Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A picture got my PostgreSQL database to start mining Monero

imperva.com

Post reply on HN
Print view View original

91–99 of 99 posts

Re: A picture got my PostgreSQL database to start mining Monero

#91

Post by emmelaich »

sdeziel wrote: post #83
craigkerstiens wrote: post #34

The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…

3. Don't let your DB engine execute random executable like wget/dd (Apparmor/SELinux) 4. Don't let your DB host make outbound connections (iptables/ip6tables)

> Don't let your DB host make outbound connections

Which can also be prevented with SELinux

Re: A picture got my PostgreSQL database to start mining Monero

#92

Post by postila »

craigkerstiens wrote: post #34

The short story of this is: - Gain access to the database itself - And the Postgres database should be vulnerable to various remote code execution - Once they're able to execute code remotely, they then download an image which has binary data tacked onto it - They then parse out the executable part of the image using dd - Then they're able to execute and mine away While an interesting read the shortest takeaway is: 1…

Also: 3. Ensure that you don't use or provide anybody superuser in Postgres. (Otherwise, there is much simpler way to download&run anything that explain in the article – just `copy tablename from program 'wget ... && chmod a+x ... && ...'`

Re: A picture got my PostgreSQL database to start mining Monero

#93

Post by postila »

cryptonector wrote: post #54
PinguTS wrote: post #49

Earlier quoted context omitted.

Actually, the takeaway is not about updates. Because the problem is actual intended functionality, that is "misused" for other purposes: indirect function calls. So, the takeaway would be to control, which functionality is needed and which not, then to take action accordingly.

Well, for one thing, inserting into pg_catalog tables without DDLs should require privilege and be audited. Secondly, things like lo_export() should be disabled by default.

things like superuser should be disabled by default (only DBA needs superuser access, not anybody else).

Re: A picture got my PostgreSQL database to start mining Monero

#95

Post by mythrwy »

knorker wrote: post #73

The short story of this is: Cryptocurrencies are run on, by, and for crime. It's immoral to participate in cryptocurrencies. You wouldn't be a member of a club that had people like this owning the club house and everyone on the board, but due to pure greed and wilful ignorance people keep "investing" in this organized crime. Shame on you all.

That's just silly.

This was one currency and bad behavior used to obtain it doesn't even reflect on that.

Re: A picture got my PostgreSQL database to start mining Monero

#96

Post by lmm »

dmurray wrote: post #88
prepend wrote: post #77

Earlier quoted context omitted.

Thanks. Is there a name for these kind of contingent exploits? If step 1 is get root/execute code, it it reduces the risk of the exploit. Still valuable to know about, but not that much if you can execute code on a server.

The "exploit" is the part where the attacker gets root/remote code execution. Using the computer to mine cryptocurrency rather than participate in DDOS attacks or host child porn is just a detail.

Getting from "execute arbitrary SQL queries" to "execute specific exploit code" is not a completely trivial step, though of course it's not the most important part.

Re: A picture got my PostgreSQL database to start mining Monero

#97

Post by knorker »

mythrwy wrote: post #95
knorker wrote: post #73

The short story of this is: Cryptocurrencies are run on, by, and for crime. It's immoral to participate in cryptocurrencies. You wouldn't be a member of a club that had people like this owning the club house and everyone on the board, but due to pure greed and wilful ignorance people keep "investing" in this organized crime. Shame on you all.

That's just silly. This was one currency and bad behavior used to obtain it doesn't even reflect on that.

Nothing good has come from cryptocurrencies, and boat loads of bad has, is, and will continue to come out of it.

Investors ignoring or rationalising all the bad because of their greed is, in my opinion, disgusting.

Re: A picture got my PostgreSQL database to start mining Monero

#98

Post by redspectre »

These attacks are not interesting. They require superuser functionality. Can't believe this wasn't mentioned. If someone has superuser access on your database, it's game over.

The real solution is not to go around making DBAs' lives harder by disabling all this stuff. The real solution is to not give attackers on the internet superuser access on your database!!! Why is the database exposed to the public internet to begin with?

Re: A picture got my PostgreSQL database to start mining Monero

#99

Post by samstave »

merb wrote: post #81
samstave wrote: post #65

Why would you have your (ANY) db directly publicly accessible?

* Multi-Cloud - no money for VPN * AWS RDS + Heroku and not knowing better * Sharing a database with a customer There are a lot of reasons. Some are ok, some are not

if I were sharing the DB with customer - whitelist IP only - not just leave the ports open to the world. Thats insane.

The only reason I can see is for honeypot.

Post reply on HN