March 2022 Summaries

A critical vulnerability known as Spring4Shell (CVE-2022-22965) has been identified in the popular Java framework Spring Core on JDK9+, which allows remote code execution (RCE) by exploiting class injection vulnerabilities, potentially leading to a complete system compromise. This vulnerability affects versions 5.3.0 to 5.3.17 and 5.2.0 to 5.2.19, including older unsupported versions, and requires certain conditions to be met, such as using JDK 9 or higher, Apache Tomcat, and specific dependencies. The vulnerability is distinct from CVE-2022-22963, which impacts Spring Cloud. To mitigate the risk, affected systems should be updated to versions 5.3.18+ or 5.2.20+, and detection can be achieved using tools like Sysdig for scanning during the build, deployment, and runtime phases. The article emphasizes the importance of continuous monitoring and adapting security policies to address emerging threats in real-time.

Researchers have discovered a significant vulnerability, CVE-2022-22963, in the Spring Cloud Function framework that permits remote code execution (RCE), potentially allowing attackers to execute arbitrary code and compromise entire hosts. This vulnerability, along with the similar CVE-2022-22965, is particularly concerning due to its high CVSS score of 9.8 and the ease with which it can be exploited through HTTP request headers using the Spring Expression Language (SpEL). The issue affects specific versions of Spring Cloud Function, and due to its potential impact on cloud serverless functions, it poses a serious threat to cloud environments such as AWS Lambda and Google Cloud Functions. The article provides guidance on detecting and mitigating this vulnerability through updating affected applications, utilizing image scanning during the build and deployment processes, and employing runtime detection tools like Falco. It emphasizes the importance of patching vulnerabilities promptly and maintaining a clear understanding of the software packages in use to defend against such threats effectively.

The text explores the importance of Digital Forensics and Incident Response (DFIR) in Kubernetes environments, emphasizing the challenges posed by the ephemeral nature of containers and the need for new methodologies to address these challenges. It outlines a scenario of a cybersecurity incident within a Kubernetes cluster, detailing the steps to identify, coordinate, resolve, and improve responses to such incidents. Tools such as Falco, Falcosidekick, and Docker Explorer are highlighted for their roles in monitoring, detecting, and analyzing security events. The article advocates for an Incident Response Plan that includes Identification, Coordination, Resolution, and Improvement phases, supported by effective tools to ensure a comprehensive approach to managing and mitigating cyber threats. It concludes by underscoring the significance of continuous improvement and training in enhancing cybersecurity resilience within Kubernetes environments.

In March 2022, the hacking group Lapsus$ exposed a breach involving Okta, a prominent Identity-as-a-Service platform, sparking concerns over insider threats and other attacks like phishing and credential stuffing. The breach, which occurred in January, allowed unauthorized access to Okta's systems, raising questions about the extent of the compromise and Okta's incident response. This has prompted discussions on the importance of auditing logs for suspicious activities, with tools like Falco and Sysdig's Okta-analyzer being recommended for analyzing past and current logs to ensure security. The article emphasizes the need for vigilance and proactive measures such as enabling multi-factor authentication (MFA) to mitigate potential risks, highlighting that no organization is immune from such threats.

In response to President Biden's warning about potential Russian cyber warfare attacks due to sanctions, the article emphasizes the importance of preparedness against such threats, particularly for American companies and critical infrastructure. It outlines the difference between Computer Network Exploitation (CNE) and Computer Network Attack (CNA), with a focus on CNA's disruptive and destructive nature, which can include ransomware and denial of service attacks. The text highlights the necessity of distinct approaches to counter CNA operations, such as conducting tabletop exercises, ensuring visibility of critical infrastructure, and implementing robust incident response and disaster recovery plans. Organizations are encouraged to deploy Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) tools for enhanced visibility and to follow best practices for cybersecurity. The article also suggests the formation of purple teams to identify and address security gaps and underscores the need for a comprehensive incident response plan, whether in-house or through third-party services, to swiftly and effectively manage potential compromises in a conflict scenario.

In March 2022, Sysdig introduced several updates and features across its platform, emphasizing enhanced security and user experience. Among the highlights were video tours showcasing the updated Sysdig UI and the introduction of Sysdig Secure, which addresses vulnerabilities such as the "Dirty Pipe" Linux Kernel flaw. The company also emphasized the importance of multi-factor authentication (MFA) and introduced User Risk Labels to identify potential security misconfigurations. New features for Cloud Infrastructure Entitlement Management (CIEM) were launched, including trend charts, CSV report exports, and effective permission calculations. In addition, the latest releases of various Sysdig tools and integrations, such as the Falco engine, Sysdig Agents, and Prometheus integrations, were announced. These updates are complemented by new educational resources, including blogs, webinars, and workshops aimed at enhancing cloud security awareness and capabilities.

CVE-2022-0811, also known as cr8escape, is a high-severity vulnerability affecting CRI-O container engines from version 1.19 onwards, which can lead to arbitrary code execution by exploiting a flaw in the pinns utility that sets kernel parameters without proper validation. This vulnerability impacts any infrastructure relying on these engines, including Kubernetes and OpenShift, allowing adversaries to potentially gain remote control of servers. A patch has been released to address the issue, and it is crucial to apply it immediately to mitigate risks. Additionally, tools like Falco and Open Policy Agent (OPA) can help detect and prevent exploitation attempts by monitoring suspicious activities and enforcing security policies at the pod level. PodSecurityPolicy is deprecated, so OPA is recommended for maintaining security compliance by blocking deployments with unsafe configurations.

IBM has introduced the IBM Z and Cloud Modernization Center to enhance the modernization of applications, data, and processes within an open hybrid cloud framework. This initiative pairs IBM Z systems, known for their transactional integrity and reliability, with hybrid cloud development. Sysdig supports this effort by offering its cloud-native monitoring and security platform tailored for IBM Z and IBM LinuxONE, which emphasizes modern DevOps practices and the use of Kubernetes-managed containers. The partnership between IBM and Sysdig aims to secure container-based applications by leveraging Sysdig's runtime threat detection tool, Falco, and other open-source technologies. This collaboration addresses the significant security risks identified in cloud environments, as highlighted by various industry reports. Sysdig's approach involves using lightweight agents that monitor system calls, ensuring real-time alerts for suspicious activities while integrating seamlessly with existing open-source tools. The partnership is expected to drive the adoption of this innovative security approach among enterprises, particularly in the financial sector, and foster the modernization journey at the IBM Z and Cloud Modernization Center.

In the evolving landscape of cloud security, traditional perimeter-based defenses are becoming obsolete due to the distributed nature of cloud services, which resemble an amusement park with multiple entry and exit points rather than a fortified medieval town. This shift necessitates new approaches to threat detection, such as real-time stream detection, which allows for continuous monitoring and immediate response to suspicious activities. Falco, an open-source runtime security tool incubated by the Cloud Native Computing Foundation, exemplifies this approach by acting as a proverbial security camera that watches over cloud workloads, analyzing system calls and consuming data from cloud services like AWS CloudTrail to detect anomalies in real-time. By integrating Falco with cloud-native logs, organizations can reduce costs associated with external log storage and enhance their threat response capabilities, aligning security measures with the demands of modern cloud infrastructures.

CVE-2022-0847, known as "Dirty Pipe," is a critical local privilege escalation vulnerability in the Linux Kernel, reminiscent of the "Dirty COW" exploit. This flaw, rated at a severe score of 8.8, stems from improper initialization of the "flags" member in the pipe buffer structure, allowing an unprivileged user to write to read-only pages and escalate privileges. Discovered in Linux 5.8, the vulnerability enables attackers to overwrite files and execute malicious actions, such as creating a SUID shell backdoor, compromising system integrity. System defenses like AppArmor and Seccomp offer limited protection against this exploit. To mitigate the risk, Linux users are advised to upgrade to fixed kernel versions (5.10.102, 5.15.25, and 5.16.11) promptly. Tools like Sysdig can help detect vulnerable systems and unusual container activity, providing a layer of security by alerting and killing compromised containers. As this vulnerability can lead to complete system compromise, responsible disclosure has been crucial in allowing Linux users to update and protect their systems.

CVE-2022-0492 is a high-severity (7.0) privilege escalation vulnerability in the Linux Kernel's cgroup_release_agent_write function, allowing attackers to escape container environments and gain root privileges. Found in cgroups v1, this vulnerability is exploitable by attackers with root access when containers run without security practices like SELinux, AppArmor, or Seccomp enabled. Although a patch is available in kernel version 5.17 rc3, the ease of exploitation necessitates proactive security measures such as using runtime detection tools like Falco and enforcing admission policies with tools like OPA. These measures help prevent exploitation by ensuring container environments are secure and up to date.

Multi-Factor Authentication (MFA) is crucial for enhancing the security of cloud accounts, as it significantly reduces the risk of unauthorized access and breaches that result from credential leaks and single-factor authentication vulnerabilities. The text highlights real-world examples, such as a costly AWS bill due to a stolen key used for crypto mining, illustrating the potential consequences of relying solely on passwords for cloud account security. Despite the ease and low user friction associated with passwords, they remain the weakest form of authentication, as they can be guessed or stolen. Implementing MFA, which involves an additional verification factor such as a cell phone or biometric data, can prevent 99.9% of attacks according to Microsoft. For both personal and corporate accounts, enforcing MFA can mitigate risks and ensure peace of mind, with cloud providers like Amazon AWS, Google Cloud Platform, and Azure offering logging services to track login attempts. Tools and strategies, such as setting up alarms for specific login behaviors, can further enhance security measures, making MFA a necessary practice to safeguard sensitive information in an increasingly cloud-centric world.

Malicious Docker containers represent a new threat vector, exploiting exposed Docker APIs or vulnerable hosts for malicious activities such as data exfiltration or crypto-mining. The article details a case study by Sysdig researchers who simulated an exposed Docker API environment, capturing a malicious container for analysis. This container, masquerading as an Apache image, was found to contain a malware downloader disguised within a binary, targeting other Docker APIs for propagation. Static and dynamic analysis revealed attempts to download and execute the Monero miner, XMRig, indicating a compromise. The article emphasizes the importance of not exposing Docker endpoints, or otherwise implementing a zero-trust infrastructure to prevent unauthorized container execution, and highlights the value of having an incident response plan to quickly address and mitigate threats. Sysdig uses tools like Falco and its own platform to enhance Kubernetes security by providing pre-written security rules and facilitating better management of security risks in cloud environments.