MongoDB, but any program) is quite system dependent. If you are running MongoDB with SSL enabled at compile time, and enabled at run-time, and it's using a vulnerable OpenSSL (1.0.1—1.0.1f with hearbeat not explicitly removed), then yes. If you are only listening on localhost, or you have packet filtering/firewalling to allow ...


4

Just for your information. Giving a direct database connection in a client side application is a bad idea. Build a RESTful interface which allows for correct authentication and input validation. This will allow you to have a stricter control on what your applications can access. The problem is that currently MongoDB doesn't offer SSL encapsulation. This ...


4

In a sense, that can be considered correct. From what I understood from the MongoDB documentation, the db.addUser() expects one to pass in an already hashed password. This is clearly seen from the documentation of the function, where the expected data type of the pwd field is hash. I read this as MongoDB expecting the system to perform the hashing prior to ...


4

If you think the database engine you're planning to use isn't secure enough, then I wouldn't advise using it for anything. If it is secure enough, then the added complexity of two different database APIs will make your life harder, and not really affect an attacker (they'll just dump it to a file anyway). If you want the data physically separate, you could ...


3

MongoDB is only about 1/10 related to what you are asking, I think. You basically want to know how to securely store data, and associated keys in the cloud. There are entire books written on this... :) Your question may be too broad for me to offer any reasonable answer, but others may be able to do better. With that being said, there is a great patterns ...


2

Few very initial things to remember are: Remove IP Binding from all to just the IP (private or localhost), you expect to get Connection Request Change the default Port Bindings Give only required permissions (like no update/delete permissions to select query users) Setup ssh keys for required master-slave connection, removing involvement of passwords You ...


2

Field level encryption is important in case of SQL injections or your database server getting hacked. Assuming application and database are on different servers, the data will still be encrypted by application server. Full-disk encryption would help in case of hardware theft as otherwise encrypted server will not be protected in case it is broken into as ...


1

According to Mongo's documentation, the following is used to construct an ObjectId: ObjectId is a 12-byte BSON type, constructed using: a 4-byte value representing the seconds since the Unix epoch, a 3-byte machine identifier, a 2-byte process id, and a 3-byte counter, starting with a random value. So to answer your question, Is there ...


1

If you are generating version 4 UUIDs using a cryptographically secure RNG, the probability of a previously issued token matching a currently valid token is exactly the same as the probability of any random token created by the attacker matching a current token. This means that an attacker with previous tokens has no advantage over any other attacker, and ...


1

First vulnerability similar to sql injection can be done in mongodb or nosql databases too. which would be mongodb injection. Try to run mongodb on different port instead on default 27017 to avoid exposing. For official security practices you can always check out http://docs.mongodb.org/manual/administration/security/ It tell security practices that should ...



Only top voted, non community-wiki answers of a minimum length are eligible