October 2022 Summaries

A critical OpenSSL vulnerability is set to be announced on November 1, 2022, affecting only the 3.0.x versions, which poses potential concerns for container images and applications using this version. Historical comparisons are drawn with past vulnerabilities like Heartbleed and CVE-2016-6309, highlighting the rarity and potential impact of such issues. While common Linux distributions and container base images such as RHEL, Alpine, and Debian typically do not have OpenSSL installed by default, application images are more likely to include various versions of OpenSSL, indicating a risk of version drift. The importance of following proper vulnerability management processes is emphasized, with a promise of further details once the CVE specifics are released.

In October 2022, Sysdig introduced several updates across its product suite, enhancing both Sysdig Monitor and Sysdig Secure. New features in Sysdig Monitor include four advisories related to cluster capacity and resource overcommitment, YAML configuration support, and customizable Slack notification sections. Sysdig Secure now offers severity filtering in Insights, a node and pod activity view, and new Falco rules to detect various security threats like rootkits and unexpected network connections. Additionally, Sysdig introduced platform improvements, including on-the-fly group mapping, and updated the Sysdig Agent to v12.9.0 with various enhancements and fixes. The release also highlighted updates to Sysdig's CLI and SDK tools, as well as new features in the Sysdig Cloud Connector, which now includes a registry scanner and other security enhancements.

Golden Signals are a concept introduced by Google to provide a focused set of metrics for monitoring services, especially useful in environments like Kubernetes. The four Golden Signals—Latency, Traffic, Errors, and Saturation—offer a comprehensive overview of a service's performance from a user perspective. Latency measures the time to serve requests, Traffic assesses service usage over time, Errors track the rate of failed requests, and Saturation gauges resource consumption. These metrics help identify potential issues affecting application behavior, enabling quicker detection and resolution. The RED and USE methods are alternative approaches inspired by the Golden Signals, emphasizing different aspects of system performance. Proper implementation of these monitoring techniques, often supported by tools like Prometheus and Grafana, can enhance system reliability and efficiency, while also providing insights into resource management and user experience.

The article outlines a process for integrating Sysdig Secure's container image scanning into Jenkins CI/CD pipelines to enhance security by identifying vulnerabilities early in the development process. By using the Sysdig Secure Jenkins plugin, developers can automate the scanning of container images, ensuring they meet security standards before being pushed to a registry. This approach allows for "security shift-left," where vulnerabilities are detected and addressed sooner, reducing risks in production environments. The article provides a detailed example of setting up a Jenkins pipeline to automate image scanning, including configuring credentials, defining pipeline stages, and utilizing Sysdig's scanning capabilities to enforce security policies. The benefits of this integration include preventing the deployment of compromised images and enabling compliance with security standards, all while utilizing Jenkins' extensive plugin ecosystem for seamless integration.

Marco Bulgarini reflects on the challenges and considerations of relying on advanced software tools in production environments, using his personal experiences with the Kubernetes management tool, Lens, as a case study. Through a series of incidents where unintended deletions occurred due to a software bug, he emphasizes the importance of balancing tool sophistication with reliability and the potential dangers of over-reliance on complex tools without proper vetting. Bulgarini suggests standardizing toolsets within teams while allowing flexibility, advocating for a culture of collaboration and open-source contribution to ensure tools are robust and reliable. He also highlights the necessity of reducing manual interventions through resilient infrastructure design and incorporating chaos testing to anticipate and manage failures effectively. Emphasizing a blameless culture in incident management, Bulgarini encourages transparency and collaboration to address and learn from mistakes, ultimately aiming to enhance productivity and infrastructure safety.

Sysdig has been recognized with three Best Place to Work awards by Comparably in 2022, based on employee feedback regarding work-life balance, compensation, and company perks and benefits. The awards reflect the sentiments of over 150 Sysdig employees and highlight the company's commitment to fostering a supportive work environment. Sysdig emphasizes a flexible approach to work, offering additional global wellness days, a monthly stipend for wellness purposes, and professional mental health support, while also focusing on competitive compensation and pay transparency. The company’s culture is driven by core values such as customer love, teamwork trust, and the determination to "dig deeper," which underpin its mission to secure cloud deployments. These values and the positive workplace culture contribute to Sysdig's high rankings in various categories, including overall culture score, employee NPS, gender score, and diversity score, as compared to other large cloud-native security companies.

Sysdig's Threat Research Team (TRT) has uncovered a sophisticated cryptomining operation, named PURPLEURCHIN, which exploits free-tier accounts on popular CI/CD platforms like GitHub, Heroku, and Buddy.works to mine cryptocurrencies. This operation, described as "freejacking," involves the use of over 130 Docker Hub images and numerous GitHub, Heroku, and Buddy accounts, leveraging automation to bypass defenses such as CAPTCHAs and credit card requirements. The illicit activity shifts operational costs to service providers, potentially leading to increased prices for legitimate customers, and could degrade service quality due to resource strain. PURPLEURCHIN's cryptomining, albeit currently targeting low-profit-margin coins, suggests a potential strategy to transition to more lucrative cryptocurrencies or even manipulate blockchains via a 51% attack. The operation might also camouflage other malicious activities, drawing parallels to past cyberespionage campaigns that used cryptomining as a diversion. The analysis highlights the persistent evolution of the threat actor's techniques, which include complex automation for account creation and operation management, indicating a highly organized and scalable fraud scheme.

CVE-2022-42889, also known as Text4shell, is a critical vulnerability identified in the Apache Commons Text library, posing a risk of remote code execution (RCE) by allowing attackers to execute arbitrary code through the StringSubstitutor interpolator class. Rated at a high severity of 9.8, this vulnerability affects versions 1.5 through 1.9, and it has been patched in version 1.10. The flaw arises from a logic error in the default string lookup keys, "script," "dns," and "url," which are improperly interpolated, leading to potential system compromise. Although less widespread than similar vulnerabilities like Log4Shell, Text4shell requires specific conditions for exploitation, making it less likely to have a large-scale impact. Mitigation involves updating to the patched version, employing runtime detection tools such as Falco for ongoing monitoring, and utilizing image scanners like Sysdig to identify and address the vulnerability within affected systems.

Kubernetes has become integral to cloud-native application infrastructure, prompting the need for effective cost management as organizations advance in their cloud journeys. Traditional cloud billing lacks the contextual detail required to manage Kubernetes costs, leading to challenges in tracking and optimizing expenses. In response, Sysdig has introduced Cost Advisor, a feature within Sysdig Monitor, designed to enhance cost visibility and aid in optimizing Kubernetes resource usage. Cost Advisor provides enriched cost data by integrating Kubernetes context, enabling organizations to identify areas of overspend and implement cost-saving measures, with potential reductions in resource waste averaging 40%. The tool also supports FinOps best practices by fostering a culture of cost discipline and accountability, allowing organizations to track costs over time, correlate them with performance metrics, and make informed decisions on resource allocation. By offering a unified view of utilization and costs, Cost Advisor helps teams rightsize workloads, maintain performance, and optimize expenditures without compromising development speed. A free 30-day trial of Sysdig Monitor's Cost Advisor is available, encouraging organizations to explore its benefits without initial financial commitment.

Victor Hernando's blog post, published on October 13, 2022, discusses how to monitor Istio using Sysdig, focusing on the integration of Falco Feeds. These feeds enhance the open-source security tool Falco, providing users with expert-crafted rules that are continuously updated to address new threats. The article emphasizes the importance of using Sysdig's features for cloud security, offering readers the opportunity to explore these capabilities through a demo guided by a security expert.

Istio is a service mesh that enhances applications by providing observability, security, and traffic management without altering the code. It comprises a control plane and a data plane, with the latter utilizing Envoy proxies to manage inter-service traffic. The article emphasizes the importance of monitoring Istio to prevent performance issues, highlighting tools like Prometheus, Grafana, Kiali, and Jaeger as key components of Istio's observability stack. Prometheus collects metrics, Grafana visualizes data, Kiali offers a console for managing service mesh configurations, and Jaeger provides distributed tracing for analyzing network performance. The piece also introduces Sysdig Monitor as a tool for enhanced Istio monitoring and troubleshooting, offering a unified platform for managing the service mesh.

Eduardo Mínguez's blog post details how to integrate Sysdig Secure's image scanning capabilities into GitLab CI/CD pipelines to identify vulnerabilities and misconfigurations in container images before they reach production. By leveraging the sysdig-cli-scanner tool, users can perform local scans within the CI/CD pipeline, ensuring that only secure images are pushed to the registry. The process involves stages for building, scanning, and pushing images, with the scanning step halting the pipeline if any critical vulnerabilities are detected. This implementation shifts security left by embedding it early in the development process, thus preventing the exposure of sensitive data and improving compliance with container security standards. Additionally, the post highlights the benefits of Sysdig's approach, including customizable policies and the ability to keep images within the build environment during scans.

Preventing Denial-of-Service (DoS) attacks in Kubernetes involves using cloud-native tools like Falco and Calico to detect and mitigate threats. Falco, an open-source intrusion detection system, can alert administrators to suspicious patterns, such as connections through the Tor network, but cannot block DoS attacks. On the other hand, Calico, a Container Network Interface (CNI) plugin, provides network policy enforcement that can prevent unwanted traffic by dropping malicious packets early in the network processing pipeline. By leveraging Calico's GlobalNetworkPolicy and GlobalNetworkSet, administrators can define rules to deny traffic from known malicious sources. Additionally, Calico supports extended Berkeley Packet Filter (eBPF) and eXpress Data Path (XDP) for enhanced network performance and security. To build a comprehensive security strategy against DoS attacks, both Falco's behavioral monitoring and Calico's network filtering capabilities are necessary. This dual approach ensures both detection and prevention, contributing to a robust Cloud Detection and Response (CDR) framework for Kubernetes environments.

Falco has expanded its capabilities to detect multi-factor authentication (MFA) spamming, a technique used by groups like Lapsus$ to gain unauthorized access to systems by overwhelming users with repeated login requests. This method, also known as MFA fatigue, was employed in the high-profile Uber cybersecurity incident, emphasizing the importance of vigilance against social engineering attacks. Falco, widely recognized for its runtime security in Linux and Kubernetes environments, has developed an Okta plugin to monitor and alert on unusual MFA activities, such as excessive denies or failures in Okta logs. This tool helps organizations take preventive measures by generating alerts when suspicious patterns occur, thus enhancing their defense mechanisms against credential-based attacks. Despite robust security protocols at companies like Uber, the incident underscores the persistent threat of social engineering attacks and the need for continuous improvement in security practices, including proper management of access credentials and anomaly detection.

Javier Martínez's blog post, published on October 5, 2022, delves into the Kubernetes error codes ErrImagePull and ImagePullBackOff, discussing their implications and how to address them. The piece highlights Falco Feeds by Sysdig, an enhancement to the Falco open-source security tool, providing continuously updated expert-written rules to help companies tackle emerging threats. The blog emphasizes the importance of proactively defending cloud environments and offers a demo to experience advanced cloud security strategies firsthand.

Sysdig Secure enhances the capabilities of Microsoft Sentinel, a Security Information and Event Management (SIEM) solution on Azure, by providing advanced threat detection and deep visibility into cloud workloads. Sysdig leverages the open-source Falco rules engine to detect suspicious activities and enrich events that are sent to Microsoft Sentinel, which can then be used for further forensic investigations and visualizations. This collaboration aims to help organizations accelerate cloud application deployment by improving security and troubleshooting efficiency. Key prerequisites for successful SIEM implementation include identifying source assets, ensuring data quality, and managing logging levels. The integration process involves setting up event forwarding from Sysdig Secure to Microsoft Sentinel, allowing security teams to utilize comprehensive dashboards and conduct in-depth analysis of various event types, such as activity audits and compliance tracking. The partnership underscores Sysdig's commitment to enhancing cloud and container security by providing valuable insights into potential threats and vulnerabilities.

The text outlines the process of building a simple SSH honeypot using vcluster and Falco for runtime intrusion detection, highlighting the benefits of honeypots in cybersecurity. Honeypots are tools used to lure attackers and gather intelligence on their activities, classified by complexity as low or high interaction. Low interaction honeypots require fewer resources but offer limited insights, while high interaction honeypots provide detailed intelligence but risk giving attackers access to real assets. Virtual clusters offer a solution by creating isolated environments within Kubernetes clusters, allowing secure exposure of sensitive elements without risking the host infrastructure. The text describes setting up a honeypot using Minikube to provision a Kubernetes cluster, followed by deploying Falco for monitoring and an insecure SSH server as the honeypot target. The installation and testing process involves multiple terminal windows to simulate an attack, with Falco detecting unauthorized activities. The guide concludes with cleanup instructions and hints at further exploration in a subsequent episode.