Docker malware is now common, so devs need to take Docker security seriously

guest · Dec 2, 2020

Docker malware is now common, so devs need to take Docker security seriously
November 30, 2020
https://www.zdnet.com/article/docke...-devs-need-to-take-docker-security-seriously/

Towards the end of 2017, there was a major shift in the malware scene. As cloud-based technologies became more popular, cybercrime gangs also began targeting Docker and Kubernetes systems.

Most of these attacks followed a very simple pattern where threat actors scanned for misconfigured systems that had admin interfaces exposed online in order to take over servers and deploy cryptocurrency-mining malware.
The most common of these mistakes is leaving Docker remote administration API endpoints exposed online without authentication.
Click to expand...

Over the past years, malware like Doki, Ngrok, Kinsing (H2miner), XORDDOS, AESDDOS, Team TNT, Xanthe, and others, have scanned for Docker servers that left the Docker management API exposed online and then abused it to deploy malicious OS images to plant backdoors or install cryptocurrency miners.

The latest of these malware strains was discovered last week by Chinese security firm Qihoo 360. Named Blackrota, this is a backdoor trojan that is basically a simplified version of the CarbonStrike beacon implemented in the Go programming language.
Only a Linux version was discovered until now, and it is unclear how this malware is being used.
Click to expand...

With Docker gaining a more prominent place in modern-day infrastructure setup, with attacks on the rise, and with the number of malware strains that target Docker systems growing by the month, it's time that developers took Docker security seriously.
Click to expand...

Log in or Sign up

Docker malware is now common, so devs need to take Docker security seriously

guest Guest

Log in or Sign up

Docker malware is now common, so devs need to take Docker security seriously

guest Guest

Useful Searches