Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Unsecured Kubernetes Instances Could Be Vulnerable to Exploitation

Summary: Unit 42 researchers scanned the internet between October 2020 and February 2021 and found 2,100 unsecured Kubernetes clusters comprising 5,300 nodes, 31,340 CPUs and 75,270 pods, plus 6,400 exposed API servers and 1,030 exposed Kubelets holding 83,902 secret keys. They observed malware and malicious activity in some of these clusters, with cryptojacking the most common attack, and found that 50% of the identified clusters ran versions v1.12, v1.13 or v1.16 and had not been updated for more than two years.

Bottom line: These clusters were reachable anonymously by anyone who knew their IPs, ports and APIs, and they held API tokens, database credentials, source code and PII across e-commerce, finance and healthcare organizations. A compromised cluster offers far more CPU, memory and network than a Docker daemon, enough for a capable attacker to host command and control servers, build a botnet or steal data.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related