January 2021 Summaries

A recently discovered vulnerability, CVE-2021-3156, identified in the widely-used Unix utility sudo, allows unprivileged users to escalate their privileges to root, posing a significant security risk across Linux and Unix systems. This vulnerability, which has been present for nearly a decade, affects all legacy sudo versions from 1.8.2 to 1.8.31p2 and stable versions from 1.9.0 to 1.9.5p1. Falco, an open-source runtime threat detection tool, can identify exploit attempts by leveraging its customizable rules to monitor for abnormal behavior, thus providing a method to detect and potentially prevent exploitation until systems can be patched. Additionally, Sysdig Secure extends Falco's capabilities by blocking threats, facilitating runtime policy management, and embedding security across the DevOps process, offering comprehensive protection against this and similar vulnerabilities.

In January 2021, the Sysdig Security Research team identified a crypto mining attack originating from a server hosting the popular RinBot Discord bot, which was suspected to be compromised and acting as a command and control server for the dk86 malware. This attack, leveraging the popularity of Discord—a platform with over 100 million active users in 2020—demonstrates the increasing trend of crypto miner attacks exploiting third-party integrations within popular applications. Discord bots, hosted by third parties, pose potential security risks as they may not adhere to stringent data protection standards, which could lead to compromised user data if the bot servers are hacked. The dk86 malware was discovered through a honeypot setup and used a backdoor to install the xmra64 crypto miner, engaging in unauthorized cryptocurrency mining activities. This incident underscores the importance of using advanced security tools like the Sysdig Secure DevOps Platform, which provides runtime threat detection and monitoring to help system administrators protect their infrastructure from such attacks. The article emphasizes the need for heightened vigilance in managing third-party services and integrating comprehensive security practices to safeguard against emerging cyber threats in cloud-native environments.

Sysdig's January 2021 update highlights various enhancements and new features aimed at improving container security and monitoring for its users. Key developments include the release of Sysdig's fourth annual container security and usage report, which provides insights into security risks and container utilization from nearly a billion unique containers. The report emphasizes the importance of runtime security alongside the practice of shifting left. Notable product updates include improvements to Sysdig Secure Event Forwarding, an enhanced Sysdig Monitor alert interface, faster detection of Prometheus no-data conditions, and efficiency improvements in CloudWatch integrations. Additionally, the release of Sysdig Agent 10.9.0 and updates to related tools and SDKs are discussed, along with new resources for vulnerability management via Terraform and enhanced documentation and support for Kubernetes integrations. The update underscores Sysdig's commitment to delivering automatic, free improvements to its customer base, while also offering webinars and case studies as educational resources.

The blog post delves into a comparative analysis of two Host Intrusion Detection System (HIDS) tools, Falco and AuditD, highlighting their functionalities, installation processes, rule creation, and event output. Falco, developed by the Cloud Native Computing Foundation (CNCF), is tailored for runtime threat detection in cloud-native environments such as containers and Kubernetes, offering a rich set of pre-configured rules and supports more than 150 filters. AuditD, on the other hand, is a native Linux feature that monitors system activities for incident investigation, with around 40 filters mainly focused on host-level detections. Both tools rely on system calls (syscalls) for detecting intrusions, but they differ significantly in rule creation and event output, with Falco offering more customizable and granular rule definitions and easier event forwarding through tools like Falco Sidekick. While both tools demonstrate decent resource consumption under stress tests, Falco appears more versatile, especially in cloud-native contexts, whereas AuditD offers more detailed object information but requires additional decoding for certain data fields. The choice between these tools should consider team expertise and long-term security strategy.

The fourth annual Sysdig Container Security and Usage Report highlights key trends in container security, emphasizing the importance of "shifting left" in the development lifecycle, with 74% of organizations scanning container images during the build process to address vulnerabilities early. Despite this proactive approach, the report reveals that 58% of containers still run as root, indicating a need for improved runtime scanning to detect configuration errors. The adoption of open-source solutions like Falco has surged by 300%, reflecting a growing reliance on tools that enable runtime policy definition and security alerts. Additionally, the report notes significant growth in container runtimes such as containerd and CRI-O, alongside a decline in Docker's usage, and highlights the increasing popularity of cloud-hosted registry solutions. As Prometheus continues to dominate in cloud-native application metrics, the report underscores the necessity for organizations to integrate robust security measures within DevOps and invest in Kubernetes-native tools for effective operations at scale.