{"id":38677,"date":"2020-12-13T07:50:03","date_gmt":"2020-12-13T07:50:03","guid":{"rendered":"http:\/\/1de7dcb9-23bf-4a62-a221-0536299a933c"},"modified":"2020-12-13T07:50:03","modified_gmt":"2020-12-13T07:50:03","slug":"pgminer-botnet-attacks-weakly-secured-postgresql-databases","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/pgminer-botnet-attacks-weakly-secured-postgresql-databases\/","title":{"rendered":"PgMiner botnet attacks weakly secured PostgreSQL databases"},"content":{"rendered":"
\"PostgreSQL\"<\/span>
<\/span><\/figcaption><\/figure>\n

Security researchers have discovered this week a botnet operation that targets PostgreSQL databases to install a cryptocurrency miner.<\/p>\n

Codenamed by researchers as PgMiner<\/strong>, the botnet is just the latest in a long list of recent cybercrime operations that target web-tech for monetary profits.<\/p>\n

According to researchers at Palo Alto Networks’ Unit 42, the botnet operates by performing brute-force attacks against internet-accessible PostgreSQL databases.<\/p>\n

The attacks follow a simple pattern.<\/p>\n

The botnet randomly picks a public network range (e.g., 18.xxx.xxx.xxx) and then iterates through all IP addresses part of that range, searching for systems that have the PostgreSQL port (port 5432) exposed online.<\/p>\n

If PgMiner finds an active PostgreSQL system, the botnet moves from the scanning phase to its brute-force phase, where it shuffles through a long list of passwords in an attempt to guess the credentials for “postgres,” the default PostgreSQL account.<\/p>\n

If PostgreSQL database owners have forgotten to disable this user or have forgotten to change its passwords, the hackers access the database and use the PostgreSQL COPY from PROGRAM<\/a> feature to escalate their access from the database app to the underlying server and take over the entire OS.<\/p>\n

<\/section>\n

Once they have a more solid hold on the infected system, the PgMiner crew deploys a coin-mining application and attempt to mine as much Monero cryptocurrency before they get detected.<\/p>\n

According to Unit 42, at the time of their report, the botnet only had the ability to deploy miners on Linux MIPS, ARM, and x64 platforms.<\/p>\n

Other notable features of the PgMiner botnet include the fact that its operators have been controlling infected bots via a command and control (C2) server hosted on the Tor network and that the botnet’s codebase appears to resemble the SystemdMiner botnet<\/a>.<\/p>\n

\"pgminer.png\"<\/span>