Unprotected database belonging to MedicareSupplement.com exposed almost 5 million user records

A security researcher Bob Diachenko along with Comparitech uncovered a MongoDB database that was left open to the public without any authentication.

Who is the owner of the database?

The MongoDB instance is a part of MedicareSupplement.com’s marketing leads database. MedicareSupplement.com is an insurance marketing website that helps users find supplemental medical insurance available in their area.

“The IP address of the publicly available database was first indexed on May 10, 2019 by public search engine BinaryEdge. We do not yet know whether anyone gained unauthorized access to the database,” Comparitech said in a blog.

What actions were taken?

Diachenko and Comparitech notified MedicareSupplement.com about the unsecured database. The insurance marketing company responded quickly by taking down the database and disabling public access.

“I have previously reported that the lack of authentication allows the installation of malware or ransomware on the MongoDB servers. The public configuration allows the possibility of cybercriminals to manage the whole system with full administrative privileges. Once the malware is in place, criminals could remotely access the server resources and even launch a code execution to steal or completely destroy any saved data the server contains,” Diachenko said.

Source: Cyware.com

Powered by NewsAPI.org

Keywords:

Database • User (computing) • Document • Security • MongoDB • Database • Open-source software • Authentication • Database • MongoDB • Object (computer science) • Component Object Model • Marketing • Database • Component Object Model • Marketing • Website • User (computing) • IP address • Database • Web search engine • Database • Blog • USS Diachenko (APD-123) • Database • Insurance • Marketing • Database • Authentication • Installation (computer programs) • Malware • Ransomware • MongoDB • Server (computing) • Cybercrime • Operating system • Superuser • Malware • Server (computing) • System resource • Source code • Execution (computing) • Data • Server (computing) •