220 Million Traveler Records Exposed via Default Credentials on Vietnam-Linked APIS Database — Detection and Hardening Guide

---
title: Network Connection to Database Service Port from External Source
description: Detects inbound network connections to common database service ports (MongoDB, Elasticsearch, PostgreSQL, MySQL, Redis) that may indicate an internet-exposed or default-credential-protected datastore. Review source addresses against known application and scanner allowlists.
references:
  - https://www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/
  - https://cwe.mitre.org/data/definitions/1392.html
author: Security Arsenal
date: 2026/04/06
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 27017
      - 9200
      - 9300
      - 5432
      - 3306
      - 6379
      - 1433
      - 5984
    Initiated: 'false'
  filter_internal:
    SourceIp|startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '192.168.'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate application-tier connections from untracked subnets
  - Authorized vulnerability scanners (allowlist by source IP)
level: high
---
title: Authentication Using Common Default or Service Account Names Over Network
description: Detects network logons using usernames commonly shipped as vendor defaults or abused on exposed admin interfaces. A hit does not prove compromise but identifies where factory-default accounts remain active against remotely reachable services.
references:
  - https://www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
logsource:
  product: windows
  service: security
detection:
  selection:
    TargetUserName|contains:
      - 'admin'
      - 'administrator'
      - 'root'
      - 'sa'
      - 'postgres'
      - 'elastic'
      - 'mongodb'
      - 'oracle'
      - 'guest'
      - 'default'
    LogonType:
      - 3
      - 10
  filter_service:
    TargetUserName|endswith: '$'
  condition: selection and not filter_service
falsepositives:
  - Legitimate administrative logons — baseline by source workstation and target host
  - Renamed-but-similar admin accounts in smaller environments
level: medium
---
title: Cloud Storage or Database Configuration Changed to Public Access
description: Detects cloud control-plane events that make storage buckets or managed databases publicly accessible, a common mechanism behind large-scale data exposures. Map to AWS CloudTrail, Azure Activity Log, or GCP Audit Logs per your Sigma backend.
references:
  - https://www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/04/06
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName:
      - 'PutBucketAcl'
      - 'PutBucketPolicy'
      - 'PutPublicAccessBlock'
      - 'ModifyDBInstance'
      - 'ModifyDBCluster'
      - 'AuthorizeSecurityGroupIngress'
  selection_public:
    requestParameters|contains:
      - 'public-read'
      - 'public-read-write'
      - 'AllUsers'
      - '0.0.0.0/0'
      - '"PubliclyAccessible":true'
      - 'false'
  condition: selection and selection_public
falsepositives:
  - Intentional public web assets (allowlist known public buckets/instances)
  - Infrastructure-as-code deployments of approved public resources
level: critical

// Hunt 1: Database ports receiving connections from public IP space
let DbPorts = dynamic([27017, 9200, 9300, 5432, 3306, 6379, 1433, 5984]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where RemotePort in (DbPorts) or LocalPort in (DbPorts)
    | where RemoteIP !startswith "10." and RemoteIP !startswith "192.168."
        and RemoteIP !startswith "172.16." and RemoteIP !startswith "172.17."
        and RemoteIP !startswith "172.18." and RemoteIP !hasprefix "127."
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, LocalPort, RemoteIP, RemotePort, ActionType),
    (CommonSecurityLog
    | where DestinationPort in (DbPorts)
    | where SourceIP !startswith "10." and SourceIP !startswith "192.168."
        and SourceIP !startswith "172."
    | project TimeGenerated, DeviceName=DeviceName, SourceIP, DestinationIP, DestinationPort, DeviceAction)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ConnectionCount=count()
    by DeviceName, RemoteIP, LocalPort
| order by ConnectionCount desc;

// Hunt 2: Interactive/network logons using common default account names
let DefaultAccounts = dynamic(["admin", "administrator", "root", "sa", "postgres", "elastic", "mongodb", "guest", "oracle"]);
SigninLogs
| where TimeGenerated > ago(14d)
| where UserPrincipalName has_any (DefaultAccounts)
| extend SourceIP = IPAddress
| where SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172."
| summarize Attempts=count(), Apps=dcount(AppDisplayName), Locations=make_set(Location)
    by UserPrincipalName, SourceIP, ResultType
| order by Attempts desc;

-- Hunt: database services listening on all interfaces (0.0.0.0 / ::)
-- The exposure precondition for APIS-style leaks: a datastore bound to a public interface
SELECT Pid, Name, Status, Family, Address AS LocalAddr, Port AS LocalPort
FROM netstat()
WHERE (LocalAddr = '0.0.0.0' OR LocalAddr = '::')
  AND LocalPort in (27017, 9200, 9300, 5432, 3306, 6379, 1433, 5984, 8080, 8888)
  AND Status =~ 'LISTEN'

-- Hunt: database processes started with authentication disabled
-- No-auth startup flags carried from PoC to production are a common root cause
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(noauth|--auth=false|bind_ip.?=.?0\.0\.0\.0|network\.host.?=.?0\.0\.0\.0|protected-mode.?no|--bind.0\.0\.0\.0)'
   OR (Name =~ '(?i)(mongod|elasticsearch|redis-server|postgres|mysqld|couchdb)'
       AND CommandLine =~ '(?i)0\.0\.0\.0')

#!/bin/bash
# Security Arsenal — Exposed Database Audit (APIS-leak class)
# Verifies no datastore is publicly reachable with default/disabled auth.
# Run as root. Read-only by default.

echo "=== [1] Database services bound to public interfaces ==="
ss -tlnp | awk 'NR==1 || /0\.0\.0\.0|\[::\]/' | grep -Ei '27017|9200|9300|5432|3306|6379|1433|5984|8080'

echo "=== [2] MongoDB auth configuration check ==="
if [ -f /etc/mongod.conf ]; then
  grep -E 'authorization|bindIp' /etc/mongod.conf
  grep -q 'authorization.*enabled' /etc/mongod.conf \
    && echo "[OK] MongoDB auth enabled" \
    || echo "[FAIL] MongoDB authorization NOT enabled — set security.authorization: enabled"
fi

echo "=== [3] Elasticsearch security check ==="
if [ -f /etc/elasticsearch/elasticsearch.yml ]; then
  grep -E 'xpack.security.enabled|network.host' /etc/elasticsearch/elasticsearch.yml
  grep -q 'xpack.security.enabled: true' /etc/elasticsearch/elasticsearch.yml \
    && echo "[OK] Elasticsearch security enabled" \
    || echo "[FAIL] Elasticsearch xpack.security NOT enabled"
fi

echo "=== [4] Redis protected-mode check ==="
if [ -f /etc/redis/redis.conf ]; then
  grep -E '^protected-mode|^bind ' /etc/redis/redis.conf
fi

echo "=== [5] Default credential service account check ==="
# Flag any local accounts still using vendor default names with valid shells
grep -E '^(admin|administrator|root|postgres|elastic|mongodb|guest):' /etc/passwd | grep -vE 'nologin|false$'

echo "=== [6] Firewall ingress on database ports ==="
iptables -L INPUT -n | grep -E '27017|9200|5432|3306|6379' || echo "[WARN] No explicit DB-port rules found — verify security groups at cloud layer"

echo "=== [7] External exposure self-test (from outside host, run separately) ==="
echo "  nmap -Pn -p 27017,9200,5432,3306,6379,1433 <public-ip>"
echo "  curl -s http://<public-ip>:9200/_cat/indices   # must return auth error, not data"

# UNCOMMENT TO ENFORCE — block external ingress to DB ports at host level
# for PORT in 27017 9200 9300 5432 3306 6379 1433 5984; do
#   iptables -A INPUT -p tcp --dport $PORT ! -s 10.0.0.0/8 -j DROP
# done