Feedback-ID: i76984098:Fastmail
Message-ID: <48b5c3db-5836-4353-8131-a9e5bedea1ac@aklaver.com>
Date: Wed, 2 Apr 2025 08:31:42 -0700
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Any industry best practise to overcome this specific malware
 "pg_mem"
To: Bharani SV-forum <esteembsv-forum@yahoo.com>,
 Greg Sabino Mullane <htamfids@gmail.com>,
 Ron Johnson <ronljohnsonjr@gmail.com>,
 "pgsql-general@postgresql.org" <pgsql-general@postgresql.org>
References: <0558ddd4d71641bdb41fa49b2425f73c@safrangroup.com>
 <132487461.4068668.1737741687606@mail.yahoo.com>
 <0dc06cb7-33cc-43ba-a95f-535fdf0a0439@aklaver.com>
 <1751608443.5432365.1738081421269@mail.yahoo.com>
 <74599d1d-c8a2-4e59-a50d-019dcc973de8@aklaver.com>
 <200665967.5560583.1738095230696@mail.yahoo.com>
 <21b5d62a-19d1-413f-9d5e-d681cd2bb91b@aklaver.com>
 <47454513.6047834.1738179914107@mail.yahoo.com>
 <1841861276.9581730.1738888679871@mail.yahoo.com>
 <fabc9547-1de0-4efa-baf5-124d91e3fab5@aklaver.com>
 <56243553.9616888.1738893835649@mail.yahoo.com>
 <940531722.732202.1739711614045@mail.yahoo.com>
 <6f44101c-ce01-478e-9fb1-138a10f358d9@aklaver.com>
 <688728245.763369.1739723234892@mail.yahoo.com>
 <b5fd053f-9131-4ee4-8f67-8d9efa6b4e97@aklaver.com>
 <1530912903.785341.1739727814631@mail.yahoo.com>
 <1995396392.4440995.1740508041256@mail.yahoo.com>
 <849879720.83739.1741119882239@mail.yahoo.com>
 <80651822.852134.1743607125222@mail.yahoo.com>
Content-Language: en-US
From: Adrian Klaver <adrian.klaver@aklaver.com>
In-Reply-To: <80651822.852134.1743607125222@mail.yahoo.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/48b5c3db-5836-4353-8131-a9e5bedea1ac%40aklaver.com>
Precedence: bulk

On 4/2/25 08:18, Bharani SV-forum wrote:
> Hello MVP's
> Good Morning
> Any industry best practise to overcome this specific malware "pg_mem".
> 
> url = 
> https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/ <https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/>

 From above:

"The first stage is a simple brute force attack. We observe several 
login attempts to the PostgreSQL database being refused until the brute 
force attack successfully guesses the honeypot’s username and password 
(which were intentionally set to be easy to guess)."

After the threat actor successfully guess the user and password, the 
attack sequence commenced. The following set of SQL commands, were 
executed: ...
"

The first command being creating a role with SUPERUSER privileges which 
depends the hacked role being a SUPERUSER itself.


So the solution is basic practices:

1) Don't expose the database anymore then necessary. It other words keep 
access to the instance as restricted as possible, e.g. behind firewall.

2) Don't use easy passwords or use one or more of the auth methods shown 
here:

https://www.postgresql.org/docs/current/client-authentication.html

3) Try to avoid using SUPERUSER roles as login roles.

Keeping up to date is good practice, but in and of itself it will not 
prevent the attack shown.

> 
> We are up to date with the respective postgres server major version 13 
> and minor patch as .20
> i.e 13.20
> Also working on the steps for db migration from ver 13.X to ver 14.X
> We are also update with respective AWS based EC2 server based OS patches

-- 
Adrian Klaver
adrian.klaver@aklaver.com