How to catch a cryptominer on your Kubernetes infra

#1

Post by webb » Mon, Nov 11, 2019, 8:45 PM UTC

How to catch a cryptominer on your Kubernetes infra
blog.kubecost.com

Re: How to catch a cryptominer on your Kubernetes infra

#2

Post by cyphar » Tue, Nov 12, 2019, 1:55 AM UTC

I think it's a bit disappointing how unsophisticated these cryptominer attackers are. If you have the ability to spawn arbitrary Docker containers, you can get root privileges on the host -- which would make tools like this one (which as far as I can tell only measures container network traffic) useless.

The real solution is to stop exposing access to Docker (or Kubernetes without any RBAC rules) to the open internet.

Re: How to catch a cryptominer on your Kubernetes infra

#3

Post by webb » Tue, Nov 12, 2019, 5:00 AM UTC

cyphar wrote: post #2

I think it's a bit disappointing how unsophisticated these cryptominer attackers are. If you have the ability to spawn arbitrary Docker containers, you can get root privileges on the host -- which would make tools like this one (which as far as I can tell only measures container network traffic) useless. The real solution is to stop exposing access to Docker (or Kubernetes without any RBAC rules) to the open internet…

I agree that appropriate configuration/policy management is part of the solution for preventing these attacks on Kubernetes, but our view is that monitoring also plays an important role.

Re: How to catch a cryptominer on your Kubernetes infra

#4

Post by cyphar » Tue, Nov 12, 2019, 5:16 AM UTC

webb wrote: post #3

cyphar wrote: post #2

I think it's a bit disappointing how unsophisticated these cryptominer attackers are. If you have the ability to spawn arbitrary Docker containers, you can get root privileges on the host -- which would make tools like this one (which as far as I can tell only measures container network traffic) useless. The real solution is to stop exposing access to Docker (or Kubernetes without any RBAC rules) to the open internet…

I agree that appropriate configuration/policy management is part of the solution for preventing these attacks on Kubernetes, but our view is that monitoring also plays an important role.

I should've said "limited in usefulness for detecting moderately-clever attackers" rather than just flat-out "useless". Monitoring is obviously a useful tool regardless of whether it will always help you detect attackers in your network. You could use nf_conntrack on the host as well but that could also be bypassed by a root process on the host.