Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A picture got my PostgreSQL database to start mining Monero

imperva.com

Post reply on HN
Print view View original

31–40 of 99 posts

Re: A picture got my PostgreSQL database to start mining Monero

#31

Post by brightball »

xyrouter wrote: post #28
jacob019 wrote: post #6

It's amazing that in 2018 people leave databases publicly exposed.

I want to know why exposing databases on the Internet publicly is considered a problem. Is it because a vulnerability found in a database would allow to exploit the database directly? I ask this because people expose web-apps on the Internet publicly too and an SQL injection vulnerability on the web-app would also be equally catastrophic. I guess exposing web-apps on the Internet is a risk we need to accept because i…

A web app has a connection to a database that can be limited to its exact permission needs, input can be sanitized, database execution can be limited to exactly what the interface has available. Apps can also use connection pools to manage limits of the database.

If the database itself is publicly exposed, even if a read only connection with access to an empty table is provided an attacker could simply max out the connection pool to kill your application. If a vulnerability was published or a password with more access was available they can not only access all of your data but they can corrupt it and/or delete it.

SQL injection has been pretty trivial to stop for a couple of decades now.

Re: A picture got my PostgreSQL database to start mining Monero

#32

Post by TremendousJudge »

yread wrote: post #16

I thought this was one of those files that are an image and an executable AT THE SAME TIME. Slightly disappointed that it's just catted together

Totally unrelated, but I'm always reminded of Spore's (the videogame) save files. Creatures, buildings and such would be saved as .png and you'd get a nice preview screenshot of the creation, but the same file also contained the information for the game to actually load the thing. It was pretty cool

Re: A picture got my PostgreSQL database to start mining Monero

#33

Post by yjftsjthsd-h »

xyrouter wrote: post #28
jacob019 wrote: post #6

It's amazing that in 2018 people leave databases publicly exposed.

I want to know why exposing databases on the Internet publicly is considered a problem. Is it because a vulnerability found in a database would allow to exploit the database directly? I ask this because people expose web-apps on the Internet publicly too and an SQL injection vulnerability on the web-app would also be equally catastrophic. I guess exposing web-apps on the Internet is a risk we need to accept because i…

I think you've hit it; never expose anything without good reason, and the database doesn't need to be exposed. This is compounded because, while apps can have injection vulnerabilities, I expect it to be easier to sanitize things at that level rather than exposing the database but expecting it to filter things enough. Or if you prefer: The failure mode of an app is that it passes raw (escapable) queries to the database. If you expose the DB, then raw queries are the starting line.

Re: A picture got my PostgreSQL database to start mining Monero

#34

Post by craigkerstiens »

The short story of this is:

- Gain access to the database itself

- And the Postgres database should be vulnerable to various remote code execution

- Once they're able to execute code remotely, they then download an image which has binary data tacked onto it

- They then parse out the executable part of the image using dd

- Then they're able to execute and mine away

While an interesting read the shortest takeaway is:

1. Don't leave your Postgres open to the public internet and

2. Ensure to upgrade when security releases come out.

If you're unsure if the version your on has security patches available or other reasons to upgrade consider checking out https://why-upgrade.depesz.com/

Edit: Looks like the user that gained access had ability to execute pl/c. Which has to run as superuser. You won't find things like pl/c, pl/python generally supported on most Postgres services like Heroku, RDS, Citus because of just this reason. So in this case database access with pl/c was enabled, suspect could have been done equally via other vectors (once database access was achieved).

Re: A picture got my PostgreSQL database to start mining Monero

#36

Post by hans_castorp »

Creating a C language function is not allowed to regular users by default because "language C" is an untrusted language only superusers can create functions using that. Additionally, regular users don't have the privileges to insert into pg_proc. So unless the attacked application uses a superuser for database access (which is a big security hole to begin with) or uses a superuser account with a weak password and allow superuser access from the outside, I don't see how this could be exploited.

Re: A picture got my PostgreSQL database to start mining Monero

#37

Post by james-mcelwain »

xyrouter wrote: post #28
jacob019 wrote: post #6

It's amazing that in 2018 people leave databases publicly exposed.

I want to know why exposing databases on the Internet publicly is considered a problem. Is it because a vulnerability found in a database would allow to exploit the database directly? I ask this because people expose web-apps on the Internet publicly too and an SQL injection vulnerability on the web-app would also be equally catastrophic. I guess exposing web-apps on the Internet is a risk we need to accept because i…

> But we should not expose anything else that we don't need to?

Yes. Why would you ever need public logins from the open internet to your production database? Even if you need to ability to log in from a random computer, there are better ways, like requiring the use of a vpn so logins are always coming from a white listed ip.

Re: A picture got my PostgreSQL database to start mining Monero

#38

Post by hans_castorp »

tehwebguy wrote: post #35

So how can one protect against an image with a payload? Would the payload still be there if the image was rebuilt with Imagemagick?

Don't access your database with a superuser account from your application.

Don't allow superuser connections from outside of your network.

Re: A picture got my PostgreSQL database to start mining Monero

#39

Post by ianlevesque »

TremendousJudge wrote: post #32
yread wrote: post #16

I thought this was one of those files that are an image and an executable AT THE SAME TIME. Slightly disappointed that it's just catted together

Totally unrelated, but I'm always reminded of Spore's (the videogame) save files. Creatures, buildings and such would be saved as .png and you'd get a nice preview screenshot of the creation, but the same file also contained the information for the game to actually load the thing. It was pretty cool

That’s genius
Post reply on HN