Live data from Hacker News

A picture got my PostgreSQL database to start mining Monero

imperva.com

11–20 of 99 posts

Re: A picture got my PostgreSQL database to start mining Monero

#11
post #7

If we can subvert computers running databases (think healthcare, insurance companies, the IRS, etc) then isn’t it time to shut down the internet? People can’t have nice things. I think this is proof that we are in hell. There is a god and she is watching from the other side. Well, I take it back. Keep the infrastructure so that the ISPs and broadcasters can keep taking our money but make it like tv used to be - one w…

This reads like something out of /r/insanepeoplefacebook

Re: A picture got my PostgreSQL database to start mining Monero

#12
post #6

It's amazing that in 2018 people leave databases publicly exposed.

Shit happens. Sometimes it's an oversight, sometimes it's accidental, sometimes it's from ignorance to the dangers. Sometimes it's even a honeypot, like this time :)

Re: A picture got my PostgreSQL database to start mining Monero

#13
post #9
post #6

It's amazing that in 2018 people leave databases publicly exposed.

I think this was a honeypot, so you want to expose it to make it an easy (or at least easier) target, don't you?

By the end of the article the author mentions that there are thousands (700k+) exposed installations.

Re: A picture got my PostgreSQL database to start mining Monero

#14
post #11
post #7

If we can subvert computers running databases (think healthcare, insurance companies, the IRS, etc) then isn’t it time to shut down the internet? People can’t have nice things. I think this is proof that we are in hell. There is a god and she is watching from the other side. Well, I take it back. Keep the infrastructure so that the ISPs and broadcasters can keep taking our money but make it like tv used to be - one w…

This reads like something out of /r/insanepeoplefacebook

It is time for /r/insanepeopleofhn

Re: A picture got my PostgreSQL database to start mining Monero

#15
How exactly can this be exploited?

Who has to run the Postgres database?

In what kind of way does it has to be accessed to get this happening?

Are we talking about web apps that use Postgres on the back end and run arbitrary queries?

Are we talking about people who somehow extract the Postgres database username and password and it has admin permissions?

I wasn't sure what's happening.

Re: A picture got my PostgreSQL database to start mining Monero

#18
post #7

If we can subvert computers running databases (think healthcare, insurance companies, the IRS, etc) then isn’t it time to shut down the internet? People can’t have nice things. I think this is proof that we are in hell. There is a god and she is watching from the other side. Well, I take it back. Keep the infrastructure so that the ISPs and broadcasters can keep taking our money but make it like tv used to be - one w…

Could I receive a content of articleId=1;/etc/passwd please?

Re: A picture got my PostgreSQL database to start mining Monero

#19
How does the image get executed? I went through the article and in the example the author extracts the executable manually using dd.

But how would an unsuspecting user run the executable? Perhaps I missed this, but is there some image viewer or browser that runs the trailing bytes of images?

Post reply on HN