8 ms·
My thoughts, too. But before claiming this I at least wanted to encourage a second look. I also ensured this was the only time he connected, so there is no plau
by xyunknown 10y ago
My thoughts, too. But before claiming this I at least wanted to encourage a second look. I also ensured this was the only time he connected, so there is no plausable way he is backing up the data.
- fauria 10y agoThe attacker could have used a script like this: use foobar db.collection.find() db.dropDatabase() and then: cat script.js | mongo | tee backup so there is indeed a plausible way to backup the database before dropping it. The timestamps seems to be as well plausible for a small database.
- xyunknown 10y agoThere is now more evidence supporting that there are no backups, e.g. he doesn't even store information about which servers he already looted (he is erasing the same servers twice or more). Until someone has logs that prove otherwise on bigger datasets, nobody should pay this guy. Also it seems implausible seeing the vast amount of data which he would need to have backed up, closing in several hundreds of terabytes, based on an estimation of last year.