Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A picture got my PostgreSQL database to start mining Monero

imperva.com

Post reply on HN
Print view View original

61–70 of 99 posts

Re: A picture got my PostgreSQL database to start mining Monero

#61

Post by [deleted] »

Animats wrote: post #56
craigkerstiens wrote: post #34

The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…

The real problem is that Postgres will let you load C functions to run in the server context. That's inherently a bad idea. Your databases should have multiple users configured with limited roles. Nothing web-facing should have a user with the ability to create a function. A SELECT-only user is a good start.

[deleted]

Re: A picture got my PostgreSQL database to start mining Monero

#62

Post by 3pt14159 »

jacob019 wrote: post #6

It's amazing that in 2018 people leave databases publicly exposed.

It’s because of the stupid overhead that SSH has out of the box and the complexity of installing and managing db certs. A db admin will say “eh it’s fine; we’ll just use iptables to restrict it to prod server” and then somewhere along the way they’ll get a second prod server and someone junior will somehow fuck it up then the whole thing is open.

It’s really hard to move fast and stay secure. You have to nail so many things and you’re either running out of money or running out of time 99% of the time.

Re: A picture got my PostgreSQL database to start mining Monero

#64

Post by Analemma_ »

This reminds me of SQL Slammer. Remember that? After that mess, there were Slashdot threads just like we have HN threads right now, and the overwhelming consensus among the sysadmins there was, "Database servers should never be visible to the public Internet. They should always be behind a VPN or application server". And then, as is usual for nerd fora, someone would try to come up with a counterexample, "But what if...", and the sysadmins would just cut them off with, "No. Never ever."

That hasn't changed, folks. If someone on the Internet can talk to your Postgres database, you are Doing It Wrong.

Re: A picture got my PostgreSQL database to start mining Monero

#67

Post by merb »

Animats wrote: post #56
craigkerstiens wrote: post #34

The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…

The real problem is that Postgres will let you load C functions to run in the server context. That's inherently a bad idea. Your databases should have multiple users configured with limited roles. Nothing web-facing should have a user with the ability to create a function. A SELECT-only user is a good start.

only the server administrator can do that. (i.e. users with server admin role) as far as I know thats forbidden on aws rds, i.e. to load c functions..

Re: A picture got my PostgreSQL database to start mining Monero

#68

Post by curiousGambler »

TremendousJudge wrote: post #32
yread wrote: post #16

I thought this was one of those files that are an image and an executable AT THE SAME TIME. Slightly disappointed that it's just catted together

Totally unrelated, but I'm always reminded of Spore's (the videogame) save files. Creatures, buildings and such would be saved as .png and you'd get a nice preview screenshot of the creation, but the same file also contained the information for the game to actually load the thing. It was pretty cool

Any idea how they did it? Stenography or just catting things together like this example?

Re: A picture got my PostgreSQL database to start mining Monero

#69

Post by aiCeivi9 »

tehwebguy wrote: post #35

So how can one protect against an image with a payload? Would the payload still be there if the image was rebuilt with Imagemagick?

That is not something you need to protect against, it was only used to make hosting malware code easier.

For image hosting services it is required to process images anyway - for example to strip EXIF GPS data. It looks like imagemagick can't really do it for JPEGs: https://stackoverflow.com/questions/2654281/how-to-remove-ex...

Re: A picture got my PostgreSQL database to start mining Monero

#70

Post by zzzeek »

craigkerstiens wrote: post #34

The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…

> 1. Don't leave your Postgres open to the public internet and

you need to do better than that, since attacks within the firewall can occur as well, and this is probably a more common vector for corporate espionage these days. A compromised laptop can get a wide open remote exploit onto a companies' production environment if the database itself is open within the firewall.

Post reply on HN