4 ms·

Is that yet another way to place a backdoor in a infected system?

• mslot 3y ago
  Fwiw, pg_cron jobs run as the database user that scheduled the job and the jobs table is not writable, nor can you see jobs created by other users unless you are the admin. There is not much you can do with it that you could not via external infrastructure that connects to the database, except you don't need to set up external infrastructure that connects to the database. (and simpler systems are generally more secure)
• Wicher 3y ago
  If you mean that you might be able to use it to disassociate the moment of gaining entry and the moment of exploitation of the system, then yes. Indeed the DB contents may have been synced elsewhere in the meantime, meaning your exploit has spread before triggering, perhaps even to places you'd otherwise not be able to exploit as they are airgapped. You can use it as a persistence mechanism.