Oktacron - Cyber Security RSS Feeds History

Full list of containerization defenses | Kaspersky official blog

kaspersky Oct 17, 2023 Business

Today, some form of virtualization or containerization can be found in almost all large IT solutions. Containers provide a host of benefits during system development, installation, maintenance, and use. They promote faster development, cost savings, and conservation of other resources. At the same time, many security show more ...

solutions that work on physical and virtual servers are not directly applicable to containers. What risks should companies consider when implementing containerization, and what measures are needed to protect container infrastructure? Benefits of containerization in development and operation A container is an isolated environment for running a single application created by OS kernel-level tools. The container image includes both the application and required settings and auxiliary components, making it very convenient for developers to pack everything they need into the container. Those using such a container find it much easier to operate than old-fashioned infrastructure. Whats more, isolation greatly reduces the influence of containerized applications on each other. In a container infrastructure, therefore, there are fewer causes for failures, while at the same theres more controllability for administrators. Containerization is a lighter technology than virtualization: containers dont emulate hardware, and theres no need to supply the entire contents of the virtual machine — in particular the guest OS. In many cases, containerized workloads are easier to scale. Without a doubt, the most common tool for creating and storing container images is Docker, while container workload orchestration is most often implemented with Kubernetes, Docker Swarm, or Red Hat OpenShift. Containerization has become a key part of modern IT development approaches. Many applications are developed in a microservice architecture: individual features of a large application are allocated to microservices that communicate with other parts of the application through APIs. An example is a video player within a social network or an online stores payment process. These microservices are often delivered as containers, allowing developers to have their own development and delivery cycle. Containers dovetail perfectly with the CI/CD (continuous integration/continuous delivery) modern methodology, so application updates get released more quickly and with reduced quantities of bugs. This approach envisages a short development cycle, teams working in parallel on the same code, and automation of routine actions. Containerization in a CI/CD pipeline also improves the efficiency of the pipeline: the CI/CD system uses container images as templates and delivers the build as a ready-to-deploy image. The key point is that updates are delivered in the form of new images — rather than deployed inside an existing and operational container. This speeds up the preparation and debugging of the release, lessens the requirements for the infrastructure of both the developer and customer, improves operational stability, and makes the application easier to scale. By properly integrating container security requirements into development and build processes, a company takes a big stride toward full implementation of DevSecOps. Core threats in container infrastructure The host system, containerization environments, and containerized applications are all susceptible to most of the typical information security risks, such as vulnerabilities in components, insecure settings and the like. Malicious actors are already actively exploiting all of the above. For example, 1650 container images with malware were found in the public Docker Hub repository. In a similar case, malicious images went undetected for around a year. There are known malicious campaigns that use the Docker API to create malicious containers on targeted systems, disable monitoring systems, and engage in mining. In another attack, threat actors went after Kubernetes clusters with misconfigured PostgreSQL. Another common problem is that outdated container images harboring known vulnerabilities like Log4shell can be stored in repositories for quite some time. Also, developers regularly leave behind API keys and other secrets in containers. Systematizing the threats to each element in the containerization system, we get this somewhat simplified scheme: Images Image registry Orchestrator Containers Host OS Use of untrusted images Unsecured connection Unrestricted administrative access Runtime environment vulnerabilities Shared OS kernel for all containers Software vulnerabilities Outdated images with vulnerabilities Unauthorized access Unrestricted network access OS component vulnerabilities Configuration errors Insufficient authentication and authorization Lack of isolation and inspection of inter-container traffic Insecure runtime configuration Incorrect user permissions Malware Â No separation of containers with different levels of data sensitivity across hosts Application vulnerabilities in containers File system accessible from containers Secrets in plaintext Â Orchestrator configuration errors Rogue containers in the runtime environment Â Containers and protection using traditional security tools Many defenses that have worked well for virtual machines cannot be applied to container security. Its usually not possible to run an EDR agent inside a container, as in a virtual machine. Moreover, what happens in the container is not fully available for analysis by conventional security systems on the host system. Therefore, detecting, for example, vulnerable and malicious software inside the container is problematic, as is applying protection tools such as WAF in containerized applications. Traffic between containers is often carried over a virtual network at the orchestrator level and might not be accessible to network security tools. Even on the host OS, an unadapted protection agent can lead to degradation of the performance or stability of deployed containerized applications. Cluster security must be provided at the host level in line with the particular orchestration environment and the nature of the container workloads. There are also specific issues that must be addressed for container environments — like preventing untrusted containers from running, searching for secrets in containers, and restricting network traffic for each specific container based on its functions. All this is only available in specialized solutions such as Kaspersky Container Security. What about protection with native tools? All key containerization vendors appear to be working hard to improve the security of their products. Native Kubernetes tools, for example, can be used to configure resource quotas and logging policies, as well as implement RBAC (role-based access control) with the least-privilege principle. All the same, there are entire classes of information security tasks that cannot be solved with native tools — such as monitoring processes inside a running container, vulnerability analysis, checking compliance with information security policies and best practices, and much more. But above all, a mature and full-fledged container security system needs to ensure protection at the early stages of containerization: development, delivery, and storage. To achieve this, containerization security has to be built into the development process and integrated with developer tools. How container protection becomes part of DevSecOps The DevOps approach has evolved into DevSecOps due to the ever-increasing demands for application reliability and security. To make security an organic part of development, core information security requirements are automatically checked at all phases of application preparation and delivery wherever possible. Container environments facilitate this. Planning phase: securing VCS and registry operations. Early in the development cycle, software developers select the components, including containerized ones, to be deployed in the application. The security system must scan registry images for up-to-dateness, and analyze configuration files (IaC — in particular, Dockerfile) for errors and insecure settings. Base images used in development need to be scanned for vulnerabilities, malware, secrets, and the like. By doing so, developers significantly reduce the risks of supply-chain compromise. Build and test phase: securing continuous integration operations. In this phase, its necessary to ensure that no secrets, vulnerable versions of libraries, or malware have gotten into the image, and that all information security aspects that can be analyzed comply with the requirements of regulators and the company itself. An application build cannot be completed successfully if there are violated policies. This is done by integrating the container security system with a CI/CD platform, be it Jenkins, Gitlab, or CircleCI. Along with static and dynamic testing of application security (AppSec), this measure is what distinguishes DevSecOps from other development approaches. Delivery and deployment phase: security at the Continuous Delivery level. Images made operational need to be scanned for both integrity and full compliance with adopted policies. If the situation warrants an exception (for example, a vulnerability is published but not yet patched), it must always be documented and time-limited. Operation phase: protecting the orchestrator and running containers. Startup and operation control of containers. This phase minimizes the risks associated with vulnerabilities in the runtime environment or its misconfiguration. More importantly, only here is it possible to detect various anomalies in application operation, such as excessive computational load or unexpected communications with other containers and the network as a whole. This step also monitors the secure customization of the orchestrator itself, and also access to it. For container security, native operation with the Kubernetes or OpenShift orchestrator is critical here. At the same time, the host OS itself must not be left unprotected. To operate at these stages, the container security system itself must be multi-component. The illustration shows the core elements of Kaspersky Container Security and their relationship with the containerization platform and the CI/CD platform. What protection measures to take for each container environment component? Lets look at a more detailed list of protection measures that must be applied to each component in the containerization system to describe its security as comprehensive. Images Image registry Orchestrator Containers Host OS Vulnerability assessment Registry integration and image scanning Detection of configuration errors and recommended fixes Startup and operation control of trusted containers only Detection of configuration errors and recommended fixes Scanning for image configuration errors Closed list — usage of only approved and up-to-date images Visualization of resources in the cluster Container integrity monitoring Security risk mitigation through container startup control Scanning for malware Search for incorrect configurations and access settings Detection and scanning of images in the cluster (search for unaccounted containers) Startup control of applications and services inside containers Adapted OS version to minimize attack surface Search for secrets Â Â Container traffic monitoring Â Risk assessment and identification of potentially dangerous images Â Â Minimization of container privileges Â Â Â Â Grouping of containers on hosts by risk/importance level Â The central element of the security system is the in-depth scanning of images. The security system needs to integrate with key registries (such as DockerHub, GitLab Registry, or JFrog Artifactory), both public and corporate, and regularly scan used images in accordance with company policies. Each scan on the list is important in itself, but the risk profile and specifics of applications vary from company to company, so it may be possible, for example, to allow the use of images with low-criticality vulnerabilities. Also, depending on the security policies in place, CIS Kubernetes recommendations or various vulnerability databases, for instance, may be key. Container images that fail scanning are either simply flagged for administrators, or blocked in later development and deployment phases. The second, equally important and specific, group of protection tools operates at the container deployment and startup stage. First of all, containers that do not comply with policies and are not included in the trusted lists are prevented from running. Runtime environment protection is incomplete without inspecting the orchestrator itself. This helps identify configuration errors, non-compliance with security policies, and unauthorized attempts to modify the configuration. Once the containers are running, monitoring orchestrator activity makes it possible to detect and halt suspicious activity both within and between clusters. Some tasks from the matrix cannot be delegated to a security solution of any kind at all. These include the initial choice of a secure and minimalist OS build specially adapted for running container workloads, plus the crucial task of container grouping. For proper layered protection and convenient management, running containers need to be grouped on hosts so that information with certain security requirements is processed separately from information with lower security requirements. The implementation here depends on the orchestrator in use, but in any case, its primarily an exercise in risk assessment and threat modeling. Generally, there are numerous container protection tasks, and trying to solve each of them in isolation, with ones own tools or a manual configuration, would cause costs to soar. Hence, medium and large container environments require holistic security solutions that are deeply integrated with the containerization platform, the CI/CD pipeline, and the information security tools used in the company. The job of information security experts is simplified by: integration with SIEM and channels for notifying about issues detected; regular automatic scanning of all images against an updated vulnerability database (such as NVD); functionality for temporary acceptance of information security risks; and detailed logging of administrative events in the containerization environment-protection system. How Kaspersky Container Security implements protection Our comprehensive solution protects container infrastructure by design: its components secure the entire lifecycle of containerized applications — from development to day-to-day operation. The dedicated scanner works with container images and provides static protection; the KCS agent running as a separate container under orchestrator control protects hosts in the runtime environment and the orchestration environment as a whole. Concurrently, the central component of Kaspersky Container Security integrates these parts and provides a management interface. The high-performance platform offers robust protection for K8s clusters with hundreds of nodes. The first version of Kaspersky Container Security, which implements core protection for container environments, is already available. And we are committed to developing the product and extending its functionality going forward.

Tech CEO Sentenced to 5 Years in IP Address Scheme

krebsonsecurity Oct 17, 2023 Ne'er-Do-Well News

Amir Golestan, the 40-year-old CEO of the Charleston, S.C. based technology company Micfo LLC, has been sentenced to five years in prison for wire fraud. Golestan’s sentencing comes nearly two years after he pleaded guilty to using an elaborate network of phony companies to secure more than 735,000 Internet show more ...

Protocol (IP) addresses from the American Registry for Internet Numbers (ARIN), the nonprofit which oversees IP addresses assigned to entities in the U.S., Canada, and parts of the Caribbean. Amir Golestan, the former CEO of Micfo. In 2018, ARIN sued Golestan and Micfo, alleging they had obtained hundreds of thousands of IP addresses under false pretenses. ARIN and Micfo settled that dispute in arbitration, with Micfo returning most of the addresses that it hadn’t already sold. ARIN’s civil case caught the attention of federal prosecutors in South Carolina, who in May 2019 filed criminal wire fraud charges against Golestan, alleging he’d orchestrated a network of shell companies and fake identities to prevent ARIN from knowing the addresses were all going to the same buyer. Prosecutors showed that each of those shell companies involved the production of notarized affidavits in the names of people who didn’t exist. As a result, the government was able to charge Golestan with 20 counts of wire fraud — one for each payment made by the phony companies that bought the IP addresses from ARIN. Golestan initially sought to fight those charges. But on just the second day of his trial in November 2021, Golestan changed his mind and pleaded guilty to 20 counts of wire fraud in connection with the phantom companies he used to secure the IP addresses. Prosecutors estimated those addresses were valued at between $10 million and $14 million. ARIN says the 5-year sentence handed down by the South Carolina judge “sends an important message of deterrence to other parties contemplating fraudulent schemes to obtain or transfer Internet resources.” “Those who seek to defraud ARIN (or other Regional Internet Registries) are subject to costly and serious civil litigation, criminal charges, and, ultimately, a lengthy term of incarceration,” reads a statement from ARIN on Golestan’s sentencing. By 2013, a number of Micfo’s customers had landed on the radar of Spamhaus, a group that many network operators rely upon to stem the tide of junk email. Shortly after Spamhaus started blocking Micfo’s IP address ranges, Micfo shifted gears and began reselling IP addresses mainly to companies marketing “virtual private networking” or VPN services that help customers hide their real IP addresses online. Golestan did not respond to a request for comment. But in a 2020 interview with KrebsOnSecurity, Golestan claimed that Micfo was at one point responsible for brokering roughly 40 percent of the IP addresses used by the world’s largest VPN providers. Throughout that conversation, Golestan maintained his innocence, even as he explained that the creation of the phony companies was necessary to prevent entities like Spamhaus from interfering with his business going forward. There are fewer than four billion so-called “Internet Protocol version 4” or IPv4 addresses available for use, but the vast majority of them have already been allocated. The global dearth of available IP addresses has turned them into a commodity wherein each IPv4 address can fetch between $15-$25 on the open market. This has led to boom times for those engaged in the acquisition and sale of IP address blocks, but it has likewise emboldened those who specialize in absconding with and spamming from dormant IP address blocks without permission from the rightful owners. The U.S Department of Justice says Golestan will serve 60 months in prison, followed by a 2-year term of court-ordered supervision. The Micfo CEO also was ordered to pay nearly $77,000 in restitution to ARIN for its work in assisting federal prosecutors.

GitGuardian’s HasMySecretLeaked Is HaveIBeenPwned for DevOps

securityledger Oct 17, 2023 agile development

Amid a spike in attacks on software supply chains, GitGuardian launched HasMySecretLeaked.com, a site that allows developers and appsec teams to search for exposed secrets. The post GitGuardian’s HasMySecretLeaked Is HaveIBeenPwned for DevOps first appeared on The Security Ledger with Paul F. Roberts. The post show more ...

GitGuardian’s...Read the whole entry... » Related StoriesEpisode 253: DevSecOps Worst Practices With Tanya Janca of We Hack PurpleAttacks on APIs demand a Security Re-ThinkThe surveys speak: supply chain threats are freaking people out

Top 6 Mistakes in Incident Response Tabletop Exercises

darkreading Oct 17, 2023 Feed

Avoid these errors to get the greatest value from your incident response training sessions.

Amazon Quietly Wades Into the Passkey Waters

darkreading Oct 17, 2023 Feed

The move by the e-commerce kahuna to offer advanced authentication to its 300+ million users has the potential to move the needle on the technology's adoption, security experts say.

UAE, US Partner to Bolster Financial Services Cybersecurity

darkreading Oct 17, 2023 Feed

The two countries agree to share financial services information and provide cross-border training and best practices.

'Etherhiding' Blockchain Technique Masks Malicious Code in WordPress Sites

darkreading Oct 17, 2023 Feed

The ClearFake campaign uses fake browser updates to lure victims and spread RedLine, Amadey, and Lumma stealers.

Zero-Day Alert: 10K Cisco IOS XE Systems Now Compromised

darkreading Oct 17, 2023 Feed

Just a day after Cisco disclosed CVE-2023-20198, it remains unpatched, and one vendor says a Shodan scan shows at least 10,000 Cisco devices with an implant for arbitrary code execution on them. The vendor meanwhile has updated the advisory with more mitigation steps.

5 Ways Hospitals Can Help Improve Their IoT Security

darkreading Oct 17, 2023 Feed

HIPAA compliance does not equal security, as continuing attacks on healthcare organizations show. Medical devices need to be secured.

Chatbot Offers Roadmap for How to Conduct a Bio Weapons Attack

darkreading Oct 17, 2023 Feed

Once ethics guardrails are breached, generative AI and LLMs could become nearly unlimited in its capacity to enable evil acts, researchers warn.

Security Must Empower AI Developers Now

darkreading Oct 17, 2023 Feed

Enterprises need to create a secure structure for tracking, assessing, and monitoring their growing stable of AI business apps.

Watch Out: Attackers Are Hiding Malware in 'Browser Updates'

darkreading Oct 17, 2023 Feed

Updating your browser when prompted is a good practice, just make sure the notification comes from the vendor themselves.

Signal Debunks Zero-Day Vulnerability Reports, Finds No Evidence

cyware Oct 17, 2023 Trends, Reports, Analysis

The company conducted a thorough investigation and found no indication that the vulnerability is real. Signal also reached out to the US government, which provided no information to support the claim.

CISA, FBI, and MS-ISAC Warn of Threat Actors Exploiting Atlassian Confluence Flaw for Initial Access to Networks

cyware Oct 17, 2023 Threat Intel & Info Sharing

The recently disclosed flaw (CVE-2023-22515) in Atlassian Confluence Data Center and Server allows malicious actors to create unauthorized administrator accounts, leading to widespread exploitation and the need for immediate application of upgrades.

US Treasury Inks Cybersecurity Agreement With United Arab Emirates

cyware Oct 17, 2023 Govt., Critical Infrastructure

The agreement between the US and the UAE comes ahead of the International Counter Ransomware Initiative summit, where governments are expected to pledge not to pay ransoms to cybercriminals.

Unpatched Cisco Zero-Day Vulnerability Actively Targeted in the Wild

cyware Oct 17, 2023 Malware and Vulnerabilities

The vulnerability affects enterprise networking gear with the Web UI feature enabled and exposed to the internet or untrusted networks, and it is recommended to disable the HTTP server feature as a mitigation.

11 Ukrainian Telecommunications Providers Hit by Cyberattacks Using POEMGATE and POSEIDON Malware

cyware Oct 17, 2023 Breaches and Incidents

The hackers used reconnaissance techniques to identify vulnerabilities in the telecom providers' networks and gained unauthorized access using compromised servers in the Ukrainian internet segment.

Growing Concern Over Role of Hacktivism in Israel-Hamas Conflict

cyware Oct 17, 2023 Geopolitical, Terrorism

Researchers from Radware found that Israel endured 143 DDoS attacks between October 2 and October 10, making it the most targeted nation-state during that period. These attacks were all claimed by hacktivists on the messaging service Telegram.

Kansas Supreme Court Probes Potential Ransomware Attack

cyware Oct 17, 2023 Breaches and Incidents

The Kansas Supreme Court and other district courts in the state are experiencing a disruption in their IT systems due to a security incident, leading to the suspension of electronic filing of documents.

Void Rabisu Targets Women Political Leaders with New RomCom 4.0 Variant

cyware Oct 17, 2023 Breaches and Incidents

Void Rabisu has been found deploying the new RomCom 4.0 backdoor against participants of the Women Political Leaders (WPL) Summit in Brussels. According to researchers, the latest variant has undergone some significant changes in its architecture, making it lighter and stealthier. Organizations are advised to stay show more ...

protected by staying updated on the RomCom attack trends and making use of the IoCs shared by Trend Micro.

UK Appoints Neal-Hopes as Commander of National Cyber Force

cyware Oct 17, 2023 Govt., Critical Infrastructure

Air Vice-Marshal Tim Neal-Hopes has been appointed as the new commander of the United Kingdom's National Cyber Force (NCF). He joins the NCF from Strategic Command, where he served as the director for cyber, intelligence, and information integration.

Hackers Exploit Critical Flaw in WordPress Royal Elementor Plugin

cyware Oct 17, 2023 Malware and Vulnerabilities

The vendor has released a patch (version 1.3.79) to fix the flaw (CVE-2023-5360), and users are recommended to upgrade as soon as possible, but a website cleanup may be necessary to remove any infections or malicious files.

Knight Ransomware Group Claims Cyberattack on BMW Munique Motors

cyware Oct 17, 2023 Breaches and Incidents

The Knight group threatened to release stolen files and provided countdown links. However, the parent company, BMW, has not confirmed the attack. The website for BMW Munique Motors is still operational.

Multiple Vulnerabilities in South River Technologies' Titan MFT and Titan SFTP Servers Fixed

cyware Oct 17, 2023 Malware and Vulnerabilities

These include authenticated remote code execution via "zip slip" and WebDAV path traversal, session fixation on the remote administration server, information disclosure via path traversal on FTP, and information disclosure in the admin interface.

Quantum Risk is Real Now: How to Navigate the Evolving Data Harvesting Threat

cyware Oct 17, 2023 Expert Blogs and Opinion

Data transmission faces a looming threat from Harvest Now, Decrypt Later (HNDL) attacks, where encrypted data is collected and stored with the intention of decrypting it in the future using advancements in computing or quantum technologies.

Discord Still a Hotbed of Malware Activity — Now APTs Join the Fun

cyware Oct 17, 2023 Trends, Reports, Analysis

A new report by Trellix reveals that Discord, a popular communication platform, is being increasingly used by hackers, including advanced persistent threat (APT) groups, to target critical infrastructure.

Stronger Ransomware Protection Finally Pays Off

cyware Oct 17, 2023 Trends, Reports, Analysis

A recent survey by Hornetsecurity reveals that 60% of companies are highly concerned about ransomware attacks, highlighting the urgency for robust protection measures and the active involvement of leadership in preventing such incidents.

Update: Victim Count Doubles in Heart Institute Data Theft Hack

cyware Oct 17, 2023 Incident Response, Learnings

The exact reason for the significant increase in affected individuals since July is unclear, but ongoing investigation and the discovery of additional compromised locations may be contributing factors.

Lumma Stealer: A New Threat on Discord

cyware Oct 17, 2023 Breaches and Incidents

Security researchers discovered threat actors using the Discord platform to distribute Lumma Stealer, an information-stealing malware. The malware is designed to steal user credentials, cryptocurrency wallets, and browser data. Users need to exercise caution while clicking links or downloading files from unverified sources.

Researchers Warn of Increased Malware Delivery via Fake Browser Updates

cyware Oct 17, 2023 Malware and Vulnerabilities

The threat group behind the SocGholish campaigns is likely responsible for the ClearFake malware delivery campaign, which uses compromised WordPress sites to push malicious fake browser updates.

Critical Vulnerabilities Expose Weintek HMIs to Attacks

cyware Oct 17, 2023 Malware and Vulnerabilities

The US cybersecurity agency, CISA, has warned organizations about critical vulnerabilities found in a human-machine interface (HMI) product made by the Taiwan-based Weintek. The impacted product is used globally, including in critical manufacturing.

TV Advertising Sales Giant Affected by Ransomware Attack

cyware Oct 17, 2023 Breaches and Incidents

The Black Basta ransomware gang claimed responsibility for the attack, but the extent of the data stolen is unknown. The company confirmed the incident and stated that they are working with law enforcement to address the issue.

Operators Behind Worldwide Linux XorDDoS Campaign Evolve Their Attack Infrastructure

cyware Oct 17, 2023 Malware and Vulnerabilities

The attackers behind the XorDDoS campaign have migrated their offensive infrastructure to legitimate public hosting services, making it harder to block their command and control (C2) traffic.

Critical Vulnerabilities Uncovered in Open Source CasaOS Cloud Software

cyware Oct 17, 2023 Malware and Vulnerabilities

Two critical security flaws in CasaOS personal cloud software allowed attackers to bypass authentication and gain full access to the system, posing a significant cyber threat.

0-Day In Cisco IOS XE Software Is Under Attack

packetstormsecurity Oct 17, 2023 headline,hacker,flaw,cisco,zero day

Trench Tales: The College Account Takeover That Never Happened

packetstormsecurity Oct 17, 2023 headline,hacker,privacy,data loss,flaw,p

Healthcare Orgs A Prime Target For NoEscape Ransomware, HHS Warns

packetstormsecurity Oct 17, 2023 headline,malware,britain,cybercrime,cryp

MemComputing ASICs Could Shatter 2048-Bit RSA Encryption

packetstormsecurity Oct 17, 2023 headline,privacy,cryptography

AI Chatbots Could Help Plan Bioweapon Attacks, Report Finds

packetstormsecurity Oct 17, 2023 headline,botnet,terror