Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A picture got my PostgreSQL database to start mining Monero

imperva.com

Post reply on HN
Print view View original

51–60 of 99 posts

Re: A picture got my PostgreSQL database to start mining Monero

#51

Post by a012 »

hans_castorp wrote: post #36

Creating a C language function is not allowed to regular users by default because "language C" is an untrusted language only superusers can create functions using that. Additionally, regular users don't have the privileges to insert into pg_proc. So unless the attacked application uses a superuser for database access (which is a big security hole to begin with) or uses a superuser account with a weak password and all…

Look for the wide open MongoDB then most recently Memcached servers, it's possible for many people just don't secure their internet connected DB server. The Shodan result mentioned in the article proved.

Re: A picture got my PostgreSQL database to start mining Monero

#52

Post by craigkerstiens »

PinguTS wrote: post #49
craigkerstiens wrote: post #34

The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…

Actually, the takeaway is not about updates. Because the problem is actual intended functionality, that is "misused" for other purposes: indirect function calls. So, the takeaway would be to control, which functionality is needed and which not, then to take action accordingly.

Ah, yes. pl/c was the culprit it seems more than some other known vulnerability, updated original accordingly.

Re: A picture got my PostgreSQL database to start mining Monero

#54

Post by cryptonector »

PinguTS wrote: post #49
craigkerstiens wrote: post #34

The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…

Actually, the takeaway is not about updates. Because the problem is actual intended functionality, that is "misused" for other purposes: indirect function calls. So, the takeaway would be to control, which functionality is needed and which not, then to take action accordingly.

Well, for one thing, inserting into pg_catalog tables without DDLs should require privilege and be audited.

Secondly, things like lo_export() should be disabled by default.

Re: A picture got my PostgreSQL database to start mining Monero

#55

Post by chucky_z »

craigkerstiens wrote: post #34

The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…

RDS supports some random PL stuff, specifically PL/Perl and PL/v8 it seems.

Re: A picture got my PostgreSQL database to start mining Monero

#56

Post by Animats »

craigkerstiens wrote: post #34

The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…

The real problem is that Postgres will let you load C functions to run in the server context. That's inherently a bad idea.

Your databases should have multiple users configured with limited roles. Nothing web-facing should have a user with the ability to create a function. A SELECT-only user is a good start.

Re: A picture got my PostgreSQL database to start mining Monero

#57

Post by craigkerstiens »

chucky_z wrote: post #55
craigkerstiens wrote: post #34

The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…

RDS supports some random PL stuff, specifically PL/Perl and PL/v8 it seems.

RDS supports one that do not run as superuser and run sandboxed. pl/perl and pl/v8 are great procedural languages because of that reason.

Re: A picture got my PostgreSQL database to start mining Monero

#58

Post by Cthulhu_ »

misterman101 wrote: post #50
tonmoy wrote: post #44

Earlier quoted context omitted.

The first paragraph mentions that this is a honeypot

The server is a honeypot run by Imperva. This means that real attackers are attempting right now.

The article does mention there's a lot of monero in the indicated wallet.

Re: A picture got my PostgreSQL database to start mining Monero

#59

Post by Cthulhu_ »

hans_castorp wrote: post #38
tehwebguy wrote: post #35

So how can one protect against an image with a payload? Would the payload still be there if the image was rebuilt with Imagemagick?

Don't access your database with a superuser account from your application. Don't allow superuser connections from outside of your network.

Don't have superuser accounts at all if you can help it.

Run Postgres in a limited user. Something that can't access any file or execute any command (like wget) it doesn't need, can't do chmod +x. Can't run a shell. Don't know if postgres needs that.

Post reply on HN