Feb 01, 2024NewsroomCryptojacking / Linux Security

Exposed Docker API endpoints over the internet are under assault from a sophisticated cryptojacking campaign called Commando Cat.

“The campaign deploys a benign container generated using the Commando project,” Cado security researchers Nate Bill and Matt Muir said in a new report published today. “The attacker escapes this container and runs multiple payloads on the Docker host.”

The campaign is believed to have been active since the start of 2024, making it the second such campaign to be discovered in as many months. In mid-January, the cloud security firm also shed light on another activity cluster that targets vulnerable Docker hosts to deploy XMRig cryptocurrency miner as well as the 9Hits Viewer software.

Commando Cat employs Docker as an initial access vector to deliver a collection of interdependent payloads from an actor-controlled server that is responsible for registering persistence, backdooring the host, exfiltrating cloud service provider (CSP) credentials, and launching the miner.

The foothold obtained by breaching susceptible Docker instances is subsequently abused to deploy a harmless container using the Commando open-source tool and execute a malicious command that allows it to escape the confines of the container via the chroot command.

It also runs a series of checks to determine if services named “sys-kernel-debugger,” “gsc,” “c3pool_miner,” and “dockercache” are active on the compromised system, and proceeds to the next stage only if this step passes.

“The purpose of the check for sys-kernel-debugger is unclear – this service is not used anywhere in the malware, nor is it part of Linux,” the researchers said. “It is possible that the service is part of another campaign that the attacker does not want to compete with.”

The succeeding phase entails dropping additional payloads from the command-and-control (C2) server, including a shell script backdoor (user.sh) that’s capable of adding an SSH key to the ~/.ssh/authorized_keys file and creating a rogue user named “games” with an attacker-known password and including it in the /etc/sudoers file.

Also delivered in a similar manner are three more shell scripts – tshd.sh, gsc.sh, aws.sh – which are designed to drop Tiny SHell and an improvised version of netcat called gs-netcat, and exfiltrate credentials

The threat actors “run a command on the cmd.cat/chattr container that retrieves the payload from their own C2 infrastructure,” Muir told The Hacker News, noting this is achieved by using curl or wget and piping the resulting payload directly into the bash command shell.

“Instead of using /tmp, [gsc.sh] also uses /dev/shm instead, which acts as a temporary file store but memory backed instead,” the researchers said. “It is possible that this is an evasion mechanism, as it is much more common for malware to use /tmp.”

“This also results in the artifacts not touching the disk, making forensics somewhat harder. This technique has been used before in BPFdoor – a high profile Linux campaign.”

The attack culminates in the deployment of another payload that’s delivered directly as a Base64-encoded script as opposed to being retrieved from the C2 server, which, in turn, drops the XMRig cryptocurrency miner but not before eliminating competing miner processes from the infected machine.

The exact origins of the threat actor behind Commando Cat are currently unclear, although the shell scripts and the C2 IP address have been observed to overlap with those linked to cryptojacking groups like TeamTNT in the past, raising the possibility that it may be a copycat group.

“The malware functions as a credential stealer, highly stealthy backdoor, and cryptocurrency miner all in one,” the researchers said. “This makes it versatile and able to extract as much value from infected machines as possible.”

Jan 18, 2024NewsroomSupply Chain Attacks / AI Security

Continuous integration and continuous delivery (CI/CD) misconfigurations discovered in the open-source TensorFlow machine learning framework could have been exploited to orchestrate supply chain attacks.

The misconfigurations could be abused by an attacker to “conduct a supply chain compromise of TensorFlow releases on GitHub and PyPi by compromising TensorFlow’s build agents via a malicious pull request,” Praetorian researchers Adnan Khan and John Stawinski said in a report published this week.

Successful exploitation of these issues could permit an external attacker to upload malicious releases to the GitHub repository, gain remote code execution on the self-hosted GitHub runner, and even retrieve a GitHub Personal Access Token (PAT) for the tensorflow-jenkins user.

TensorFlow uses GitHub Actions to automate the software build, test, and deployment pipeline. Runners, which refer to machines that execute jobs in a GitHub Actions workflow, can be either self-hosted or hosted by GitHub.

“We recommend that you only use self-hosted runners with private repositories,” GitHub notes in its documentation. “This is because forks of your public repository can potentially run dangerous code on your self-hosted runner machine by creating a pull request that executes the code in a workflow.”

Put differently, this allows any contributor to execute arbitrary code on the self-hosted runner by submitting a malicious pull request.

This, however, does not pose any security concern with GitHub-hosted runners, as each runner is ephemeral and is a clean, isolated virtual machine that’s destroyed at the end of the job execution.

Praetorian said it was able to identify TensorFlow workflows that were executed on self-hosted runners, subsequently finding fork pull requests from previous contributors that automatically triggered the appropriate CI/CD workflows without requiring approval.

An adversary looking to trojanize a target repository could, therefore, fix a typo or make a small but legitimate code change, create a pull request for it, and then wait until the pull request is merged in order to become a contributor. This would then enable them to execute code on the runner sans raising any red flag by creating a rogue pull request.

Further examination of the workflow logs revealed that the self-hosted runner was not only non-ephemeral (thus opening the door for persistence), but also that the GITHUB_TOKEN permissions associated with the workflow came with extensive write permissions.

“Because the GITHUB_TOKEN had the Contents:write permission, it could upload releases to https://github[.]com/tensorflow/tensorflow/releases/,” the researchers said. “An attacker that compromised one of these `GITHUB_TOKEN’s could add their own files to the Release Assets.”

On top of that, the contents:write permissions could be weaponized to push code directly to the TensorFlow repository by covertly injecting the malicious code into a feature branch and getting it merged into the main branch.

That’s not all. A threat actor could steal the AWS_PYPI_ACCOUNT_TOKEN used in the release workflow to authenticate to the Python Package Index (PyPI) registry and upload a malicious Python .whl file, effectively poisoning the package.

“An attacker could also use the GITHUB_TOKEN’s permissions to compromise the JENKINS_TOKEN repository secret, even though this secret was not used within workflows that ran on the self-hosted runners,” the researchers said.

Following responsible disclosure on August 1, 2023, the shortcomings were addressed by the project maintainers as of December 20, 2023, by requiring approval for workflows submitted from all fork pull requests and by changing the GITHUB_TOKEN permissions to read-only for workflows that ran on self-hosted runners.

“Similar CI/CD attacks are on the rise as more organizations automate their CI/CD processes,” the researchers said.

“AI/ML companies are particularly vulnerable as many of their workflows require significant compute power that isn’t available in GitHub-hosted runners, thus the prevalence of self-hosted runners.”

The disclosure comes as both researchers revealed that several public GitHub repositories, including those associated with Chia Networks, Microsoft DeepSpeed, and PyTorch, are susceptible to malicious code injection via self-hosted GitHub Actions runners.

Picture this: you stumble upon a concealed secret within your company’s source code. Instantly, a wave of panic hits as you grasp the possible consequences. This one hidden secret has the power to pave the way for unauthorized entry, data breaches, and a damaged reputation. Understanding the secret is just the beginning; swift and resolute action becomes imperative. However, lacking the necessary context, you’re left pondering the optimal steps to take. What’s the right path forward in this situation?

Secrets management is an essential aspect of any organization’s security strategy. In a world where breaches are increasingly common, managing sensitive information such as API keys, credentials, and tokens can make all the difference. Secret scanners play a role in identifying exposed secrets within source code, but they have one significant limitation: they don’t provide context. And without context, it’s impossible to devise an appropriate response plan.

Context and Response: Key factors in addressing exposed secrets

When it comes to addressing exposed secrets, context is everything as you are the guardian of your secrets. Without it, you don’t know the severity of the exposure, the potential impact, and the best course of action.

Here are some key factors to consider when contextualizing exposed secrets:

1 — Classify secrets based on sensitivity and importance

Not all secrets are created equal. Some are more critical to your organization’s security than others. Classifying your secrets based on their sensitivity and importance will help you prioritize which ones need immediate attention and remediation.

2 — Understand the scope of exposure and potential impact

Once you’ve classified the exposed secret, it’s crucial to assess the scope of the exposure. Has the secret been leaked to a public repository/darknet, or is it still in your internal systems? Understanding the extent of the exposure will help you determine the potential impact and risk on your organization and help create your response plan.

3 — Identify the root cause of the exposure

Getting to the exposure’s root cause is essential for an exposed secrets remediation process, and to prevent future attacks. By identifying how the secret was exposed, you can take steps to address the underlying issue- preventing similar incidents from occurring in the future. This could involve updating security policies, improving code review processes, or implementing additional access controls.

4 — Secrets enrichment

Secrets, while seemingly meaningless strings of characters, carry significant metadata. This includes ownership details, creation, rotation timestamps, assigned privileges for cloud service access, associated risks, and much more. Entro uses this wealth of information to construct a dynamic threat model or a secret lineage map that illustrates the connections between applications or compute workloads, the secrets they employ, and the cloud services they access — thus providing a comprehensive view of each secret’s security and compliance status.

Remediation and Prevention: Securing your organization’s Secrets

Addressing exposed secrets requires a process of remediation and prevention. Here’s how you can secure your organization’s secrets effectively:

1 — Mitigate the impact of exposed secrets:

Take swift action to mitigate the potential harm stemming from the revealed secret. This could entail changing or invalidating the compromised secret, reaching out to impacted parties, and vigilantly observing for any unusual or suspicious behavior due to the disclosure. In certain cases, it might be necessary to engage law enforcement or seek assistance from external security experts.

2 — Implement policies and processes to prevent future exposures:

Learn from the exposure and take steps to prevent similar incidents. This might include crafting or revising your company’s security protocols, adopting secure development methodologies, and educating staff on effectively managing confidential data. It’s also crucial to regularly audit your secrets management processes to ensure compliance and effectiveness.

3 — Regular monitoring and auditing of secrets:

Monitoring your organization’s secrets is vital in identifying potential exposures and mitigating risks. Implementing automated tools and processes to monitor and audit secrets will help you keep track of sensitive information, detect anomalies, and trigger alerts for any unauthorized access or changes.

Leveraging technology for effective secrets management

As your organization grows, managing secrets manually becomes increasingly complex and error-prone. Leveraging technology can significantly enhance your secrets management strategy.

1 — Embrace automation:

Automation can help streamline the process of managing exposed secrets, providing you with faster detection, classification, and response capabilities. Look for tools that integrate with your existing security workflows, reducing the need for manual intervention. Through its auto-discovery process, Entro can identify the owner of each secret or token, automate resolution procedures, and detect misconfigurations in vaults and secrets stores, ensuring a faster response to security incidents.

2 — Platforms that provide essential context:

Some advanced secrets management platforms go beyond simple scanning, offering valuable context that can help you respond more effectively to exposed secrets. Entro is one such platform, and very uniquely so since it goes above and beyond to create the most comprehensive secret lineage maps to provide valuable context, enabling a more effective response to exposed secrets.

3 — Integration with existing tools:

Ensure your chosen technology can easily integrate with your existing security tools and workflows. Seamless integration will help you maintain a consistent security posture across your organization and maximize your current investments in security solutions.

Conclusion

Effectively handling exposed secrets is crucial for protecting your company’s confidential data and maintaining trust among stakeholders. Recognizing the significance of context in dealing with revealed secrets empowers you to make informed choices regarding fixing and preventing issues. Integrating technology and a strong approach to managing secrets into your workflow enhances your organization’s security posture, minimizing the chances of unauthorized entry and data breaches.

Appreciating this pivotal aspect of cybersecurity, it becomes clear that it’s not merely about awareness but also action. This is where solutions like Entro come into play. Specifically designed to tackle the challenges we’ve explored, Entro offers a comprehensive approach to secrets management that transcends basic scanning. It provides the crucial context needed for effective remediation and prevention. It creates a dynamic threat model map using this context, thus positioning your organization a step ahead in the face of security threats

Protecting your organization’s sensitive data is too critical to be left to chance. As such, it’s time to harness the power of proactive and strategic management of exposed secrets. Check out our use cases to explore how Entro can empower you to strengthen your organization’s security posture.

Book a demo to learn more about Entro and how it can benefit your organization.