News for hackers. Stuff that matters.

A comment on A picture got my PostgreSQL database to start mining Monero.

Re:A picture got my PostgreSQL database to start mining Monero by craigkerstiens on Monday March 19, 2018 @09:45AM (#16618274)
The short story of this is:

- Gain access to the database itself

- And the Postgres database should be vulnerable to various remote code execution

- Once they're able to execute code remotely, they then download an image which has binary data tacked onto it

- They then parse out the executable part of the image using dd

- Then they're able to execute and mine away

While an interesting read the shortest takeaway is:

1. Don't leave your Postgres open to the public internet and

2. Ensure to upgrade when security releases come out.

If you're unsure if the version your on has security patches available or other reasons to upgrade consider checking out https://why-upgrade.depesz.com/

Edit: Looks like the user that gained access had ability to execute pl/c. Which has to run as superuser. You won't find things like pl/c, pl/python generally supported on most Postgres services like Heroku, RDS, Citus because of just this reason. So in this case database access with pl/c was enabled, suspect could have been done equally via other vectors (once database access was achieved).

[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by zzzeek on Monday March 19, 2018 @01:33PM (#16620633)
> 1. Don't leave your Postgres open to the public internet and

you need to do better than that, since attacks within the firewall can occur as well, and this is probably a more common vector for corporate espionage these days. A compromised laptop can get a wide open remote exploit onto a companies' production environment if the database itself is open within the firewall.

[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by favorited on Monday March 19, 2018 @04:07PM (#16622595)
Yup. Your database (as well as the majority of ports for other hosts) shouldn't be available from your corporate network either. 99% of corporate users don't need network access beyond a few ports to most hosts.
[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by sdeziel on Monday March 19, 2018 @04:15PM (#16622659)
3. Don't let your DB engine execute random executable like wget/dd (Apparmor/SELinux)

4. Don't let your DB host make outbound connections (iptables/ip6tables)

[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by emmelaich on Monday March 19, 2018 @06:54PM (#16624102)
> Don't let your DB host make outbound connections

Which can also be prevented with SELinux

[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by PinguTS on Monday March 19, 2018 @10:46AM (#16618714)
Actually, the takeaway is not about updates. Because the problem is actual intended functionality, that is "misused" for other purposes: indirect function calls.

So, the takeaway would be to control, which functionality is needed and which not, then to take action accordingly.

[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by cryptonector on Monday March 19, 2018 @11:08AM (#16618909)
Well, for one thing, inserting into pg_catalog tables without DDLs should require privilege and be audited.

Secondly, things like lo_export() should be disabled by default.

[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by anarazel on Monday March 19, 2018 @02:37PM (#16621608)
> Well, for one thing, inserting into pg_catalog tables without DDLs should require privilege and be audited.

It does require privileges.

> Secondly, things like lo_export() should be disabled by default.

It's superuser only.

[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by postila on Monday March 19, 2018 @08:02PM (#16624651)
things like superuser should be disabled by default (only DBA needs superuser access, not anybody else).
[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by craigkerstiens on Monday March 19, 2018 @10:52AM (#16618764)
Ah, yes. pl/c was the culprit it seems more than some other known vulnerability, updated original accordingly.
[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by tonmoy on Monday March 19, 2018 @10:19AM (#16618476)
The first paragraph mentions that this is a honeypot
[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by misterman101 on Monday March 19, 2018 @10:46AM (#16618716)
The server is a honeypot run by Imperva.

This means that real attackers are attempting right now.

[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by Cthulhu_ on Monday March 19, 2018 @11:30AM (#16619135)
The article does mention there's a lot of monero in the indicated wallet.
[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by Animats on Monday March 19, 2018 @11:24AM (#16619070)
The real problem is that Postgres will let you load C functions to run in the server context. That's inherently a bad idea.

Your databases should have multiple users configured with limited roles. Nothing web-facing should have a user with the ability to create a function. A SELECT-only user is a good start.

[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by merb on Monday March 19, 2018 @12:45PM (#16619904)
only the server administrator can do that. (i.e. users with server admin role) as far as I know thats forbidden on aws rds, i.e. to load c functions..
[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by postila on Monday March 19, 2018 @08:00PM (#16624634)
Also: 3. Ensure that you don't use or provide anybody superuser in Postgres. (Otherwise, there is much simpler way to download&run anything that explain in the article – just `copy tablename from program 'wget ... && chmod a+x ... && ...'`
[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by chucky_z on Monday March 19, 2018 @11:19AM (#16619011)
RDS supports some random PL stuff, specifically PL/Perl and PL/v8 it seems.
[ Parent | on HN ]
Re:A picture got my PostgreSQL database to start mining Monero by craigkerstiens on Monday March 19, 2018 @11:26AM (#16619095)
RDS supports one that do not run as superuser and run sandboxed. pl/perl and pl/v8 are great procedural languages because of that reason.
[ Parent | on HN ]