Security Attacks on PostgreSQL
summary
Covers concrete attack techniques and defenses: unauthenticated DoS by spamming connections, authenticated DoS by exhausting work_mem or filling disk with temp files and mitigation with connection pools and temp_file_limit; passive and active MITM that capture cleartext or break MD5 unless using TLS with sslmode=verify-full and SCRAM-SHA-256; privilege escalation by creating triggers, malicious functions or operators, abusing roles like pg_execute_server_program or pg_write_server_files, and view/definer pitfalls fixed with security_barrier and forcing a safe search_path.
AI-written summary · about
chapters (9)
- 0:00Introduction and setup
- 1:50Scope and attack types
- 2:53Denial of service attacks
- 8:21Authentication attacks
- 17:45Privilege escalation attacks
- 22:46Security barrier views
- 29:23Security definer functions
- 36:15Key security recommendations
- 37:42Q&A session
related talks
32mPostgreSQL Security: Defending Against External Attacks
35mSecuring PostgreSQL From External Attack
07mAll about Postgres security
50mSecuring PostgreSQL From External Attack
22mPostgreSQL Threats and Attacks in the Wild
50mSecuring PostgreSQL
28mFrom Dev to Prod: Securing Postgres the Right Way
32mEnhancing Security in PostgreSQL