X
Tech
Home Tech Security

Unsecured MongoDB databases expose Kremlin's backdoor into Russian businesses

"Admin@kremlin.ru" account spotted on thousands of Russian-linked, internet-exposed MongoDB databases.
Written by Catalin Cimpanu, Contributor

Security

A Dutch security researcher has stumbled upon the Kremlin's backdoor account that the government had been using to access the servers of local and foreign businesses operating in Russia.

Also: MongoDB in 2019: Cloud, transactions, and mobile

The backdoor account was found inside thousands of MongoDB databases that had been left exposed online without a password.

Any hacker who noticed the account could have used it to gain access to sensitive information from thousands of companies operating in Russia.

"The first time I saw these credentials was in the user table of a Russian Lotto website," Victor Gevers told ZDNet in an interview today. "I had to do some digging to understand that the Kremlin requires remote access to systems that handle financial transactions."

The researcher says that after his initial finding, he later found the same "admin@kremlin.ru" account on over 2,000 other MongoDB databases that had been left exposed online, all belonging to local and foreign businesses operating in Russia.

Examples include databases belonging to local banks, financial institutions, big telcos, and even Disney Russia.

Kremlin credentials found in the internet-exposed database of a Russian lotto agency

Kremlin credentials found in the internet-exposed database of a Russian lotto agency

Image: Victor Gevers
Kremlin credentials found in the internet-exposed database of Disney Russia

Kremlin credentials found in the internet-exposed database of Disney Russia

Image: Victor Gevers

Gevers even found this account inside a leaky MongoDB database belonging to Ukraine's Ministry of Internal Affairs that was holding details about ERDR investigations carried out by the country's General Prosecutor's Office into corrupt politicians.

Must read

This latter case was very strange because, at the time, the Russian-Ukrainian conflict had already been raging for at least two years.

Kremlin credentials found in the internet-exposed database of a Ukrainian ministry

Kremlin credentials found in the internet-exposed database of a Ukrainian ministry

Image: Victor Gevers

Gevers, who at the time was the Chairman of the GDI Foundation, is one of the world's top white-hat hackers. His research didn't include digging through companies' logs to see what this account was used for, so it's currently unknown if the Russian government used this account only to retrieve financial-related information or they actively altered data.

"We have been searching for open MongoDB for years," Gevers told ZDNet. "When we investigate a MongoDB instance, we try to respect privacy as much as possible by limiting the search for breadcrumbs such as the owner's email addresses to a minimum."

"All the systems this password was on were already fully accessible to anyone," Gevers said. "The MongoDB databases were deployed with default settings. So anyone without authentication had CRUD [Create, Read, Update and Delete] access."

"It took a lot of time and also many attempts to contact and warn the Kremlin about this issue. We never got through, but, apparently, the message came through," the researcher said.

"We still find Russian databases from companies, but these credentials have not been sighted any more in the last months," he said.

It is unclear if the Kremlin switched to using a non-descriptive account or to using per-company unique usernames and passwords.

While companies operating in Russia have to abide by local laws and provide the Kremlin administration with access to some of their financial data, for oversight reasons, they should make sure that their MongoDB databases aren't exposed to everyone on the internet as well.

Data leaks: The most common sources

Related stories:

More data breach coverage:

Editorial standards
Show Comments

Related

coding-hacker-typing-laptop-breach-security

Sisense's data breach is serious enough that CISA is investigating. Here's what you need to do

Woman packing a suitcase while reviewing a check list on her phone

The best travel VPNs: Expert tested

Image of two hands holding a phone while turning on the VPN

The best mobile VPNs: Expert tested