Why would you have your (ANY) db directly publicly accessible?
* Multi-Cloud - no money for VPN
* AWS RDS + Heroku and not knowing better
* Sharing a database with a customer
There are a lot of reasons. Some are ok, some are not
A picture got my PostgreSQL database to start mining Monero
81–90 of 99 posts
Re: A picture got my PostgreSQL database to start mining Monero
#82The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…
> 1. Don't leave your Postgres open to the public internet and you need to do better than that, since attacks within the firewall can occur as well, and this is probably a more common vector for corporate espionage these days. A compromised laptop can get a wide open remote exploit onto a companies' production environment if the database itself is open within the firewall.
Yup. Your database (as well as the majority of ports for other hosts) shouldn't be available from your corporate network either. 99% of corporate users don't need network access beyond a few ports to most hosts.
Re: A picture got my PostgreSQL database to start mining Monero
#83The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…
3. Don't let your DB engine execute random executable like wget/dd (Apparmor/SELinux)
4. Don't let your DB host make outbound connections (iptables/ip6tables)
Re: A picture got my PostgreSQL database to start mining Monero
#84Clickbait headline. Was expecting a weird Postgres buffer overflow or something, instead it's a honeypot and the picture is almost completely irrelevant (just a matter of where the attacker hosted their binary).
Re: A picture got my PostgreSQL database to start mining Monero
#85Earlier quoted context omitted.
Any idea how they did it? Stenography or just catting things together like this example?
I don't think so, the images were pretty low res iirc. I did some googling though, and the only thing I found was somebody that said "the game reads the model data out from the file's alpha channel". However, I'd expect the data to just be appended to the end of the file, since PNG works anyway with that.
PNG is extensible, so they could totally have defined a PNG "chunk" in the private namespace and shoved the data in that. They didn't though. They treated PNG as just a way to store image data and wrote their extra data into the image, encrypted in an amateurish way.
Re: A picture got my PostgreSQL database to start mining Monero
#86It's amazing that in 2018 people leave databases publicly exposed.
It’s because of the stupid overhead that SSH has out of the box and the complexity of installing and managing db certs. A db admin will say “eh it’s fine; we’ll just use iptables to restrict it to prod server” and then somewhere along the way they’ll get a second prod server and someone junior will somehow fuck it up then the whole thing is open. It’s really hard to move fast and stay secure. You have to nail so many…
I'm going to strongly disagree with that point. You can; you just have to prioritize security.
Re: A picture got my PostgreSQL database to start mining Monero
#87Re: A picture got my PostgreSQL database to start mining Monero
#88Earlier quoted context omitted.
It's executed from PostgreSQL - the article shows SQL queries containing shell commands. This is a way for an attacker who's already obtained the ability to run arbitrary queries against a PostgreSQL server to run an exploitation payload there; the real solution is not to let the attacker get into that situation.
Thanks. Is there a name for these kind of contingent exploits? If step 1 is get root/execute code, it it reduces the risk of the exploit. Still valuable to know about, but not that much if you can execute code on a server.
The "exploit" is the part where the attacker gets root/remote code execution. Using the computer to mine cryptocurrency rather than participate in DDOS attacks or host child porn is just a detail.
Re: A picture got my PostgreSQL database to start mining Monero
#89Re: A picture got my PostgreSQL database to start mining Monero
#90This title makes zero sense.