On Debian 8.5, I'm finding weird processes and files in
file "cool" is owned by root, group=postgres<br> file "Injection.sh", "zeroteam.so", "zteam"
Why do those file exist? How can I figure out what they are doing?
I found something. So it looks like it is malware, which was downloaded by the postgres user, I can see the entries in the postgresql-log where it downloads the various files from an unknown ip.
How were they able to do this? I guess it has something to do with the default public schema. Is this correct?
I restarted the database with an updated config to prevent all access to the database from outside. Not sure if that's enough or whether I'll have to do a clean rebuild of the system.
Any additional information is appreciated.