Kubernetes clusters being hijacked to mine cryptocurrencies • Hacker News Board

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#51

Post by speedplane » Fri, Dec 07, 2018, 10:20 AM UTC

ram_rar wrote: post #34

nineteen999 wrote: post #4

This is one of the side-effects of products having enormous hype in this industry. Far too many people are adopting Docker/Kubernetes as they have been the hot new product for the last couple of years, often regardless of whether they are actually the best or most appropriate tool for the job. A lot of the people who get sucked into the hype are often inexperienced programmers, devops or admin types who are in positi…

>A lot of the people who get sucked into the hype are often inexperienced programmers, devops or admin types who are in positions of power or influence in companies that they probably shouldn't be, IMHO. I cannot agree more. Many times, I feel you da easily do away with ansible and terraform to setup VMs / docker. you dont quite need k8s. Just cuz K8s are cool.. people feel the need to use it.

I dunno, any cluster with more than 5 servers is a pain to deal with without something like kubernetes.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#52

Post by bonesss » Fri, Dec 07, 2018, 10:21 AM UTC

justicezyx wrote: post #21

outworlder wrote: post #19

Earlier quoted context omitted.

The "hype" part is pretty subjective and may have warranted down votes. It's not hype if it solves a lot of organizations pain points.

Let's be honest, pretty much every new tech got hyped initially. K8s is no doubt hype, otherwise it won't enjoy the explosive growth. That's not subjective, at least IMHO

It's the delineation of 'hype' and 'excitment' that is tricky.

If magic CPUs that were 10x better showed up tomorrow we'd all be justified in being very excited. But running with hype around the next Zune? ... that's not excitement backed with meaning.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#53

Post by raverbashing » Fri, Dec 07, 2018, 10:39 AM UTC

TheDong wrote: post #38

raverbashing wrote: post #30

Earlier quoted context omitted.

To be fair, you're playing with fire if you rely on product security to be perfect. For every SSHd out there there are multiple SystemD or worse security products.

I think you meant "OpenSSH" not SSHd, and "systemd" is always spelled lowercase. The 'd' doesn't stand for something and is never capitalized. "sshd" is an ambiguous term as there are many ssh daemons, from the libssh server to dropbear to OpenSSH, and OpenSSH is likely the one that you use and the most secure one. systemd has had a few security incidents, but very few of them are actually a big deal. People have ove…

Yes, I meant OpenSSH

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#54

Post by cbzbc » Fri, Dec 07, 2018, 11:07 AM UTC

nineteen999 wrote: post #9

cobookman wrote: post #5

Earlier quoted context omitted.

Why do you assume that other platforms are not at similar risk? VMs also have zero-days that have been exploited for cryptomining.

I don't assume that at all. I mentioned Docker explicitly and people are pulling Docker containers from untrusted sources with malware pre-installed, because they lack the experience that would tell them that pulling untrusted Docker containers and running them is a bad idea. https://threatpost.com/malicious-docker-containers-earn-cryp... From the article itself, although they mention the CVE at the top, the real poi…

Leaving aside NoSQL db's - there's also a ton of normal SQL databases wide open, I don't think hype is necessarily the issue there.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#55

Post by clarry » Fri, Dec 07, 2018, 11:12 AM UTC

TheDong wrote: post #36

ryacko wrote: post #23

Earlier quoted context omitted.

You will have to patch a critical vulnerability every year on production systems, no matter what language or who develops it. Secure defaults are irrevalent if you pay attention to the news.

> You will have to patch a critical vulnerability every year on production systems, no matter what language or who develops it. Interesting. I've got a few openbsd boxes that do not have vulnerabilities that impact them nearly so often. It turns out that if you practice defence in depth, the majority of security vulnerabilities in the news have no impact on you. For example, on my openbsd boxes I have only a single u…

Yep. The bloated, overhyped and chruny mainstream crap needs updating all the time (and it kinda tends to break too). Build on that, and hope the updates get done before someone fires and exploit. That's defense in "pray and hope we're faster."

I'm not so concerned about my OpenBSD box with >800 days of uptime, which runs very limited and carefully selected services.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#56

Post by gammateam » Fri, Dec 07, 2018, 11:54 AM UTC

blazespin wrote: post #32

voltagex_ wrote: post #22

At least cryptocurrency has removed most of the creativity from script kiddies - there's so many more interesting things you could do than just mine coins.

Yeah, exactly. It’s almost like a bounty for find a vuln. It seems to be a mostly harmless attack that doesn’t cause global internet grief like a DDoS or something.

WannaCry’s very public global ransom brought attention to a Monero mining botnet which was using the same exploit for weeks beforehand, it was making $40,000 per day. It made much more than WannaCry and its operators are still unknown and would have been able to cash out

Script kiddies are just annoying and their actions resulted in the patch killing that silent mining botnet as well.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#57

Post by fixermark » Fri, Dec 07, 2018, 4:07 PM UTC

kevin_nisbet wrote: post #10

tetha wrote: post #8

Ugh. I mean, I recently got in an argument if anything but a hard firewall could or should be exposed to a WAN interface on the internet and we kinda agreed to not agree for now. But, popular services, on default ports, with default APIs enabled, without hard authentication on a WAN interface? That should be a paddling. That doesn't fly. Or, well it does, except not for the guy paying the power.

To be fair, kubernetes itself and most distributions are quite secure by default. So with kubernetes it's not the same as it was NoSQL databases that didn't have authentication that were bound to the internet. I'm not familiar with enough distributions to know if there is a popular distribution that totally disabled authentication by default, but in my companies distribution, kubeadm clusters, and I suspect all manag…

I strongly suspect we're going to encounter quite a few instances of admins (or individual developers, depending on how poorly-secured a given corporate network is) installing Kubernetes to test and play with, disabling auth for simplicity of testing, and then completely forgetting they have it installed or failing to properly shut it down and uninstall it.

They may consider that fine for security (the equivalent of having an insecure MySQL install on a machine with no tables of value in it), but might perhaps forget that even an empty Kubernetes install still lets attackers dictate what your CPU is doing.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#58

Post by nineteen999 » Fri, Dec 07, 2018, 4:34 PM UTC

ownagefool wrote: post #50

ram_rar wrote: post #34

Earlier quoted context omitted.

>A lot of the people who get sucked into the hype are often inexperienced programmers, devops or admin types who are in positions of power or influence in companies that they probably shouldn't be, IMHO. I cannot agree more. Many times, I feel you da easily do away with ansible and terraform to setup VMs / docker. you dont quite need k8s. Just cuz K8s are cool.. people feel the need to use it.

It's more complicated that that. Whilst some people are probably jumping on kubernetes for the hype, there's a lot of things it makes really easy, especially for less experience teams. For example: - You want to spin up ephemeral environments to test PRs end2end. Sure, create a namespace, deploy your charts and run your tests. You want to do that with ansible, sure you can, but it's harder. - You org is running apps…

Can I ask because I'm genuinely interested - what on earth do you do for third-party applications (for eg. closed source) that have to be integrated into your environment that don't come pre-packaged in a convenient container?

Do you containerize these yourselves, whether or not the vendor says that will support that? Or does it get pushed to some other team that manages whole VM's/AWS instances that are not container hosts.

Or is this a scenario that just doesn't happen in your environment?

Genuinely curious.

Also:

> using a managed k8s service will allow you some easy wins so you can actually think about those other problems, and those solutions will work on all platforms you can run k8s on

None of which matters one jot, if one cannot properly manage ingress/egress filtering on one's API endpoints, or a reasonable level of password/credential security. One will be used for cryptomining or worse, as per the fine article.

In that instance, one needs to go back and get some basic UNIX/Linux/network and security training before one starts playing with complicated software on publicly connected clouds. Or hire some people who actually know what they are doing with respect to that.

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#59

Post by barrow-rider » Fri, Dec 07, 2018, 4:42 PM UTC

TheDong wrote: post #38

raverbashing wrote: post #30

Earlier quoted context omitted.

To be fair, you're playing with fire if you rely on product security to be perfect. For every SSHd out there there are multiple SystemD or worse security products.

I think you meant "OpenSSH" not SSHd, and "systemd" is always spelled lowercase. The 'd' doesn't stand for something and is never capitalized. "sshd" is an ambiguous term as there are many ssh daemons, from the libssh server to dropbear to OpenSSH, and OpenSSH is likely the one that you use and the most secure one. systemd has had a few security incidents, but very few of them are actually a big deal. People have ove…

> "systemd" is always spelled lowercase. The 'd' doesn't stand for something and is never capitalized.

I thought the 'd' was a holdover from "daemon", as in initd or setsid, as a general name for a background process. systemd is a little more than just a background process but it's sort of the same idea.

From the wiki page: "In a strictly technical sense, a Unix-like system process is a daemon when its parent process terminates and the daemon is assigned the init process (process number 1) as its parent process and has no controlling terminal. However, more generally a daemon may be any background process, whether a child of the init process or not. "

https://en.wikipedia.org/wiki/Daemon_(computing)

Re: Kubernetes clusters being hijacked to mine cryptocurrencies

#60

Post by TheDong » Fri, Dec 07, 2018, 6:33 PM UTC

barrow-rider wrote: post #59

TheDong wrote: post #38

Earlier quoted context omitted.

I think you meant "OpenSSH" not SSHd, and "systemd" is always spelled lowercase. The 'd' doesn't stand for something and is never capitalized. "sshd" is an ambiguous term as there are many ssh daemons, from the libssh server to dropbear to OpenSSH, and OpenSSH is likely the one that you use and the most secure one. systemd has had a few security incidents, but very few of them are actually a big deal. People have ove…

> "systemd" is always spelled lowercase. The 'd' doesn't stand for something and is never capitalized. I thought the 'd' was a holdover from "daemon", as in initd or setsid, as a general name for a background process. systemd is a little more than just a background process but it's sort of the same idea. From the wiki page: "In a strictly technical sense, a Unix-like system process is a daemon when its parent process…

From their documentation [0]:

> Yes, it is written systemd, not system D or System D, or even SystemD .... [You may also, optionally] call it (but never spell it!) System Five Hundred since D is the roman numeral for 500 (this also clarifies the relation to System V, right?).

The 'd' is a pun on both daemons typically being postfixed with 'd' and on the roman numeral for '500'. It does not directly stand for either though officially.

[0]: https://www.freedesktop.org/wiki/Software/systemd/