MIME-Version: 1.0
References: <0558ddd4d71641bdb41fa49b2425f73c@safrangroup.com>
 <132487461.4068668.1737741687606@mail.yahoo.com> <0dc06cb7-33cc-43ba-a95f-535fdf0a0439@aklaver.com>
 <1751608443.5432365.1738081421269@mail.yahoo.com> <74599d1d-c8a2-4e59-a50d-019dcc973de8@aklaver.com>
 <200665967.5560583.1738095230696@mail.yahoo.com> <21b5d62a-19d1-413f-9d5e-d681cd2bb91b@aklaver.com>
 <47454513.6047834.1738179914107@mail.yahoo.com> <1841861276.9581730.1738888679871@mail.yahoo.com>
 <fabc9547-1de0-4efa-baf5-124d91e3fab5@aklaver.com> <56243553.9616888.1738893835649@mail.yahoo.com>
 <940531722.732202.1739711614045@mail.yahoo.com> <6f44101c-ce01-478e-9fb1-138a10f358d9@aklaver.com>
 <688728245.763369.1739723234892@mail.yahoo.com> <b5fd053f-9131-4ee4-8f67-8d9efa6b4e97@aklaver.com>
 <1530912903.785341.1739727814631@mail.yahoo.com> <1995396392.4440995.1740508041256@mail.yahoo.com>
 <849879720.83739.1741119882239@mail.yahoo.com> <80651822.852134.1743607125222@mail.yahoo.com>
 <48b5c3db-5836-4353-8131-a9e5bedea1ac@aklaver.com>
In-Reply-To: <48b5c3db-5836-4353-8131-a9e5bedea1ac@aklaver.com>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Wed, 2 Apr 2025 12:22:08 -0400
Message-ID: <CANzqJaBNfETJu-Z+GhSU-Nxu_Vt4=LHtVxGMYYR_iTJWHXd-HQ@mail.gmail.com>
Subject: Re: Any industry best practise to overcome this specific malware "pg_mem"
To: "pgsql-general@postgresql.org" <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000b41cc80631ce0eab"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaBNfETJu-Z%2BGhSU-Nxu_Vt4%3DLHtVxGMYYR_iTJWHXd-HQ%40mail.gmail.com>
Precedence: bulk

--000000000000b41cc80631ce0eab
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Apr 2, 2025 at 11:31=E2=80=AFAM Adrian Klaver <adrian.klaver@aklave=
r.com>
wrote:

> On 4/2/25 08:18, Bharani SV-forum wrote:
> > Hello MVP's
> > Good Morning
> > Any industry best practise to overcome this specific malware "pg_mem".
> >
> > url =3D
> >
> https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-proc=
esses/
> <
> https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-proc=
esses/
> >
>
>  From above:
>
> "The first stage is a simple brute force attack. We observe several
> login attempts to the PostgreSQL database being refused until the brute
> force attack successfully guesses the honeypot=E2=80=99s username and pas=
sword
> (which were intentionally set to be easy to guess)."
>
> After the threat actor successfully guess the user and password, the
> attack sequence commenced. The following set of SQL commands, were
> executed: ...
> "
>
> The first command being creating a role with SUPERUSER privileges which
> depends the hacked role being a SUPERUSER itself.
>
>
> So the solution is basic practices:
>
> 1) Don't expose the database anymore then necessary. It other words keep
> access to the instance as restricted as possible, e.g. behind firewall.
>

Besides deny-by-default firewalls, be strict with pg_hba.conf entries.


> 2) Don't use easy passwords


openssl rand -base64 24

WordList=3D($(egrep '^.{4,9}$' /usr/share/dict/words | shuf -n2
--random-source=3D/dev/urandom | tr -d [:punct:] | sort));
First=3D${WordList[0]^};
Second=3D${WordList[1]};
Number=3D`printf "%02d\n" $(shuf -i00-99 -n1)`;
echo ${First}.${Second}${Number}

--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--000000000000b41cc80631ce0eab
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Wed, Apr 2, 2025 at 11:31=E2=80=AFAM A=
drian Klaver &lt;<a href=3D"mailto:adrian.klaver@aklaver.com">adrian.klaver=
@aklaver.com</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_cont=
ainer"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;=
border-left:1px solid rgb(204,204,204);padding-left:1ex">On 4/2/25 08:18, B=
harani SV-forum wrote:<br>
&gt; Hello MVP&#39;s<br>
&gt; Good Morning<br>
&gt; Any industry best practise to overcome this specific malware &quot;pg_=
mem&quot;.<br>
&gt; <br>
&gt; url =3D <br>
&gt; <a href=3D"https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the=
-postgres-processes/" rel=3D"noreferrer" target=3D"_blank">https://www.aqua=
sec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/</a> &lt;<a =
href=3D"https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgre=
s-processes/" rel=3D"noreferrer" target=3D"_blank">https://www.aquasec.com/=
blog/pg_mem-a-malware-hidden-in-the-postgres-processes/</a>&gt;<br>
<br>
=C2=A0From above:<br>
<br>
&quot;The first stage is a simple brute force attack. We observe several <b=
r>
login attempts to the PostgreSQL database being refused until the brute <br=
>
force attack successfully guesses the honeypot=E2=80=99s username and passw=
ord <br>
(which were intentionally set to be easy to guess).&quot;<br>
<br>
After the threat actor successfully guess the user and password, the <br>
attack sequence commenced. The following set of SQL commands, were <br>
executed: ...<br>
&quot;<br>
<br>
The first command being creating a role with SUPERUSER privileges which <br=
>
depends the hacked role being a SUPERUSER itself.<br>
<br>
<br>
So the solution is basic practices:<br>
<br>
1) Don&#39;t expose the database anymore then necessary. It other words kee=
p <br>
access to the instance as restricted as possible, e.g. behind firewall.<br>=
</blockquote><div><br></div><div>Besides deny-by-default firewalls, be stri=
ct with pg_hba.conf entries.</div><div>=C2=A0</div><blockquote class=3D"gma=
il_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,2=
04,204);padding-left:1ex">2) Don&#39;t use easy passwords </blockquote><div=
><br></div><div>openssl rand -base64 24</div><div><br></div><div>WordList=
=3D($(egrep &#39;^.{4,9}$&#39; /usr/share/dict/words | shuf -n2 --random-so=
urce=3D/dev/urandom | tr -d [:punct:] | sort));<br>First=3D${WordList[0]^};=
<br>Second=3D${WordList[1]};<br>Number=3D`printf &quot;%02d\n&quot; $(shuf =
-i00-99 -n1)`;<br>echo ${First}.${Second}${Number}<br></div></div><div><br>=
</div><span class=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr"=
 class=3D"gmail_signature"><div dir=3D"ltr">Death to &lt;Redacted&gt;, and =
butter sauce.<div>Don&#39;t boil me, I&#39;m still alive.<br><div><div>&lt;=
Redacted&gt; lobster!</div></div></div></div></div></div>

--000000000000b41cc80631ce0eab--