Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Attacker’s Tactics and Techniques in Unsecured Docker Daemons Revealed

Summary: Between September and December 2019, Unit 42 researchers scanned internet-exposed Docker hosts and found more than 1,400 unique unsecured hosts, 8,673 active containers, 17,927 Docker images and 15,229 volumes, with roughly 5,000 daemons exposed and 10-15% accessible without authentication. Most compromised platforms were used for cryptojacking, mostly mining Monero, while some were used as stepping stones for other attacks or to install rootkits, and attackers frequently mounted the entire host file system to a container to read and write the host OS.

Key Takeaway: The Docker daemon runs as a root process on the host, so an unauthenticated TCP socket on port 2375 hands an attacker full control of the platform and potentially the entire host - and the exposed logs alone leaked application passwords, etcd server IPs and key file locations that speed lateral movement.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related