> This attack’s Monero address has done more than 312.5 XMR so far, valued with more than $90,000 to date.
Wow. IMO buried lede. That is... very impressive.
A picture got my PostgreSQL database to start mining Monero
41–50 of 99 posts
Re: A picture got my PostgreSQL database to start mining Monero
#42Creating a C language function is not allowed to regular users by default because "language C" is an untrusted language only superusers can create functions using that. Additionally, regular users don't have the privileges to insert into pg_proc. So unless the attacked application uses a superuser for database access (which is a big security hole to begin with) or uses a superuser account with a weak password and all…
Seems to be an intentional honeypot. That said, the storing the binary code on an innocent image host was a nice find that wouldn't have happened had the attack been blocked immediately. Pretty nice win for that image host to learn to strip images and they can stop hosting malware...
Re: A picture got my PostgreSQL database to start mining Monero
#43So how can one protect against an image with a payload? Would the payload still be there if the image was rebuilt with Imagemagick?
If the image is not lossy compressed (even if it is for the really clever) you can use a variety steganographic tricks to hide any data you want inside an image. Of course you have to have code to decode it.
Re: A picture got my PostgreSQL database to start mining Monero
#44The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…
The first paragraph mentions that this is a honeypot
Re: A picture got my PostgreSQL database to start mining Monero
#45Much like the porn industry drives progress in the video format wars, it seems that malware drives progress in the cryptocurrency space. I for one am very excited!
Re: A picture got my PostgreSQL database to start mining Monero
#46This is awesome.
Re: A picture got my PostgreSQL database to start mining Monero
#47How exactly can this be exploited? Who has to run the Postgres database? In what kind of way does it has to be accessed to get this happening? Are we talking about web apps that use Postgres on the back end and run arbitrary queries? Are we talking about people who somehow extract the Postgres database username and password and it has admin permissions? I wasn't sure what's happening.
at this point, the attacker has already owned the database and found an exploit that allows arbitrary shell execution on the host. i feel like the title is a little bit click-baity, because the attacker could have just hosted their executable payload on any of a thousand shady file hosting sites without needing to hide it in an image.
The image has 2 purposes:
- make it easy to host it on a public, reputable, unblocked web site;
- have a format AV detect less often.
Re: A picture got my PostgreSQL database to start mining Monero
#48Ironically unavailable due to an "error establishing a database connection".
Someone may have uploaded an image of Scarlett Johansson.
Re: A picture got my PostgreSQL database to start mining Monero
#49The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…
Actually, the takeaway is not about updates. Because the problem is actual intended functionality, that is "misused" for other purposes: indirect function calls.
So, the takeaway would be to control, which functionality is needed and which not, then to take action accordingly.
Re: A picture got my PostgreSQL database to start mining Monero
#50The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…
The first paragraph mentions that this is a honeypot
The server is a honeypot run by Imperva.
This means that real attackers are attempting right now.