Pierluigi Paganini April 06, 2020

Experts uncovered a hacking campaign that is breaching Docker clusters to deploy a new crypto-mining malware tracked as Kinsing.

Cloud security firm Aqua Security uncovered a hacking campaign carried out during the past months, hackers are scanning the Internet for Docker servers running API ports exposed without a password. Then the attackers break into the installs and deploy a new crypto-miner tracked as Kinsing.

“We’ve been tracking an organized attack campaign that targets misconfigured open Docker Daemon API ports. This persistent campaign has been going on for months, with thousands of attempts taking place nearly on a daily basis.” reads the post published by Aqua Security.

“In this attack, the attackers exploit a misconfigured Docker API port to run an Ubuntu container with the kinsing malicious malware, which in turn runs a cryptominer and then attempts to spread the malware to other containers and hosts.”

The Kinsing malware abuses the resources of the Docker installations to mine cryptocurrency, hackers exploit unprotected open Docker API port to instantiate an Ubuntu container.

The container also includes scripts that are executed to remove other malware running on the same Docker instance, to gather local SSH credentials in an attempt to perform lateral movements in the container network, to disable security measures and clear logs, to infect other cloud systems with the same piece of malware.

“The spre.sh shell script that the malware downloads is used to laterally spread the malware across the container network. In order to discover potential targets and locate the information it needs to authenticate against, the script passively collects data from /.ssh/config, .bash_history, /.ssh/known_hosts, and the likes.” continues the report.”We did not identify any active scanning techniques used to identify additional targets.”

The Kinsing miner is a Golang-based Linux agent that uses several Go libraries, including:

• go-resty – an HTTP and REST client library, used to communicate with a Command and Control (C&C) server.
• gopsutil – a process utility library, used for system and processes monitoring.
• osext – extension to the standard ‘os’ package, used to execute binaries.
• diskv – A disk-backed key-value store, for storage.

Experts reported that before the malware deploys its payload, it attempts to communicate with servers in Eastern Europe each of them is associated with a function that the malicious code executes.

Aqua recommends companies to carefully review the security settings of their Docker instances and avoid exposing administrative APIs online. Experts also recommend to access admin endpoints only through firewall or VPN gateway.

“This attack stands out as yet another example of the growing threat to cloud native environments. With deployments becoming larger and container use on the rise, attackers are upping their game and mounting more ambitious attacks, with an increasing level of sophistication.” concludes the experts.

Pierluigi Paganini

(SecurityAffairs – Kinsing malware, Docker)

[adrotate banner=”5″]

[adrotate banner=”13″]