On Debian 8.5, I'm finding weird processes and files in /tmp:

file "cool" is owned by root, group=postgres<br>
file "Injection.sh", "zeroteam.so", "zteam"

Why do those file exist? How can I figure out what they are doing?


I found something. So it looks like it is malware, which was downloaded by the postgres user, I can see the entries in the postgresql-log where it downloads the various files from an unknown ip.

How were they able to do this? I guess it has something to do with the default public schema. Is this correct?

I restarted the database with an updated config to prevent all access to the database from outside. Not sure if that's enough or whether I'll have to do a clean rebuild of the system.

Any additional information is appreciated.

  • 2
    You should backup all your data and reinstall the whole system. – Ortomala Lokni Dec 2 '16 at 17:04
  • Could you please elaborate? What are the risks? There was only a breach of a user (postgres) without root access. Of course the safest way is to reinstall, but I'd like to learn why. – Rhodarus Dec 5 '16 at 15:13
  • 3
    file "cool" is owned by root is a serious sign that your system is/was owned. Here is a full answer : security.stackexchange.com/questions/39231/… – Ortomala Lokni Dec 5 '16 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.