PostgreSQL containers allow you to take control of the system.
The Microsoft Defender for Cloud team reports that Kinsing malware is actively infecting Kubernetes clusters using vulnerabilities in container images and misconfigured open PostgreSQL containers.
Kinsing is Linux malware that targets container environments for cryptocurrency mining using compromised server hardware resources.
According to experts, hackers use 2 methods to gain initial access to a Linux server - using a vulnerability in container images and misconfigured PostgreSQL database servers.
Vulnerabilities in container images
When exploiting image vulnerabilities, attackers look for RCE vulnerabilities that allow them to deliver their payloads. Cybercriminals are trying to exploit vulnerabilities in the following applications for initial access:
Attack on PostgreSQL
The second attack vector is directed at misconfigured PostgreSQL servers. One of the most common misconfigurations that attackers use is the "trusted authentication" setting, which tells PostgreSQL to assume that "anyone who can connect to the server has the right to access the database."
Another mistake is to assign too wide a range of IP addresses, including any IP address that an attacker can use to access the server. To troubleshoot PostgreSQL configuration issues, visit the project's security advisory page and apply the suggested steps.