November 2022 Summaries

The conflict between Russia and Ukraine has significantly influenced cyber attack behaviors, leading to a notable increase in Distributed Denial of Service (DDoS) attacks as both government-backed threat actors and civilian hacktivists take sides. This cyberwarfare component has resulted in a fourfold rise in DDoS attacks between late 2021 and early 2022, with more than 150,000 volunteers joining anti-Russian campaigns using container images from platforms like Docker Hub. The Sysdig Threat Research Team (TRT) observed a shift from cryptomining activities to DDoS attacks, as attackers exploit unsecured infrastructures and cloud-hosted websites, often bypassing common protections using various methods like SYN-Flood and Layer 7 attacks. These attacks have caused significant disruptions, including outages in NATO countries, and highlight the evolving landscape of cyber threats where political motives intertwine with financial gains, as evidenced by the continued prevalence of cryptojacking activities. The conflict's digital dimension illustrates the rapid scaling and organization of cyber campaigns, facilitated by technologies such as containers, and emphasizes the complex interplay between geopolitical events and cybercrime.

Kubernetes 1.26 introduces a host of new features and enhancements aimed at improving performance and usability for developers and administrators. This release includes 37 enhancements, with highlights such as the ability to provision volumes from cross-namespace snapshots, which facilitates database management and backup solutions, and improved support for high-performance workloads through better CPU core management. New features for cluster administrators include support for OpenAPIv3, which simplifies cluster setup and management. The update also introduces a practical implementation of CEL for admission control, streamlining the process by removing the need for webhooks. Moreover, Kubernetes 1.26 enhances monitoring with Service Level Indicator (SLI) metrics, removes dependencies on cAdvisor by enriching the CRI API, and features dynamic resource allocation for advanced hardware. Deprecations in this version include the removal of legacy authentication methods and certain API versions, emphasizing the need for users to adapt to newer configurations. Overall, Kubernetes 1.26 continues to evolve with significant improvements in storage, networking, and node management, reflecting the platform's ongoing commitment to scalability, efficiency, and security.

Cloud storage extortion involves attackers stealing data or access and demanding payment for its return, with various vulnerabilities exploited to gain initial access, such as Log4Shell or Spring4Shell, social engineering, and malware. In AWS, attackers can exploit encryption key policies to lock out data access, while GCP and Azure have different methods and safeguards against such attacks, including mandatory encryption and versioning features. However, GCP and Azure have their own susceptibilities, such as GCP's potential for file transfer extortion and Azure's default public access to storage accounts. Tools like Falco can help detect suspicious activities across these platforms, alerting users to potential threats and enabling quicker response to security events. The article emphasizes understanding cloud environment features and maintaining a proactive security posture to mitigate extortion risks, suggesting solutions like Sysdig for real-time threat detection and cloud security posture management.

The analysis of Docker Hub by the Sysdig Threat Research Team reveals significant security risks associated with public container images, as attackers have increasingly used containers as an attack vector to distribute malicious payloads. This research involved examining over 250,000 Linux images, excluding official and verified ones, to detect embedded threats such as cryptominers and secrets, which could expose users' environments to high risks. Malicious actors often disguise harmful images as legitimate software, a tactic known as typosquatting, to deceive users into downloading and deploying them. The investigation highlights the importance of scrutinizing container images for security flaws before deployment, reinforcing the need for organizations to implement preventive and detective measures to protect cloud and container workloads. The findings have enabled Sysdig to create a feed of known malicious container images, allowing users to identify and respond to these threats effectively.

Monitoring the Kubelet is crucial for maintaining the health and performance of Kubernetes clusters, as it ensures that containers within Pods are running smoothly and can affect the node's readiness state. The Kubelet operates on both control plane and worker nodes and is responsible for executing PodSpecs and maintaining the health of containers. When the Kubelet is down, the node enters a NotReady state, preventing the creation of new Pods and the restarting of failed workloads, thereby impacting application stability. To effectively monitor Kubelet, it is essential to focus on specific metrics such as the number of Kubelet instances, running Pods and containers, and the status of volume management and runtime operations. Prometheus can be configured to scrape these metrics, and tools like Sysdig Monitor can enhance the monitoring process with built-in dashboards and troubleshooting capabilities, allowing for faster identification and resolution of issues within the Kubernetes environment.

The November 2022 update for Sysdig introduces several enhancements and new features across its monitoring and security services. For Sysdig Monitor, new capabilities include AWS Cloudwatch Metric Streams filtering, enabling users to selectively ingest metrics, as well as a Lambda Extension for AWS Lambda Telemetry API, which significantly reduces metrics ingestion latency. Usability improvements in Sysdig Secure include new Falco rules and enhanced event notifications, such as linking network activity to security events for better threat analysis. The update also includes integration with Google Security Command Center and other platforms, alongside improvements in dashboard management, alert systems, and monitoring integrations like OpenShift and Azure Virtual Machines. Additionally, Sysdig continues to update its tools and plugins, addressing vulnerabilities and enhancing functionalities to provide robust cloud security and monitoring solutions.

Cloud Security Posture Management (CSPM) is a framework designed to automate the identification and remediation of risks within cloud infrastructures, emphasizing the enforcement of the least privilege principle to enhance security. This approach overlaps with Cloud Infrastructure Entitlement Management (CIEM), a newer category that addresses identity and privilege control gaps in public cloud deployments. Both CSPM and CIEM are now part of the broader Cloud Native Application Protection Platform (CNAPP), which provides comprehensive coverage from workload validation to policy auditing. The principle of least privilege involves granting only necessary permissions to users and systems, reducing vulnerabilities to unauthorized access. Tools like Falco, an open-source runtime security engine, enhance threat detection by analyzing cloud environment activity logs, aiding in the identification of suspicious events such as unauthorized access attempts. The blog also highlights the importance of multi-factor authentication (MFA) and audit logging in cloud environments for maintaining a secure posture. Moreover, it discusses the significance of identity and access management (IAM) solutions in securely authenticating and authorizing access while emphasizing the need for proactive security measures, including image and configuration scanning, to prevent misconfigurations from reaching production environments. The text concludes by asserting that CSPM focuses on the control plane, advocating for a shift-left security approach that integrates early-stage security measures to prevent potential breaches and improve overall cloud security posture.

Understanding Kubernetes limits and requests is crucial for optimizing resource allocation in containerized environments, particularly concerning CPU and memory resources. The article explores the significance of setting limits and requests, which are essential configurations in Kubernetes that help manage resource allocation and performance. Limits define the maximum resources a container can consume, while requests specify the minimum guaranteed resources for a container. Properly configuring these settings ensures efficient resource usage and prevents issues like CPU throttling or out-of-memory (OOM) kills, which can degrade performance or cause pods to fail. The text emphasizes that while limits are useful in specific cases, they can lead to resource contention and should be used sparingly. Additionally, Kubernetes offers tools like ResourceQuotas and LimitRanges to manage resource allocations at the namespace level, ensuring that resource usage stays within defined boundaries and that default values are applied to containers without explicit specifications. The article highlights the importance of balancing resource allocation to avoid excessive costs or insufficient resource availability, which can affect application performance.

Cryptomining attacks, fueled by the rise of blockchain and cryptocurrencies, pose a significant threat to cloud and Kubernetes environments due to their inherent openness and available compute power. The article highlights the importance of detecting such attacks early, using open-source tools like Falco for monitoring Indicators of Compromise (IoC) and Prometheus for health activity metrics. It discusses a high-profile cryptomining attack on Tesla's Kubernetes cluster, illustrating vulnerabilities such as unprotected dashboards and sensitive credential exposure. The article further explains various evasion techniques attackers use, such as minimizing CPU usage and encrypting communications, and details how Falco can detect suspicious network activity and file system changes. Moreover, it emphasizes the necessity of a multi-layered detection strategy, combining rule-based policies with machine learning to identify cryptomining activities effectively. The integration of Sysdig Secure's Cloud Detection & Response platform with Falco's managed ruleset aims to improve incident response times and enhance security against the increasingly complex cloud threat landscape.

Monitoring the Kubernetes API server is essential for ensuring the stability and performance of a Kubernetes cluster, as it serves as the core component of the control plane responsible for processing requests and managing the cluster's state. The article provides a comprehensive guide on how to monitor the Kubernetes API server using tools like Prometheus, by scraping metrics endpoints that provide insights into key performance indicators such as latency, traffic, errors, and saturation. These metrics help identify performance issues, allowing for quick troubleshooting and maintaining the cluster's health. It emphasizes the importance of understanding metrics like apiserver_request_duration_seconds and apiserver_request_total to assess latency and traffic volumes, while also highlighting the utility of Sysdig Monitor for enhanced monitoring and troubleshooting. The article underscores the need for proper monitoring to prevent disruptions in Kubernetes operations like starting or stopping Pods and services.

TeamTNT is a well-documented threat actor that has been actively targeting cloud infrastructure since 2019, primarily engaging in cryptojacking activities, which involve mining cryptocurrency on compromised systems without the owner's consent. Using tools like ParrotOS and leveraging vulnerabilities in platforms such as Redis, Docker, and Kubernetes, TeamTNT has executed large-scale campaigns like "Dockergeddon" and "Chimaera," compromising over 10,000 devices. The group's operations are financially motivated, taking advantage of the anonymity provided by privacy-focused cryptocurrency Monero, making it difficult to trace their transactions. Despite the challenges in tracking their activities, Sysdig's Threat Research Team has identified about $8,100 in cryptocurrency profits attributed to TeamTNT, though the actual financial damage to victims is much higher, estimated at $430,000, due to the high cost of cloud resources consumed during the mining process. TeamTNT's approach showcases the growing threat of cryptomining in cloud environments, a low-risk yet profitable venture that continues to challenge cloud security measures.

Helm is widely used to deploy Kubernetes applications due to its simplicity and integration capabilities with GitOps pipelines, yet its security is often overlooked, requiring users to implement their own safeguards. Helm simplifies the deployment process by offering a command interface, a repository with over 9,000 charts, and a templating engine that allows users to deploy complex applications easily. However, Helm charts are generally not secure by default, and users should employ best practices such as using role-based access control (RBAC), keeping charts updated, and verifying digital signatures to ensure security. Writing custom Helm charts involves recommendations like storing them in Git repositories, using consistent versioning, and creating test scenarios to validate deployments. Users should also encrypt Kubernetes secrets and be cautious with third-party charts by using tools to render and review manifests before deploying. While Helm does not automatically enforce security, the article provides comprehensive recommendations for enhancing the security of both consuming and creating Helm charts.

In the face of evolving cyber threats, the blog emphasizes the importance of integrating both "shift-left" and "shield-right" security practices to enhance cloud-native security. "Shift-left" focuses on identifying and addressing security vulnerabilities early in the development pipeline, employing tools such as Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Infrastructure-as-Code (IaC) auditing. In contrast, "shield-right" addresses runtime security by monitoring and protecting running services against emerging threats, acknowledging that traditional security tools may leave gaps in containerized environments. The synergy between these approaches forms the foundation of DevSecOps, as exemplified by the partnership between Sysdig and Snyk, which aims to provide comprehensive container security from development to production. This dual approach allows for more effective detection and response to vulnerabilities, ensuring full lifecycle security by integrating runtime insights into the development process, thus optimizing security efforts in modern application architectures.

The blog post by Nigel Douglas offers a comprehensive guide on mitigating ransomware attacks in Microsoft Azure environments by leveraging Azure's native security tools and best practices. It explains that ransomware is a consequence of failures in threat detection and emphasizes the importance of early detection and mitigation strategies. The post highlights the Azure Threat Research Matrix, which begins with reconnaissance rather than initial access, and outlines various attack vectors such as compromised accounts and misconfigurations. Key recommended practices include limiting user permissions using the least-privilege principle, enforcing Multi-Factor Authentication (MFA), and configuring Network Security Groups (NSGs) to control inbound and outbound traffic. It also advises on employing tools like Microsoft Defender and Azure Sentinel for threat detection, and using Just-In-Time VM Access to restrict port access. The importance of backup management as a last line of defense is underscored, alongside a 3-2-1 backup strategy to ensure data resilience. The blog stresses the need for continuous monitoring and automated security posture management to prevent ransomware attacks effectively, advocating for tools like Sysdig Secure that offer cross-cloud security management capabilities.

The article explores the distinctions between AWS CloudTrail and CloudWatch, two essential cloud log management services, highlighting their unique functionalities within cloud environments compared to traditional on-premises settings. CloudTrail is primarily used for auditing operations, tracking user actions, and ensuring compliance by recording events related to AWS services, while CloudWatch focuses on performance monitoring, detecting anomalies, and setting alarms, although it requires additional configuration for security alerts. The text emphasizes the importance of effectively managing cloud logs due to challenges such as massive log volumes, multi-cloud environments, and security threats, and it suggests best practices for log creation, transmission, and storage. Additionally, it discusses strategies for addressing security concerns, like runtime detection, and the necessity of understanding and utilizing cloud logs effectively to enhance visibility and response to potential threats. The article concludes by recommending Sysdig as a tool to improve Cloud Security Posture Management (CSPM) and offers resources for further exploration of AWS security services.

AWS has introduced the AWS Lambda Telemetry API to address challenges in monitoring serverless environments like AWS Lambda, which traditionally suffer from issues such as ephemeral nature and distributed execution. This API allows real-time access to function metrics, enabling providers like Sysdig to develop telemetry tools packaged as Lambda Layers, which can be attached to Lambda functions to collect and generate critical real-time metrics, including invocation count and function duration. Sysdig's Monitor Lambda Extension leverages this API to provide lower latency and higher fidelity metrics collection compared to AWS CloudWatch Metric Streams, offering users the potential for improved monitoring and reduced mean time to recovery (MTTR). The extension, compatible with OpenTelemetry (OTEL) standards, simplifies instrumentation by integrating Lambda events into Sysdig's platform, offering greater insight into Lambda function performance and states, and is available in preview mode for users seeking enhanced observability in near real-time.

Kubernetes multi-tenancy presents security challenges due to shared resources among different services or teams, requiring isolation boundaries to ensure secure operations. The three primary isolation boundaries in Kubernetes include the Control Plane and API, where Kubernetes Namespaces and Role-Based Access Control (RBAC) help isolate tenants; the Host, leveraging containers and Linux features like Namespaces and cgroups for workload isolation; and the Network, where NetworkPolicies manage traffic between tenants. Tools like Falco and Open Policy Agent (OPA) Gatekeeper enhance security by monitoring runtime behaviors and enforcing policy compliance. Falco, an open-source project, alerts users to suspicious activities by analyzing Kubernetes audit trails and Linux syscalls, while OPA Gatekeeper acts as a firewall for Kubernetes configurations to prevent insecure deployments. Network isolation is achieved through NetworkPolicies, although challenges persist due to the need for external providers and the inherent default-allow nature of Kubernetes networking. Achieving effective multi-tenancy security involves configuring these boundaries, deploying monitoring tools, and tailoring them to specific organizational needs.

Sysdig Secure offers tools to detect and prioritize the mitigation of the OpenSSL vulnerabilities CVE-2022-3602 and CVE-2022-3786, which were addressed in the OpenSSL 3.0.7 patch released on November 1, 2022. These vulnerabilities involve stack-based buffer overflows affecting all OpenSSL versions up to 3.0.6. Sysdig Secure utilizes features like Falco Feeds and Risk Spotlight to aid organizations in identifying vulnerable container images and prioritizing those vulnerabilities that present real exploitation risks at runtime. Users can generate detailed reports to assess their exposure, customize report frequency, and choose notification methods, facilitating a proactive approach to managing these vulnerabilities. The article emphasizes the importance of preparing for such vulnerabilities due to the widespread use of OpenSSL and the potential for these issues to affect various dependencies within different Linux distributions.

Etcd is a distributed key-value open-source database that serves as a critical component in Kubernetes infrastructure by storing cluster-related data and leveraging the RAFT algorithm for leader election and consensus. Proper monitoring of etcd is essential to prevent issues such as loss of quorum, which can halt changes within a Kubernetes cluster. The article outlines how to monitor etcd using its built-in metrics endpoint accessible via the client port, requiring appropriate certificates for access. It details setting up Prometheus to scrape these metrics and highlights key metrics to monitor, including node availability, leader status, proposal handling, disk performance, and network latency. By properly monitoring these metrics, users can ensure the stability and performance of their Kubernetes clusters. The article also introduces the Sysdig Monitor tool as a resource for accelerating monitoring and troubleshooting processes.

Kernel parameters, essential for controlling the behavior of Linux and Unix-like operating systems, can be opaque and intimidating due to their sheer number and complexity, with around 2,000 parameters affecting aspects such as memory, networking, and filesystems. These parameters are stored in the filesystem under /proc/sys/ and can be managed using the sysctl utility. While some parameters are benign, others can significantly impact system security, necessitating careful monitoring to detect unauthorized changes. Tools like Falco can help track modifications to sensitive parameters, providing alerts for potential security breaches. By understanding and managing these parameters effectively, system administrators can enhance the security and functionality of their environments.

Dropbox experienced a significant security breach on November 1, 2022, when attackers accessed more than 130 code repositories by exploiting a Dropbox employee's GitHub credentials obtained through a sophisticated phishing attack. The attackers impersonated CircleCI to trick the employee into divulging their credentials, highlighting the ongoing threat of phishing campaigns. To combat similar incidents, the open-source tool Falco, a cloud-native runtime security project, can be extended with a GitHub plugin to enhance security by monitoring for suspicious activities, such as unauthorized access, secret leaks, and crypto mining operations within GitHub repositories. Falco uses plugins to set up webhooks and analyze messages, providing alerts in real time for potential security breaches. This approach helps organizations mitigate risks by detecting unauthorized actions, such as adding or removing collaborators, changing repository visibility, and executing malicious code through GitHub Actions. The customizable nature of Falco's ruleset allows for rapid adaptation to emerging threats, offering a proactive defense mechanism in the constantly evolving landscape of cybersecurity threats.

On November 1, 2022, two high-severity vulnerabilities in OpenSSL v3, identified as CVE-2022-3602 and CVE-2022-3786, were disclosed, affecting all versions up to 3.0.6, with fixes included in version 3.0.7. While initially rated as critical, the severity of CVE-2022-3602 was downgraded to high after testing revealed it was not easily exploitable on common platforms. These vulnerabilities involve stack-based buffer overflows in X.509 certificate verification and can potentially lead to denial of service, although remote code execution is unlikely. Organizations are advised to identify and prioritize vulnerable workloads, remediate threats by updating OpenSSL, and utilize tools like Sysdig Secure for continuous monitoring and threat detection. Despite the vulnerabilities not being as severe as Heartbleed, proactive patching and vulnerability management remain crucial to prevent exploitation, with Sysdig offering enhanced capabilities through its Falco-based threat detection and response tools.