Cloud

5/15/2018
05:20 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

25% of Businesses Targeted with Cryptojacking in the Cloud

New public cloud security report detects a spike in cryptojacking, mismanaged cloud storage, account takeover, and major patches getting overlooked.

It seems like only yesterday we learned about the first of many Amazon S3 bucket leaks to expose troves of personal information in 2017. Poor cloud configuration was only one security issue to plague businesses last year; now, they have several to worry about.

RedLock's second annual Cloud Security Trends report digs into lessons learned from attacks and breaches over the past year. Researchers found the top issues in the cloud are account compromises, which affected 27% of organizations, cryptojacking (25%), risky configurations (51%), and missing high-severity patches in the cloud (24%).

"Twelve months ago, in everyone's minds, the biggest thing was cloud misconfigurations, S3 buckets," says RedLock cofounder and CEO Varun Badhwar. By now, the threats have escalated.

On average, 27% of organizations experienced potential account compromise, including major companies Uber, Tesla, OneLogin, Aviva, and Gemalto. Risky configurations affected 51%; among them were FedEx, Deep Root Analytics, and Under Armour. Nearly one-quarter (24%), including Drupal, MongoDB, Elasticsearch, and Intel, missed high-severity patches in the cloud.

Cryptojacking has gone mainstream as attackers have unprecedented access to high-powered public cloud computing resources, affecting major corporations like Tesla, Gemalto, and Aviva. One-quarter of organizations had cryptojacking in their environments, compared with just 8% last year. Badhwar says activity has ramped up 300% in the last quarter, partially because the bar to enter the world of cryptomining is low and the payoff is high.

"Once the attackers are in, the ease of the cloud is really what makes it possible," he notes. "They can spin up an infinite number of resources … it's really a question of how aggressive they want to be." For some organizations, cryptomining incidents can cost between $50-100K per day, for every day an attacker is mining digital currency undetected on their network.

Researchers also noticed account compromise has led to new attack vectors. Leaked credentials have been found in GitHub repositories, unsecured Kubernetes administrative interfaces, and public Trello boards; now, public cloud instance metadata APIs are an attack vector.

"Public cloud instance metadata is data about your instance that can be used toconfigure or manage the running instance," researchers report. "Essentially, an instance's metadata can be queried via an API to obtain access credentials to the public cloud environment by any process running on the instance." Account compromise will continue to evolve, they anticipate.

There was a spot of good news in the report, Badhwar notes. One year ago, 82% of corporate databases were not encrypted. Now the number has dropped to 49%, marking a 67% improvement. However, he continues, the decline is most likely due to compliance and not because companies are becoming more security-conscious overall.

"I have to say, because this is one of those outlier trends related to improvement … I'm more inclined to say the majority is driven by the visibility and audits that GDPR is driving," he says. This isn't to say companies are excelling in compliance, however. Researchers found on average, businesses fail 30% of CIS Foundations' best practices, 50% of PCI requirements, and 23% of NIST CSF requirements.

Visibility, along with speed of innovation, are two factors causing challenges in the cloud, Badhwar adds. As organizations rapidly adopt cloud services, security teams are often left in the dark when it comes to the applications developers are putting in the cloud. The cloud provides new tools and features to developers, who want to use them right away and don't consult with security as they're building.

"When you don't have visibility, how can you do any security or policy enforcement?" Badhwar points out.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
sleveson
50%
50%
sleveson,
User Rank: Apprentice
7/6/2018 | 1:50:55 PM
Question about cryptojacking costs
Interesting article - thanks. I'm wondering where this statistic came from as I couldn't find it n the Redlock report nor anywhere else - "For some organizations, cryptomining incidents can cost between $50-100K per day, for every day an attacker is mining digital currency undetected on their network."

This is the only cost quantification on cryptojacking I've seen. Is it from DarkReading research?
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-10727
PUBLISHED: 2018-07-20
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive ...
CVE-2018-8018
PUBLISHED: 2018-07-20
Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a spe...
CVE-2018-14415
PUBLISHED: 2018-07-20
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.
CVE-2018-14418
PUBLISHED: 2018-07-20
In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.
CVE-2018-14419
PUBLISHED: 2018-07-20
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.