Cloud

5/15/2018
05:20 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

25% of Businesses Targeted with Cryptojacking in the Cloud

New public cloud security report detects a spike in cryptojacking, mismanaged cloud storage, account takeover, and major patches getting overlooked.

It seems like only yesterday we learned about the first of many Amazon S3 bucket leaks to expose troves of personal information in 2017. Poor cloud configuration was only one security issue to plague businesses last year; now, they have several to worry about.

RedLock's second annual Cloud Security Trends report digs into lessons learned from attacks and breaches over the past year. Researchers found the top issues in the cloud are account compromises, which affected 27% of organizations, cryptojacking (25%), risky configurations (51%), and missing high-severity patches in the cloud (24%).

"Twelve months ago, in everyone's minds, the biggest thing was cloud misconfigurations, S3 buckets," says RedLock cofounder and CEO Varun Badhwar. By now, the threats have escalated.

On average, 27% of organizations experienced potential account compromise, including major companies Uber, Tesla, OneLogin, Aviva, and Gemalto. Risky configurations affected 51%; among them were FedEx, Deep Root Analytics, and Under Armour. Nearly one-quarter (24%), including Drupal, MongoDB, Elasticsearch, and Intel, missed high-severity patches in the cloud.

Cryptojacking has gone mainstream as attackers have unprecedented access to high-powered public cloud computing resources, affecting major corporations like Tesla, Gemalto, and Aviva. One-quarter of organizations had cryptojacking in their environments, compared with just 8% last year. Badhwar says activity has ramped up 300% in the last quarter, partially because the bar to enter the world of cryptomining is low and the payoff is high.

"Once the attackers are in, the ease of the cloud is really what makes it possible," he notes. "They can spin up an infinite number of resources … it's really a question of how aggressive they want to be." For some organizations, cryptomining incidents can cost between $50-100K per day, for every day an attacker is mining digital currency undetected on their network.

Researchers also noticed account compromise has led to new attack vectors. Leaked credentials have been found in GitHub repositories, unsecured Kubernetes administrative interfaces, and public Trello boards; now, public cloud instance metadata APIs are an attack vector.

"Public cloud instance metadata is data about your instance that can be used toconfigure or manage the running instance," researchers report. "Essentially, an instance's metadata can be queried via an API to obtain access credentials to the public cloud environment by any process running on the instance." Account compromise will continue to evolve, they anticipate.

There was a spot of good news in the report, Badhwar notes. One year ago, 82% of corporate databases were not encrypted. Now the number has dropped to 49%, marking a 67% improvement. However, he continues, the decline is most likely due to compliance and not because companies are becoming more security-conscious overall.

"I have to say, because this is one of those outlier trends related to improvement … I'm more inclined to say the majority is driven by the visibility and audits that GDPR is driving," he says. This isn't to say companies are excelling in compliance, however. Researchers found on average, businesses fail 30% of CIS Foundations' best practices, 50% of PCI requirements, and 23% of NIST CSF requirements.

Visibility, along with speed of innovation, are two factors causing challenges in the cloud, Badhwar adds. As organizations rapidly adopt cloud services, security teams are often left in the dark when it comes to the applications developers are putting in the cloud. The cloud provides new tools and features to developers, who want to use them right away and don't consult with security as they're building.

"When you don't have visibility, how can you do any security or policy enforcement?" Badhwar points out.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
sleveson
50%
50%
sleveson,
User Rank: Apprentice
7/6/2018 | 1:50:55 PM
Question about cryptojacking costs
Interesting article - thanks. I'm wondering where this statistic came from as I couldn't find it n the Redlock report nor anywhere else - "For some organizations, cryptomining incidents can cost between $50-100K per day, for every day an attacker is mining digital currency undetected on their network."

This is the only cost quantification on cryptojacking I've seen. Is it from DarkReading research?
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11763
PUBLISHED: 2018-09-25
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
CVE-2018-14634
PUBLISHED: 2018-09-25
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerabl...
CVE-2018-1664
PUBLISHED: 2018-09-25
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cache. ...
CVE-2018-1669
PUBLISHED: 2018-09-25
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote atta...
CVE-2018-1539
PUBLISHED: 2018-09-25
IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or forced browsing to a page other than URL intended. IBM X-Force ID: 142561.