PostgreSQL Threats and Attacks in the Wild
summary
Two honeypots are built and deployed: pghoney (low‑interaction, Go) and Sticky Elephant (medium‑interaction, Ruby), integrated with MHN & HPFeeds. Deployments on home, AWS and DigitalOcean capture mostly automated attacks: brute force from China/France/Turkey (about 95% of passwords match common lists, ~200 that don’t), a nine‑month Monero mining campaign using user‑defined function exploits (seval/sisson stages), and a one‑off Windows RAT upload from Brazil. Findings show effective telemetry but no observed manual logins; defenses: don’t expose Postgres, use strong passwords, disable UDFs.
AI-written summary · about
chapters (10)
- 0:00Start
- 5:00Notes / Shout outs
- 6:20Findings!
- 8:14Brute-force Attacks (cont.)
- 9:12Behavior on Login
- 10:18Software Installation
- 15:58Connecting the Dots
- 17:47Malware Storage
- 18:23Defense
- 19:41What's next?
related talks
32mPostgreSQL Security: Defending Against External Attacks
45mSecurity Attacks on PostgreSQL
34mActive Security Honeypot for MySQL and PostgreSQL protecting databases from ransomware attacks
30mHow secure is your database? Hacking Postgres with Hathi
26mLooking at 4 years of web honeypot attacks: tactics, ...
50mThe Anatomy of Cloud Attacks
35mSecuring PostgreSQL From External Attack
43mGame of Hacks: The Mother of All Honeypots