News in brief: child bypasses iPhone security; MongoDB warning; ransom demand of time

Your daily round-up of some of the other security stories in the news

Sleeping mum’s iPhone hacked

Just when you thought that biometric security on your cellphone would keep it safe from the sticky fingers of your children, it seems that at least one enterprising six-year-old has worked out how to bypass it.

Bethany Powell of Little Rock, Arkansas, awoke from a nap on the sofa to put her daughter to bed. The next day, she found emails from Amazon confirming 13 orders of Pokémon items totalling $250.

At first, she told the Daily Mail, she thought she’d been hacked, but then her daughter, Ashlynd, revealed that she’d used her sleeping mother’s thumbprint to unlock her iPhone and log in to Amazon to make the orders.

Powell was only able to return four of the items – which meant Ashlynd got to keep the rest of the things she’d ordered. The moral of the story is to make sure your phone is safely out of little hands’ ways when you’re asleep.

Cloud MongoDB instances attacked

Unsecured MongoDB databases are being hit by an attacker demanding a 0.2BTC ransom ($220) to return the data he’s stealing.

The attacker, “Harak1r1”, has been hitting servers all around the world, said penetration tester Victor Gevers, who noticed the attacks when he reported exposed installations to their owners.

Gevers has also been warning admins via Twitter about the attacker, who to date has collected 16 ransoms via a Bitcoin wallet after having accessed unprotected databases, exported the content and replaced the data with the ransom demand.

Gevers warned that it’s old MongoDB instances deployed via cloud hosting services, mostly on the AWS platform with a default configuration, that have been attacked. If that sounds like your MongoDB setup, go and secure your installation now.

Ransomware demands time rather than money

Ransomware in its more familiar format was big news last year, but yet another variant has been spotted – this time, one that, instead of demanding a ransom in Bitcoin, demands its ransom of your time.

The Koolova ransomware does the usual thing of encrypting your files, then apparently throws up a screen similar to the Jigsaw strain. That is a particularly unpleasant infection that not only demands money but also threatens to send your data to your contacts, and then offers live support to talk you through paying the Bitcoin ransom.

However, the screen shown to its victim by Koolova, according to Bleeping Computer, simply requires you to read two articles on ransomware, and then provides you with the decryption key.

But if you haven’t read both pieces by the time the countdown ends, it then gets nasty and deletes your files.

The message on the screen treats this race against time as “a game”, but it’s certainly not much fun for its victim.

Fortunately, it doesn’t seem to have made it out into the wild yet, but it seems as if the old ransomware dog is learning some unpleasant new tricks in the new year.

Catch up with all of today’s stories on Naked Security