A picture got my PostgreSQL database to start mining Monero
The short story of this is:<p>- Gain access to the database itself<p>- And the Postgres database should be vulnerable to various remote code execution<p>- Once they're able to execute code remotely, they then download an image which has binary data tacked onto it<p>- They then parse out the executable part of the image using dd<p>- Then they're able to execute and mine away<p>While an interesting read the shortest takeaway is:<p>1. Don't leave your Postgres open to the public internet and<p>2. Ensure to upgrade when security releases come out.<p>If you're unsure if the version your on has security patches available or other reasons to upgrade consider checking out <a href="https://why-upgrade.depesz.com/" rel="nofollow">https://why-upgrade.depesz.com/</a><p>Edit: Looks like the user that gained access had ability to execute pl/c. Which has to run as superuser. You won't find things like pl/c, pl/python generally supported on most Postgres services like Heroku, RDS, Citus because of just this reason. So in this case database access with pl/c was enabled, suspect could have been done equally via other vectors (once database access was achieved).