A New Malicious Software PG_MEM Aims at PostgreSQL Databases for Cryptocurrency Mining
Cyber experts have discovered a new malicious software named PG_MEM that is crafted to mine digital currency by forcefully cracking into PostgreSQL database instances.
“Guessing database credentials repeatedly in Postgres constitutes brute-force attacks, exploiting feeble passcodes,” mentioned Aqua cybersecurity analyst Assaf Morag in a detailed report.
“Once they gain entry, attackers can utilize the COPY … FROM PROGRAM SQL command to carry out random shell commands on the host, enabling them to engage in malevolent actions like data pilfering or installing malware.”
The chain of attack observed by the cloud protection company involves targeting improperly configured PostgreSQL databases to establish an administrator role in Postgres and exploiting a feature called PROGRAM to execute shell commands.
Furthermore, after a successful brute-force attack, the criminal executes preliminary reconnaissance and issues commands to remove the superuser privileges from the “postgres” user, thereby limiting access privileges of other malicious actors who could breach through the same technique.
The shell commands are responsible for downloading two malware portions from a distant server (“128.199.77[.]96”), specifically PG_MEM and PG_CORE, which are capable of terminating rival processes (e.g., Kinsing), establishing continuous operation on the host, and finally deploying the Monero digital currency miner.
This is achieved by utilizing a PostgreSQL command known as COPY, which permits the transfer of data between a file and a database table. It particularly exploits a setting named PROGRAM which enables the server to trigger the given command and write the program execution results to the table.
“While [digital currency mining] remains the major fallout, presently the attacker can also execute commands, view data, and take control of the server,” commented Morag.
“This campaign is capitalizing on internet-facing Postgres databases with feeble passwords. Many organizations link their databases to the internet, and a weak password results from misconfiguration and lack of proper identity checks.”
About Author
