Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Gaining Visibility Within Container Clusters

Summary: Unit 42 reports that service mesh platforms such as Istio, Linkerd and Consul, already used by DevOps for traffic control and load balancing, can also mirror network traffic to SOC tools and give security teams visibility into container processes inside Kubernetes clusters. The researchers note that actor groups including TeamTNT, WatchDog and Nobelium have targeted containerized applications, and that the top 20 Docker Hub images carry 1,989 known exploits, with 13 of the 20 containing at least one and four containing at least 90.

Bottom line: TeamTNT is actively exploiting CVE-2021-26084 against Atlassian Confluence, and Shodan listed 976 internet-facing Confluence servers at the time of writing - while security operations teams often remain unaware of activity inside their own K8s clusters.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Supply Chain & AppSec
Mentions
CVE-2021-26084
Related