Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A picture got my PostgreSQL database to start mining Monero

imperva.com

Post reply on HN
Print view View original

71–80 of 99 posts

Re: A picture got my PostgreSQL database to start mining Monero

#71

Post by TremendousJudge »

curiousGambler wrote: post #68
TremendousJudge wrote: post #32

Earlier quoted context omitted.

Totally unrelated, but I'm always reminded of Spore's (the videogame) save files. Creatures, buildings and such would be saved as .png and you'd get a nice preview screenshot of the creation, but the same file also contained the information for the game to actually load the thing. It was pretty cool

Any idea how they did it? Stenography or just catting things together like this example?

I don't think so, the images were pretty low res iirc. I did some googling though, and the only thing I found was somebody that said "the game reads the model data out from the file's alpha channel". However, I'd expect the data to just be appended to the end of the file, since PNG works anyway with that.

Re: A picture got my PostgreSQL database to start mining Monero

#72

Post by zzzeek »

xyrouter wrote: post #28
jacob019 wrote: post #6

It's amazing that in 2018 people leave databases publicly exposed.

I want to know why exposing databases on the Internet publicly is considered a problem. Is it because a vulnerability found in a database would allow to exploit the database directly? I ask this because people expose web-apps on the Internet publicly too and an SQL injection vulnerability on the web-app would also be equally catastrophic. I guess exposing web-apps on the Internet is a risk we need to accept because i…

a web app presents a coarse-grained API, in that it exposes a very small, fixed number of API calls with very generic, non-system specific parameters and responses, each of which has been tailored for public exposure.

The database OTOH represents an entire programming shell, e.g. extremely fine-grained and in many cases linked directly to the underlying system as was shown in this article - additionally, the number of entrypoints is undefined. If you somehow were convinced that you've locked down every single function of your database from attack, the next day you upgrade the database to a new version and it can very well expose new functions that are again exposed.

Re: A picture got my PostgreSQL database to start mining Monero

#73

Post by knorker »

The short story of this is:

Cryptocurrencies are run on, by, and for crime. It's immoral to participate in cryptocurrencies. You wouldn't be a member of a club that had people like this owning the club house and everyone on the board, but due to pure greed and wilful ignorance people keep "investing" in this organized crime.

Shame on you all.

Re: A picture got my PostgreSQL database to start mining Monero

#74

Post by teddyh »

andrewshadura wrote: post #5
teddyh wrote: post #3

Earlier quoted context omitted.

PostgreSQL, not Postgres.

Well, it's both: the original name was Postgres, later extended to include SQL in it.

It was Postgres for the first ten years since the start in 1985, but it’s been “PostgreSQL” for more than twenty years now.

Re: A picture got my PostgreSQL database to start mining Monero

#75

Post by anarazel »

cryptonector wrote: post #54
PinguTS wrote: post #49

Earlier quoted context omitted.

Actually, the takeaway is not about updates. Because the problem is actual intended functionality, that is "misused" for other purposes: indirect function calls. So, the takeaway would be to control, which functionality is needed and which not, then to take action accordingly.

Well, for one thing, inserting into pg_catalog tables without DDLs should require privilege and be audited. Secondly, things like lo_export() should be disabled by default.

> Well, for one thing, inserting into pg_catalog tables without DDLs should require privilege and be audited.

It does require privileges.

> Secondly, things like lo_export() should be disabled by default.

It's superuser only.

Re: A picture got my PostgreSQL database to start mining Monero

#76

Post by zombieprocesses »

hans_castorp wrote: post #36

Creating a C language function is not allowed to regular users by default because "language C" is an untrusted language only superusers can create functions using that. Additionally, regular users don't have the privileges to insert into pg_proc. So unless the attacked application uses a superuser for database access (which is a big security hole to begin with) or uses a superuser account with a weak password and all…

> So unless the attacked application uses a superuser for database access (which is a big security hole to begin with) or uses a superuser account with a weak password and allow superuser access from the outside, I don't see how this could be exploited.

It can't be exploited if the security "best practices" are used. But I've come across situations where people were using "sa" as the account for production SQL Server connections because they just didn't know any better. Things are much better in the linux/bsd world where there is generally more competence and people tend to know what they are doing.

Having said that, things are getting better. IT/developers are much more mindful of security concerns today than 10 years ago.

Re: A picture got my PostgreSQL database to start mining Monero

#77

Post by prepend »

lmm wrote: post #22
prepend wrote: post #19

How does the image get executed? I went through the article and in the example the author extracts the executable manually using dd. But how would an unsuspecting user run the executable? Perhaps I missed this, but is there some image viewer or browser that runs the trailing bytes of images?

It's executed from PostgreSQL - the article shows SQL queries containing shell commands. This is a way for an attacker who's already obtained the ability to run arbitrary queries against a PostgreSQL server to run an exploitation payload there; the real solution is not to let the attacker get into that situation.

Thanks.

Is there a name for these kind of contingent exploits? If step 1 is get root/execute code, it it reduces the risk of the exploit.

Still valuable to know about, but not that much if you can execute code on a server.

Re: A picture got my PostgreSQL database to start mining Monero

#78

Post by anarazel »

Cthulhu_ wrote: post #59
hans_castorp wrote: post #38

Earlier quoted context omitted.

Don't access your database with a superuser account from your application. Don't allow superuser connections from outside of your network.

Don't have superuser accounts at all if you can help it. Run Postgres in a limited user. Something that can't access any file or execute any command (like wget) it doesn't need, can't do chmod +x. Can't run a shell. Don't know if postgres needs that.

No, postgres can't work without accessing files or having a working shell (latter kinda works in some limited configurations).

And I don't think it's a reasonable idea to not have a superuser at all. But you can have it password less and only accessible from the local machine and a specific account (eg root).

Re: A picture got my PostgreSQL database to start mining Monero

#79

Post by anarazel »

fps wrote: post #23
prepend wrote: post #19

How does the image get executed? I went through the article and in the example the author extracts the executable manually using dd. But how would an unsuspecting user run the executable? Perhaps I missed this, but is there some image viewer or browser that runs the trailing bytes of images?

I was hoping for some sort of image or binary processing exploit too, but the attack just uses a Postgres vulnerability to execute arbitrary shell code. [0][1] The fact that the executed code was buried in an image seems to just be a camouflage step for the attacker. 0. https://github.com/nixawk/pentest-wiki/blob/master/2.Vulnera... 1. https://www.rapid7.com/db/modules/exploit/linux/postgres/pos...

There's no exploit here, superusers can do things, that's it.

Re: A picture got my PostgreSQL database to start mining Monero

#80

Post by merb »

goshx wrote: post #13
maffydub wrote: post #9

Earlier quoted context omitted.

I think this was a honeypot, so you want to expose it to make it an easy (or at least easier) target, don't you?

By the end of the article the author mentions that there are thousands (700k+) exposed installations.

Yeah exposed to the internet. While most of them were from AWS RDS probably. Which actually forbids using untrusted Languages.
Post reply on HN