January 2022 Summaries

Sysdig's January 2022 update highlights several new features and improvements aimed at enhancing cloud security and compliance. Key developments include the introduction of Rapid Response for swift investigation and analysis of security events, Infrastructure-as-Code (IaC) Security integration into Git pipelines for compliance checks, and new scanning policies and rule bundles to enhance vulnerability management. The update also announces the welcoming of Gerald Combs, Wireshark's creator, to extend Sysdig's open-source project for cloud security. Furthermore, it introduces an updated Data Sources page for better cloud account visibility, and a unified compliance reporting interface for improved audit capabilities. Sysdig Secure now supports various integrations with platforms like GitHub, Bitbucket, GitLab, and Azure DevOps, and has enhanced its compliance standards to include NIST, FedRAMP, HITRUST, GDPR, HIPAA, and others. The company continues to focus on providing comprehensive and intuitive tools for cloud and container security, as evidenced by the updates to its Sysdig Agent, CLI, Python SDK, and other tools.

CVE-2021-4034, also known as "Pwnkit," is a local privilege escalation vulnerability discovered in the 'pkexec' program, part of Polkit, which has been present since its release in 2009. This flaw, which scores a high 7.8 on the CVSSv3 scale, allows attackers to execute arbitrary code with superuser privileges by exploiting a memory corruption issue when no arguments are passed to 'pkexec'. The vulnerability is not remotely exploitable but can be used by attackers with a user shell to gain root access. Temporary mitigation can be achieved by removing SUID permissions, although this may disrupt normal operations dependent on 'pkexec'. Users are advised to apply security patches from their Linux distributions. Detection tools like Falco can identify attempts to exploit this vulnerability by monitoring for unusual use of 'pkexec' and specific environment variable manipulations. OpenBSD is notably not affected due to existing mitigations. The discovery underscores the potential for long-standing software to harbor undiscovered vulnerabilities.

The 2022 Sysdig Cloud-Native Security and Usage Report provides an in-depth analysis of how organizations are managing and securing cloud environments, focusing on trends in cloud security, container vulnerabilities, and Kubernetes capacity planning. The report highlights that a significant percentage of container images have patchable vulnerabilities, often of high or critical severity, with many organizations facing configuration errors such as exposed S3 buckets and containers running with root privileges. Additionally, the report underscores the challenges of Kubernetes capacity management, noting that many containers lack defined limits, leading to inefficiencies and potential performance issues. The increasing adoption of Prometheus metrics reflects a trend toward standardizing cloud-native architectures. As cloud technologies continue to evolve, the report stresses the importance of implementing security measures during the build process and adhering to best practices, such as managing access based on data sensitivity and monitoring Kubernetes resources closely.

A recently disclosed Linux Kernel vulnerability, identified as CVE-2022-0185, poses a high-severity threat due to a heap overflow issue in the Filesystem Context system, which can allow attackers to execute arbitrary code, cause system crashes, and escape container environments to gain control over the host operating system. This vulnerability, which was introduced in version 5.1-rc1 of the Linux Kernel, can be exploited without the CAP_SYS_ADMIN capability, making it relatively easy for local attackers to leverage. A patch has been released to fix the issue, and Linux users are strongly advised to update their systems with the latest Kernel version. If patching is not feasible, disabling unprivileged user namespaces provides an alternative mitigation strategy, though it may affect container operations. Tools like Sysdig Secure can assist in identifying unpatched systems to prevent exploitation. Researchers Jamie Hill-Daniel and William Liu are credited with the discovery and responsible disclosure of this vulnerability, and while no public exploits have been released, the potential for misuse underscores the importance of maintaining updated security measures.

Sysdig Secure has introduced a Rapid Response feature to enhance endpoint detection and response (EDR) capabilities specifically for containers and Kubernetes environments, addressing the challenges posed by existing host-centric EDR tools. Traditional EDR solutions struggle with container visibility and Kubernetes integration, leaving security teams with incomplete data and prolonged mean time to respond (MTTR) to security incidents. Rapid Response allows direct shell access to containers from event alerts, enabling immediate investigation and remediation without additional learning or steps, thereby reducing MTTR significantly. This feature facilitates seamless collaboration among security, operations, and development teams, allowing them to use familiar tools and processes for effective threat management. With Sysdig Secure, organizations can perform swift threat triage and mitigation, minimizing risk exposure and the impact of attacks in cloud-native environments, as exemplified by challenges such as the log4j vulnerability.

The blog post discusses the security challenges and best practices associated with AWS Lambda functions, emphasizing the importance of proper input validation and the application of least privilege principles in AWS Identity and Access Management (IAM) roles to prevent unauthorized access and privilege escalation. It highlights two attack scenarios, black box and white box testing, illustrating how misconfigured permissions and insecure code can be exploited by attackers to gain access to cloud environments. The post underscores the importance of securing serverless applications, such as AWS Lambda, by ensuring that code adheres to security best practices and that resources like S3 buckets are not publicly accessible without proper authentication. Additionally, it suggests using security tools to monitor and detect anomalous activities to strengthen cloud security and prevent exploitation.

Sysdig has announced that Gerald Combs, the original creator and lead maintainer of Wireshark, has joined the company, and Sysdig will become the primary sponsor of Wireshark. This collaboration marks a reunion for Loris Degioanni, Sysdig's founder, and Combs, who have collaborated since their early days with the Ethereal project, which later became Wireshark. Combs' addition is seen as an opportunity to enhance Wireshark's capabilities for modern cloud environments, particularly as software increasingly operates in the cloud and is orchestrated by Kubernetes. Sysdig plans to invest in expanding Wireshark's features to ensure it remains a vital tool for troubleshooting and security investigations, with a commitment to supporting its developer community and continuing the legacy of Wireshark.

In early 2022, two popular JavaScript open-source packages, colors.js and faker.js, were maliciously modified, rendering them unusable. Colors.js, used for console customization, was altered to create an infinite loop, while faker.js, used for generating fake data, had its functional code deleted, making it non-functional. These incidents highlight the vulnerability of software supply chains and the importance of maintaining security measures for open-source projects. To mitigate such risks, users are advised to revert to stable versions of these packages and employ image scanning tools like Sysdig Secure, which can detect compromised packages and potential vulnerabilities. These events underscore the necessity for vigilance in managing open-source dependencies, as the impacts of such modifications can be widespread, affecting numerous applications.

Microsoft Azure, a prominent choice for enterprises to deploy apps in the cloud, faces security challenges that require robust solutions, particularly in the realm of DevSecOps. Sysdig has launched its Sysdig Secure cloud capabilities for Azure, which include advanced security and compliance controls such as Cloud Security Posture Management (CSPM) and Cloud Threat Detection using Falco rules tailored for Azure. These capabilities aim to enhance the security posture by providing static configuration analysis, guided remediation, and real-time threat detection through Azure Activity Logs. The collaboration between Sysdig and Microsoft Azure aims to simplify cloud and container security while ensuring users adhere to best practices for securing Azure accounts, applications, and services. Sysdig's offerings are available on the Microsoft Azure Marketplace, and the partnership emphasizes a unified approach to securing cloud services, workloads, and containers, ultimately facilitating faster threat detection and response.