A Dutch security researcher has stumbled upon the Kremlin’s backdoor account that the government had been using to access the servers of local and foreign businesses operating in Russia.
The backdoor account was found inside thousands of MongoDB databases that had been left exposed online without a password.
Any hacker who noticed the account could have used it to gain access to sensitive information from thousands of companies operating in Russia.
“The first time I saw these credentials was in the user table of a Russian Lotto website,” Victor Gevers told ZDNet in an interview today. “I had to do some digging to understand that the Kremlin requires remote access to systems that handle financial transactions.”
The researcher says that after his initial finding, he later found the same “admin@kremlin.ru” account on over 2,000 other MongoDB databases that had been left exposed online, all belonging to local and foreign businesses operating in Russia.
Examples include databases belonging to local banks, financial institutions, big telcos, and even Disney Russia.
Kremlin credentials found in the internet-exposed database of a Russian lotto agency
Image: Victor Gevers
Kremlin credentials found in the internet-exposed database of Disney Russia
Image: Victor Gevers
Gevers even found this account inside a leaky MongoDB database belonging to Ukraine’s Ministry of Internal Affairs that was holding details about ERDR investigations carried out by the country’s General Prosecutor’s Office into corrupt politicians.
This latter case was very strange because, at the time, the Russian-Ukrainian conflict had already been raging for at least two years.
Kremlin credentials found in the internet-exposed database of a Ukrainian ministry
Image: Victor Gevers
Gevers, who at the time was the Chairman of the GDI Foundation, is one of the world’s top white-hat hackers. His research didn’t include digging through companies’ logs to see what this account was used for, so it’s currently unknown if the Russian government used this account only to retrieve financial-related information or they actively altered data.
“We have been searching for open MongoDB for years,” Gevers told ZDNet. “When we investigate a MongoDB instance, we try to respect privacy as much as possible by limiting the search for breadcrumbs such as the owner’s email addresses to a minimum.”
“All the systems this password was on were already fully accessible to anyone,” Gevers said. “The MongoDB databases were deployed with default settings. So anyone without authentication had CRUD [Create, Read, Update and Delete] access.”
“It took a lot of time and also many attempts to contact and warn the Kremlin about this issue. We never got through, but, apparently, the message came through,” the researcher said.
“We still find Russian databases from companies, but these credentials have not been sighted any more in the last months,” he said.
It is unclear if the Kremlin switched to using a non-descriptive account or to using per-company unique usernames and passwords.
While companies operating in Russia have to abide by local laws and provide the Kremlin administration with access to some of their financial data, for oversight reasons, they should make sure that their MongoDB databases aren’t exposed to everyone on the internet as well.
More data breach coverage:
DailyMotion discloses credential stuffing attackMystery still surrounds hack of PHP PEAR websitePopular WordPress plugin hacked by angry former employeeLocalBitcoins blames security breach on forum ‘third-party software’
Online casino group leaks information on 108 million bets, including user detailsTwitter bug revealed private tweets for some Android users for almost five yearsMassive breach leaks 773 million email addresses, 21 million passwords CNET
Marriott reveals data breach affecting 500 million hotel guests TechRepublic
Related Topics:
Government
Security TV
Data Management
CXO
Data Centers