May 2022 Summaries

The blog post explores how to use Atomic Red Team, a tool maintained by Red Canary, to test Falco rules within a Kubernetes environment. Atomic Red Team helps simulate adversarial tactics and techniques based on Mitre's ATT&CK framework, allowing users to generate suspicious events and observe Falco's alert responses. The article provides a step-by-step guide on setting up Atomic Red Team in a Kubernetes cluster, including creating Docker images and running tests with elevated privileges. It also discusses troubleshooting potential issues with test cases, such as those requiring remote hosts or specific system features. In addition, the post explains how to manually execute tests within the container and verify Falco's detection capabilities by checking logs for triggered events. The overall aim is to ensure that security products are functioning correctly and to identify any gaps in protection.

In May 2022, Sysdig introduced several updates to enhance its platform's capabilities, focusing on improved security, troubleshooting, and data management. Notable features include the Sysdig Advisor for accelerated Kubernetes troubleshooting and Container Drift for detecting runtime code deviations. The Sysdig Platform Architecture now offers comprehensive tracking and reporting of system changes, while the enhanced metric store supports a Prometheus-compatible naming convention for faster data queries. Sysdig also earned recognition as an AWS Well Architected Framework Partner for security management and launched updated versions of tools like the Sysdig CLI, Python SDK, and Terraform Provider. Furthermore, the updates encompass security patches for various analyzers, new Prometheus integrations, and enhanced dashboards, ensuring users can efficiently monitor and secure their cloud environments.

The article explores how to use Falco, a runtime security tool, to detect connections through the TOR network, which is designed to anonymize internet traffic but can also be exploited by attackers. It highlights TOR's role in protecting user privacy and its operation via a global network of relays. Since TOR nodes are dynamic, static lists are ineffective for detection, but Falco can utilize metrics from TOR's API to identify nodes. A Python script is used to periodically update Falco's rule sets to monitor TOR connections, distinguishing between inbound and outbound connections to assess potential security threats. The article provides a detailed guide on setting up Falco to detect TOR connections, including the installation of necessary software and testing procedures with Docker containers. It emphasizes that while TOR is not inherently malicious, monitoring its connections can be crucial for security, helping to identify unauthorized data exfiltration or attacks.

Shift left is a cybersecurity philosophy aimed at integrating security processes and tools earlier in the software development lifecycle to address the shortcomings of traditional waterfall methodologies. By prioritizing security alongside functionality and quality during the design and development phases, shift left helps detect vulnerabilities earlier, thus reducing the complexity and cost of fixes. This approach involves using application security testing (AST) methods like software composition analysis (SCA) and static application security testing (SAST) to identify issues in both custom code and dependencies. However, the effectiveness of shift left is enhanced when combined with runtime intelligence, which helps prioritize risks and minimize false positives. Despite its benefits, shift left is only part of a comprehensive security strategy, as ongoing protective measures and responsive actions for production environments remain crucial for maintaining organizational safety and success.

In May 2022, a series of cyberattacks targeted Italian institutional websites, including the Italian Senate and the Ministry of Defense, as well as sites in other countries, with pro-Russian hacker groups Killnet and Legion claiming responsibility. These attacks, using the Mirai malware to execute distributed denial-of-service (DDoS) attacks, marked the first claimed assault on Italy by pro-Russian cyber groups since the onset of the Ukraine conflict. Killnet and Legion have previously targeted nations opposed to Russia, leveraging a botnet primarily composed of foreign devices, with financial backing from enthusiasts rather than official authorities. The Sysdig Threat Research Team has been monitoring Mirai-based malware, noting a significant increase in activity coinciding with the conflict in Ukraine, and has developed detection rules using the Falco security tool to identify such malicious activities. The attacks highlight vulnerabilities in the network services of institutional servers, suggesting a need for improved cybersecurity measures and transparent communication to enhance awareness and prevent future incidents.

Sysdig's latest release of its open-source tool introduces significant enhancements, including support for plugins, which extend the tool's capabilities by allowing the integration of new event sources similar to Falco's functionality. The update includes features such as output color coding, Podman support, and new syscalls, alongside a new filtering option. By leveraging plugins, users can define new fields and evaluate additional event sources using Falco rules, enhancing the tool’s versatility in threat detection. Installation instructions are provided, showcasing how to set up and test plugins like the dummy and docker plugins, which facilitate interaction with Docker events. This advancement signifies Sysdig's commitment to enhancing its open-source security framework, enabling the detection of infrastructure threats in a more efficient manner, whether on-premise or in the cloud.

Edd Wilder-James has joined Sysdig as the Vice President of Open Source Ecosystem, bringing his extensive experience from Google Cloud where he influenced major open-source projects like Tensorflow, Kubernetes, and Istio. His role at Sysdig focuses on leveraging open-source platforms, such as Sysdig OSS and Falco, to enhance container security, a crucial aspect of modern cloud computing. Wilder-James emphasizes the importance of a balanced relationship between product, open-source projects, and the ecosystem of users and contributors for achieving success. He sees Sysdig as a perfect match for his skills and predicts that more companies will prioritize open-source resources at the executive level in the evolving cloud market. He believes that open source is vital for the future of cloud security, fostering transparency and interoperability, and is committed to supporting successful projects within the CNCF and the broader Kubernetes ecosystem. Wilder-James invites people to connect with him at KubeCon EU, where he will be engaging with the community and promoting Sysdig's open-source initiatives.

Sysdig Advisor, as discussed by Harry Perks, highlights the benefits of Falco Feeds in enhancing Kubernetes troubleshooting by providing companies with access to expert-crafted, continuously updated rules to address emerging threats. This resource aims to simplify cloud security management by allowing organizations to leverage open-source tools effectively, ensuring they stay informed about the latest security challenges. Sysdig also emphasizes the importance of practical experience, offering demonstrations to help users understand how to defend their cloud environments efficiently.

Organizations increasingly adopt cloud and container technologies to expedite application development, but ensuring robust security requires embedding security into the DevOps workflow without hindering developer productivity. Key considerations for securing these technologies include integrating image scanning into the CI/CD pipeline, utilizing Kubernetes native controls to prevent risky deployments, and enforcing Infrastructure as Code (IaC) security to manage misconfigurations. Effective cloud security also involves managing excessive permissions, enabling cloud log auditing for threat detection, and implementing runtime security to detect malicious activities. Embracing a zero-trust network segmentation strategy, monitoring performance and availability, and having an incident response framework in place are crucial for maintaining security. Additionally, leveraging open-source tools helps prevent vendor lock-in and allows for greater transparency and flexibility, aligning with community standards to protect technological investments.

Sysdig's blog post highlights the importance of monitoring and securing AWS Relational Database Service (RDS) instances due to the potential security risks associated with public exposure and configuration drift. While AWS provides robust security measures like encryption and network isolation, the shared responsibility model means users must manage and secure instances actively, as attackers can exploit public RDS instances using various tools and techniques. The blog discusses how traditional methods and native AWS tools, such as CloudTrail and CloudWatch, can be ineffective in real-time alerting due to their complexity, high maintenance, and delayed response times. In contrast, Sysdig Secure offers a more efficient solution by continuously monitoring CloudTrail logs and providing immediate alerts with actionable insights, allowing for rapid response to suspicious events. The blog emphasizes the scalability and ease of extending Sysdig's functionalities through customizable rules using the open-source Falco format, making it a comprehensive tool for safeguarding AWS environments against potential threats.

The blog post addresses how attackers exploit fileless malware techniques to bypass security measures, particularly in containerized environments with read-only root filesystems. It highlights the vulnerability of such systems by discussing a specific exploit targeting a Redis Docker image with a critical CVE-2022-0543 vulnerability, which allows attackers to execute shell commands via a Lua sandbox escape. The article describes how attackers use shared memory (/dev/shm) to execute malicious code in-memory without writing to disk, thus evading traditional file-based detection methods. It emphasizes the importance of using tools like Falco for detecting in-memory attacks by monitoring suspicious behaviors, such as executions from /dev/shm. The discussion concludes that while read-only filesystems provide some security, they are not foolproof against fileless malware, urging the need for timely patching and advanced detection mechanisms to mitigate such threats effectively.