Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

5/15/2018
05:20 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

25% of Businesses Targeted with Cryptojacking in the Cloud

New public cloud security report detects a spike in cryptojacking, mismanaged cloud storage, account takeover, and major patches getting overlooked.

It seems like only yesterday we learned about the first of many Amazon S3 bucket leaks to expose troves of personal information in 2017. Poor cloud configuration was only one security issue to plague businesses last year; now, they have several to worry about.

RedLock's second annual Cloud Security Trends report digs into lessons learned from attacks and breaches over the past year. Researchers found the top issues in the cloud are account compromises, which affected 27% of organizations, cryptojacking (25%), risky configurations (51%), and missing high-severity patches in the cloud (24%).

"Twelve months ago, in everyone's minds, the biggest thing was cloud misconfigurations, S3 buckets," says RedLock cofounder and CEO Varun Badhwar. By now, the threats have escalated.

On average, 27% of organizations experienced potential account compromise, including major companies Uber, Tesla, OneLogin, Aviva, and Gemalto. Risky configurations affected 51%; among them were FedEx, Deep Root Analytics, and Under Armour. Nearly one-quarter (24%), including Drupal, MongoDB, Elasticsearch, and Intel, missed high-severity patches in the cloud.

Cryptojacking has gone mainstream as attackers have unprecedented access to high-powered public cloud computing resources, affecting major corporations like Tesla, Gemalto, and Aviva. One-quarter of organizations had cryptojacking in their environments, compared with just 8% last year. Badhwar says activity has ramped up 300% in the last quarter, partially because the bar to enter the world of cryptomining is low and the payoff is high.

"Once the attackers are in, the ease of the cloud is really what makes it possible," he notes. "They can spin up an infinite number of resources … it's really a question of how aggressive they want to be." For some organizations, cryptomining incidents can cost between $50-100K per day, for every day an attacker is mining digital currency undetected on their network.

Researchers also noticed account compromise has led to new attack vectors. Leaked credentials have been found in GitHub repositories, unsecured Kubernetes administrative interfaces, and public Trello boards; now, public cloud instance metadata APIs are an attack vector.

"Public cloud instance metadata is data about your instance that can be used toconfigure or manage the running instance," researchers report. "Essentially, an instance's metadata can be queried via an API to obtain access credentials to the public cloud environment by any process running on the instance." Account compromise will continue to evolve, they anticipate.

There was a spot of good news in the report, Badhwar notes. One year ago, 82% of corporate databases were not encrypted. Now the number has dropped to 49%, marking a 67% improvement. However, he continues, the decline is most likely due to compliance and not because companies are becoming more security-conscious overall.

"I have to say, because this is one of those outlier trends related to improvement … I'm more inclined to say the majority is driven by the visibility and audits that GDPR is driving," he says. This isn't to say companies are excelling in compliance, however. Researchers found on average, businesses fail 30% of CIS Foundations' best practices, 50% of PCI requirements, and 23% of NIST CSF requirements.

Visibility, along with speed of innovation, are two factors causing challenges in the cloud, Badhwar adds. As organizations rapidly adopt cloud services, security teams are often left in the dark when it comes to the applications developers are putting in the cloud. The cloud provides new tools and features to developers, who want to use them right away and don't consult with security as they're building.

"When you don't have visibility, how can you do any security or policy enforcement?" Badhwar points out.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
sleveson
50%
50%
sleveson,
User Rank: Apprentice
7/6/2018 | 1:50:55 PM
Question about cryptojacking costs
Interesting article - thanks. I'm wondering where this statistic came from as I couldn't find it n the Redlock report nor anywhere else - "For some organizations, cryptomining incidents can cost between $50-100K per day, for every day an attacker is mining digital currency undetected on their network."

This is the only cost quantification on cryptojacking I've seen. Is it from DarkReading research?
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...