Is it safe to pg_dump and pg_restore a new postgres database that has malware?

Question

I'm pretty sure there is a crypto bot eating up my CPU through a postgres script. I would like to create an entirely new VM, and move my database with it using pg_dump and pg_restore. I already checked my postgres for new users, tables, databases; couldn't find anything odd there which could comprise me if I move my data. I'm a little worried however because the bot is some how getting access to my postgres, and nothing else on my VM.

Thank you for the help.

EDIT:

I managed to move my db with pg-dump and pg-dumpall. It's been a few days since I destroyed my last VM and made a new db with better security. It looks like I'm in the clear at least for this same attack.

Answer 1

Probably. But if you just recreate the same vulnerable setup, you will just get infected again from scratch. They probably got in by guessing the weak password on a super-user account. So set up all new passwords on the new system and make then strong ones. (pg_dump will not carry over your old passwords anyway, but pg_dumpall will.). It would also be good to lock down your new pg_hba.conf so that superusers can only connect locally, or at least only from white-listed IP addresses.

They probably created a new function which gives them shell access, and pg_dump will carry over that function definition. But if they can't log in in the first place they can't use it anymore; and it probably relies on a dropped binary .so file, which pg_dump will not carry over.

Answer 2

I don't know what kind of crypto bot you're talking about but if you're going to start up with a new VM, you can safely use pg_dump plain text output (default Fp format) and restore it by using psql. If you're experiencing an issue infecting data structure of your PG data directory, I strictly recommend plain text backup since it's strictly SQL sentences. If you need to move users/roles you can also back them up with pg_dumpall.