A crypto-mining botnet is now stealing Docker and AWS credentials

erek

erek

8-D
2FA
Joined
Dec 19, 2005
Messages
18,406
"Furthermore, Oliveira says TeamTNT has now also added a feature to collect Docker API credentials, on top of the AWS creds-stealing code.

This feature is most likely used on container platforms where the botnet infects hosts using other entry points than its original Docker API port scanning feature.

Oliveira points out that with the addition of this feature, "implementing [Docker] API authentication is not enough" and that companies should make sure Docker management APIs aren't exposed online in the first place, even when using strong passwords.

But in case the API ports have to be enabled, the Trend Micro researcher recommends that companies deploy firewalls to limit who can access the port using allow-lists."

https://www.zdnet.com/article/a-crypto-mining-botnet-is-now-stealing-docker-and-aws-credentials/
 
I wrote a rant only to calm down by the end of it, it comes down to this if you are doing security the same way you were 3 years ago then your security is garbage and you are asking to be hacked. It's not enough to protect things behind a username and password, you need port filtering paired with application ID filtering, and strict IP permission sets. No longer can you have your admin portal accessible from the outside, if you can access the admin portal then so can anybody else and it doesn't matter how good you think your username and password combination is, they will find a way around it, or to steal it.
 
Lakados said:
I wrote a rant only to calm down by the end of it, it comes down to this if you are doing security the same way you were 3 years ago then your security is garbage and you are asking to be hacked. It's not enough to protect things behind a username and password, you need port filtering paired with application ID filtering, and strict IP permission sets. No longer can you have your admin portal accessible from the outside, if you can access the admin portal then so can anybody else and it doesn't matter how good you think your username and password combination is, they will find a way around it, or to steal it.
Click to expand...
did you save the rant anywhere? just curious
 
erek said:
:(
Click to expand...
Sorry
It was a long rant about the government security audit that took my great security from 4 years ago and tore it to shreds in a matter of minutes. Then took an AI to analyze the last year of our traffic logs and developed around 1100 individual firewall rules for the outgoing traffic and 1 for the incoming, deny.
So all traffic into the building has to be initiated by somebody in the building. Then the next month was taking those 1100 rules and working them down to some 300 and properly labelling them. My next steps are DNS sinkholes for adds because they are technically user initiated, and finding a way to label the Google and Facebook tracking stuff because sweet Jesus it’s a lot. It’s all getting blocked but there is so much of it, that it drowns out any threats that may be active because it’s buried in 10’s of thousands of Google and Facebook metrics. Then I went off on them for a bit, and how I was surprised how few metrics Microsoft and Apple collect it’s not even a mentionable fraction of Facebook and Google. Which led me on a tangent about people who side load their Android phones because 99% of the time they infect them in the process. And next thing I realized I had finished 2-3 cups of coffee came back from the bathroom and found myself surprised I had to go at all because the contents of the screen in front of me were no better than what I had just left behind.
 
Exactly what I said, only completely different.
Man, I need to sideload some coffee.
 
Lakados said:
Sorry
It was a long rant about the government security audit that took my great security from 4 years ago and tore it to shreds in a matter of minutes. Then took an AI to analyze the last year of our traffic logs and developed around 1100 individual firewall rules for the outgoing traffic and 1 for the incoming, deny.
So all traffic into the building has to be initiated by somebody in the building. Then the next month was taking those 1100 rules and working them down to some 300 and properly labelling them. My next steps are DNS sinkholes for adds because they are technically user initiated, and finding a way to label the Google and Facebook tracking stuff because sweet Jesus it’s a lot. It’s all getting blocked but there is so much of it, that it drowns out any threats that may be active because it’s buried in 10’s of thousands of Google and Facebook metrics. Then I went off on them for a bit, and how I was surprised how few metrics Microsoft and Apple collect it’s not even a mentionable fraction of Facebook and Google. Which led me on a tangent about people who side load their Android phones because 99% of the time they infect them in the process. And next thing I realized I had finished 2-3 cups of coffee came back from the bathroom and found myself surprised I had to go at all because the contents of the screen in front of me were no better than what I had just left behind.
Click to expand...
KD5ZXG said:
Exactly what I said, only completely different.
Man, I need to sideload some coffee.
Click to expand...

why so much coffee? and how did 2-3 cups go down so quickly?
 
You must log in or register to reply here.
Back
Top