0

User postgres is running a process that take all CPUs at 100% usage in a centos machine, the postgresql service is not running so it cannot be a query.

When I try to stop the process it restarts itself. Then name of the process is somewhat strange.

Information of the running process

6
  • 2
    I dont see how it is postgres from your pic. probably you are mining coins for smbd
    – Vao Tsun
    May 3, 2018 at 7:22
  • btw taking db offline now is a precious advise. If I were a miner, I would monitor exactly SO to see if I'm caught or not and would destroy my code asap - first to make it harder to protect next time and second I would be extremely ashamed to write the code that uses 100% without even a minimal effort to make it look less suspicious...
    – Vao Tsun
    May 3, 2018 at 7:36
  • 2
    You got hacked. May 3, 2018 at 7:52
  • @VaoTsun just out of curiosity: how can you tell it is related to coin mining? Just in case I see something similar in the future. Thanks! :-)
    – Jim Jones
    May 3, 2018 at 7:55
  • 1
    @JimJones just from my ignorance :D I just don't see any other point to spin self written process on somebodies postgres using supposedly all four cores at max pace. I mean - how else could you use other machine resources? To brute force password? To calculate Pi? As I said - I thought on coins just because my knowledge and fantasy are very limited
    – Vao Tsun
    May 3, 2018 at 7:59

2 Answers 2

7

Congratulations!

By exposing a database with a weak superuser password to the internet you invited somebody to break in and use your CPU for their own purposes, probably mining crypto-currencies.

Take the machine from the internet, wipe it clean and re-install the operating system.

4
  • Wouldn't it make more since to debug the issue, identify the weakness and not repeat it in the future?
    – puk
    Feb 10, 2021 at 13:59
  • Well, the weakness is the weak superuser password. Fix that, and you are good. Feb 10, 2021 at 14:49
  • I just reformatted but for future readers, would a simple ALTER ROLE postgres with password ***** solve it? Because it didn't work for me (ie. the scripts kept popping up)
    – puk
    Feb 11, 2021 at 1:25
  • 4
    @puk Once somebody has taken control of your machine it is game over. You shouldn't trust yourself to be able to find and remove all the code and back doors. Wipe the machine and reinstall the operating system, and choose good passwords on that new system. Feb 11, 2021 at 1:36
-1

I had the same issue on my VPS. I considered to reinstall OS or clone VPS, but have alot of issues on that solution. So, i choose another way: I did:

  • backup all data with "pg_dumpall"
  • backup pqsql configuration(pg_hba.conf,postgresql.conf,...)
  • Uninstall "everything" of pgsql
  • reinstall pgsql
  • restore pgsql data
  • Done
1
  • 1
    And then the attackers hacked back into your system using the same passwords that you just backed up and restored.... Oct 22, 2022 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.