May 2024 Summaries

In the May 2024 update of Sysdig, key developments include the introduction of Falco Feeds, which provides continuously updated security rules, and the unveiling of the Runtime Insights Partner Ecosystem to address active cloud risks. The Sysdig Threat Research Team has been active in identifying new security threats, such as the RUBYCARP botnet and LLMjacking, which exploit large language models. Enhancements to Sysdig's vulnerability management now allow administrators to define RBAC roles, while product updates such as Sysdig CLI Scanner V1.10.0 and new features in Sysdig Agents offer improved functionality and support for platforms like Suse Linux. Additional updates include new tools like the Sysdig Secure Jenkins Plugin and Prometheus Integration, as well as resources such as webinars, training labs, and blog posts focusing on cloud security strategies and artificial intelligence governance. These updates reflect Sysdig's ongoing commitment to enhancing cloud and container security through innovative tools and collaborative ecosystems.

In March 2024, the Sysdig Threat Research Team identified a DDoS-as-a-Service botnet named RebirthLtd, which operates primarily through a domain linked to the Mirai malware family and targets the video gaming community. The botnet is marketed via Telegram and an online store, offering services to disrupt gaming servers for financial gain, often affecting video game streamers. The RebirthLtd botnet, which has been active since its Telegram advertisement in early 2024, sells various packages that range in price and features, such as API access and the number of attacks per second. The botnet's infrastructure includes multiple attack methods like TCP and UDP floods, and it is closely monitored by a DDoS tracking site, Tumult.network. Attribution of the botnet's operators points to individuals using pseudonyms like "CazzG" and "Docx69," with connections to other botnets like estresse.pro and Tsuki. The Rebirth botnet has evolved from previous malware families, including Gafgyt, QBot, and STDBot, and continues to pose a threat by exploiting vulnerabilities in IoT devices. Detection and prevention of such threats emphasize the importance of maintaining security hygiene and deploying real-time threat detection systems.

The Gartner Security and Risk Management Summit is highlighted as a favorite annual conference, offering a rich learning and networking environment for attendees from diverse roles, including technical and leadership positions. The event features keynotes crafted by top analysts, one-on-one analyst meetings, and a variety of talks designed to push attendees out of their comfort zones and provide new perspectives. Networking is emphasized as a crucial component, with opportunities to connect with both vendors and end-users, while the expo provides insights into evolving vendor offerings. The author recommends attending sessions that cover career advancement, cyber risk management, cloud security, and emerging technologies, and encourages participation in the Technical Insights track for its high-quality thought leadership and practical advice.

Cybersecurity leaders must ensure transparency and resilience in their security processes to address the growing number of regulatory requirements, with a strong focus on risk management programs. Sysdig's Practical Cloud Security Guidance emphasizes the importance of documenting and configuring processes to enhance risk management transparency and improve security program resiliency. This includes the timely identification and documentation of security events, information sharing among organizations, and the implementation of Coordinated Vulnerability Disclosure (CVD) practices. The guide also highlights the adoption of "as code" approaches like Infrastructure as Code (IaC), Policy as Code (PaC), and Detection as Code (DaC) to translate complex risk management policies into enforceable rules, ensuring consistency and compliance across environments. Additionally, maintaining secure supply chains through private repositories and comprehensive Bills of Materials (BOMs) is crucial for mitigating risks and enhancing security. Policy guardrails and drift control mechanisms are recommended to maintain secure configurations and prevent vulnerabilities, while continuous improvement and collaboration are necessary to meet compliance requirements and ensure service resilience.

In the context of Kubernetes, managing network traffic analysis is challenging due to the transient nature of containers and the abstraction layers inherent in the system. Traditional tools like Wireshark struggle with these complexities, often resulting in excessive irrelevant data capture. The integration of Falco, a cloud-native detection engine, with Wireshark's terminal version, tshark, through Falco Talon, offers a solution by leveraging Kubernetes-specific context to initiate targeted, real-time packet captures. This approach reduces data noise and enhances the precision of security incident responses by focusing on information pertinent to detected threats. Notably, this strategy not only streamlines Digital Forensics & Incident Response (DFIR) efforts but also aids in maintaining regulatory compliance by capturing context-specific data. The collaboration between Falco and Wireshark demonstrates the potential for open-source software to meet modern security demands, with the possibility of extending this method beyond Kubernetes to other systems like IoT devices and edge computing in the future.

As the global adoption of artificial intelligence (AI) grows, nations are racing to establish governance frameworks that ensure the safe, ethical, and private use of AI technologies. Various countries are taking unique approaches to AI regulation, as seen with China's emphasis on AI development and ethical standards, Singapore's actionable Model AI Governance Framework, Canada's Directive on Automated Decision-Making, and the United States’ National AI Initiative Act focusing on national strategy and technical standards. The European Union is developing one of the most comprehensive AI Acts, categorizing AI systems by risk levels and enforcing binding regulations with significant penalties for violations. The United Kingdom's evolving proposal aims for an innovation-friendly framework with high safety standards, while India focuses on public education about AI through its AI for All initiative. These efforts highlight a global trend toward developing secure and ethical AI frameworks to address the opportunities and challenges AI presents, emphasizing the importance of governance to protect citizens from potential high-risk AI applications.

Mend.io and Sysdig have launched a collaborative solution aimed at enhancing secure software delivery by integrating runtime insights and application ownership context, presented at the RSA Conference 2024. This joint effort addresses the challenge of managing increasing vulnerabilities in cloud-native environments, including containers and Kubernetes, by offering risk-based vulnerability prioritization and remediation across development and production stages. By combining Mend.io's expertise in application security with Sysdig's real-time runtime security capabilities, the integration provides developers and security teams with actionable insights to prioritize and remediate critical vulnerabilities effectively. The partnership underscores the importance of both "Shift Left" and "Shield Right" strategies, offering end-to-end security by detecting threats in real-time and hardening security postures against potential attacks. As the demand for cloud applications grows, this integration aims to streamline vulnerability management, expedite response times, and enhance automated security workflows, thereby empowering teams to focus on innovation while maintaining robust security measures.

LLMjacking is a newly observed form of cyberattack where stolen cloud credentials are used to target large language model (LLM) services hosted by cloud providers, with the intent to sell LLM access to other cybercriminals while the original cloud account owner incurs the costs. The attack was facilitated through vulnerabilities in systems like Laravel and involved accessing multiple LLM services, including AWS Bedrock and Azure, without running legitimate queries during the verification phase. By exploiting these credentials, attackers can accumulate significant charges, potentially up to $46,000 per day, while also preventing the legitimate use of these models by the compromised organization. The attack demonstrated a strategic use of seemingly legitimate API requests to test the limits of access without immediate detection, employing tools like reverse proxies to manage access across compromised accounts. Effective detection and prevention strategies include robust vulnerability management, secrets management, and detailed monitoring of cloud activities to identify suspicious behavior early and secure cloud environments from such threats.

The Runtime Insights Partner Ecosystem, launched by Sysdig, aims to enhance cloud security by fostering collaboration and integration among industry-leading cybersecurity solutions. By focusing on sharing valuable insights, this initiative helps users improve vulnerability and posture management, and cloud detection and response, enabling them to prioritize risk, automate workflows, and ensure compliance efficiently. Centered on runtime visibility and leveraging Falco open source technology, the ecosystem enriches various security domains such as AppSec, threat detection, and incident response with real-time intel. Notable partners like Checkmarx, Cybereason, Docker Scout, and Google Chronicle contribute to this collaborative effort, offering expertise across diverse security domains and enhancing the ability to defend against cloud threats from development to deployment. The partnerships not only augment Sysdig's capabilities but also provide critical data sources that aid in detecting threats across multiple domains, ultimately empowering organizations to proactively safeguard their cloud environments.