Kubernetes clusters being hijacked to mine cryptocurrencies
blog.binaryedge.io
Kubernetes clusters being hijacked to mine cryptocurrencies
1–10 of 67 posts
Re: Kubernetes clusters being hijacked to mine cryptocurrencies
#2JSON file is still available (http://192.99.142.232:8220/222.json)
Re: Kubernetes clusters being hijacked to mine cryptocurrencies
#3JSON file is still available ( http://192.99.142.232:8220/222.json )
> "algo": "cryptonight",
Nice, Monero mining
Cryptocurrencies makes the bug bounty market A LOT more efficient than companies, legislation or HackerOne ever could.
Re: Kubernetes clusters being hijacked to mine cryptocurrencies
#4This is one of the side-effects of products having enormous hype in this industry.
Far too many people are adopting Docker/Kubernetes as they have been the hot new product for the last couple of years, often regardless of whether they are actually the best or most appropriate tool for the job.
A lot of the people who get sucked into the hype are often inexperienced programmers, devops or admin types who are in positions of power or influence in companies that they probably shouldn't be, IMHO.
As a result, they don't have the Linux or networking experience to be able to know when they are deploying these complex products securely or not, and they are putting their employers businesses at risk.
Re: Kubernetes clusters being hijacked to mine cryptocurrencies
#5This is one of the side-effects of products having enormous hype in this industry. Far too many people are adopting Docker/Kubernetes as they have been the hot new product for the last couple of years, often regardless of whether they are actually the best or most appropriate tool for the job. A lot of the people who get sucked into the hype are often inexperienced programmers, devops or admin types who are in positi…
Why do you assume that other platforms are not at similar risk?
VMs also have zero-days that have been exploited for cryptomining.
Re: Kubernetes clusters being hijacked to mine cryptocurrencies
#6This is one of the side-effects of products having enormous hype in this industry. Far too many people are adopting Docker/Kubernetes as they have been the hot new product for the last couple of years, often regardless of whether they are actually the best or most appropriate tool for the job. A lot of the people who get sucked into the hype are often inexperienced programmers, devops or admin types who are in positi…
Why do you assume that other platforms are not at similar risk? VMs also have zero-days that have been exploited for cryptomining.
CEO of BinaryEdge here, ur 100% right. If I show you the queue of posts we have you'd see similar posts to this one just with different technologies that we have seen being infected or misused(etcd, docker, and about 10 or 20 more types of DB's).
Re: Kubernetes clusters being hijacked to mine cryptocurrencies
#7These guys are amazing. They have a lot of data and an excellent app with a lot of potential!
Re: Kubernetes clusters being hijacked to mine cryptocurrencies
#8Ugh. I mean, I recently got in an argument if anything but a hard firewall could or should be exposed to a WAN interface on the internet and we kinda agreed to not agree for now.
But, popular services, on default ports, with default APIs enabled, without hard authentication on a WAN interface? That should be a paddling. That doesn't fly. Or, well it does, except not for the guy paying the power.
Re: Kubernetes clusters being hijacked to mine cryptocurrencies
#9This is one of the side-effects of products having enormous hype in this industry. Far too many people are adopting Docker/Kubernetes as they have been the hot new product for the last couple of years, often regardless of whether they are actually the best or most appropriate tool for the job. A lot of the people who get sucked into the hype are often inexperienced programmers, devops or admin types who are in positi…
Why do you assume that other platforms are not at similar risk? VMs also have zero-days that have been exploited for cryptomining.
I don't assume that at all. I mentioned Docker explicitly
and people are pulling Docker containers from untrusted sources with malware pre-installed, because they lack the experience that would tell them that pulling untrusted Docker containers and running them is a bad idea.
https://threatpost.com/malicious-docker-containers-earn-cryp...
From the article itself, although they mention the CVE at the top, the real point they are making is that people are deploying the products with poor defaults:
"as is typical with our findings, lots of companies are exposing their Kubernetes API with no authentication; inside the Kubernetes cluster"
Not to mention a bunch of NoSQL type db's you can easily search on Shodan if you wanted to have some fun.
So yes - the problem here is experience, or lack thereof, and not Kubernetes itself. The CVE can be patched. You can't patch inexperience - except with experience I suppose.
All I am saying is that there a lot of people who are downloading and deploying these products because of hype, who are unable or unwilling to secure them.
Re: Kubernetes clusters being hijacked to mine cryptocurrencies
#10Ugh. I mean, I recently got in an argument if anything but a hard firewall could or should be exposed to a WAN interface on the internet and we kinda agreed to not agree for now. But, popular services, on default ports, with default APIs enabled, without hard authentication on a WAN interface? That should be a paddling. That doesn't fly. Or, well it does, except not for the guy paying the power.
To be fair, kubernetes itself and most distributions are quite secure by default. So with kubernetes it's not the same as it was NoSQL databases that didn't have authentication that were bound to the internet.
I'm not familiar with enough distributions to know if there is a popular distribution that totally disabled authentication by default, but in my companies distribution, kubeadm clusters, and I suspect all managed clusters (GKE/EKS/AKS/etc), the vector outlined in the article would only work if an admin specifically disabled the authentication.
In gravity (my companies distribution), we even disable anonymous-auth, so someone would have to do real work to allow API access to the internet.