• Office Hours : 08:00 - 17:30

Monero miners target cloud-native development environments

Security researchers have discovered a revival in attacks against GitHub and Docker Hub to mine cryptocurrency

According to researchers at cybersecurity firm Aqua Security, in just four days, the attackers set up 92 malicious Docker Hub registries and 92 Bitbucket repositories to abuse these resources for cryptocurrency mining. Last September, the team unearthed a similar campaign that exploited automated build processes on GitHub and Docker Hub to create cryptocurrency miners.

Researchers said hackers created a continuous integration process that initiates multiple auto-build processes every hour. On each build, a Monero cryptominer is executed.

In the attack, hackers created several fake email accounts using a free Russian email service provider. They then set up a Bitbucket account with a few repositories. To evade detection, each masqueraded as a benign project using the official project documentation.

Hackers then created a Docker hub with several registries. Each registry presented itself as benign, using its documentation to evade detection. The images are built on these service providers’ environments and then hijack their resources to mine cryptocurrency.

“This campaign shows the ever-growing sophistication of attacks targeting the cloud-native stack,” says Assaf Morag of Aqua Security. “Bad actors are constantly evolving their techniques to hijack and exploit cloud compute resources for cryptocurrency mining. It also reminds us that developer environments in the cloud represent a lucrative target for attackers as usually, they are not getting the same level of security scrutiny.”

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), told ITPro that the build systems used to create software should always be secured to ensure they only process requests related to legitimate projects. 

“There are many reasons for this, but the most important of which is to ensure that what is being built is something that should be built. When build systems and build processes are moved to cloud-based systems, the risk profile for the build system now extends to the capabilities of the cloud provider as well. While major public providers of software build services, like GitHub or Docker, will have protections in place to limit client risk, as this report shows, they are not immune from attack,” Mackey said.

Mackey added that this attack pattern should serve as an opportunity for anyone operating a cloud-based build process, not just the providers of such services. 

“If there is a way for unapproved code or configuration to enter your build system, then the actions performed by your build pipelines could be under the control of an attacker. Minimally, resource consumption could grow to a point where build jobs aren’t progressing as they should – a situation that could have a direct impact on delivery schedules,” he said.

Featured Resources

Remote workforce security report

Key challenges, security threats, and investment priorities of organisations during the pandemic

Download now

On-prem storage vs. public cloud storage

Economic advantages of on-premises object storage vs. public cloud for enterprise data storage

Download now

The future of CIAM

Four trends shaping identity and access management

Download now

Realising the benefits of automated machine learning

How to overcome machine learning obstacles and start reaping the benefits

Download now

See the original article here: ITPro