Microsoft warns of "shadow miner" attacks on Kubernetes clusters – Bits Media

Microsoft computer security experts reported a series of hacker attacks on Kubernetes clusters with Kubeflow -running Kubeflow containers for hidden cryptocurrency mining.

Kubernetes - a popular container orchestration system, And the solution of kubeflow allows you to quickly and just turn up specimens of containers with machine learning systems. Hackers attack clusters with detailed Kubeflow systems, to unfold your own containers, in which the XMR and ETH miners are launched.

The attacks began at the end of May. Computer security experts discovered a sudden surge of deploying Tensorflow containers.

“The surge in installations on various clusters was simultaneously. This indicates, that the hackers scanned clusters in advance and compiled a list of potential goals, and then launched a coordinated attack ", - said the senior researcher of Microsoft on the safety of Yoshi Vaitsman (Yossi Weizman).

Attackers modified containers, so that they get cryptocurrencies, and distributed them through the Kubeflow Pipelines platform. At the same time, they received the initial access to Kubernetes clusters through the Kubeflow control system - initially access to it should be limited to internal networks, But some administrators mistakenly allowed access from outside. Then hackers deployed two containers: One for the extraction of cryptocurrencies on central processors, And the other - on video accelerators.

The XMRIG application was used to extract Monero, And for mining Ethereum, hackers deployed containers from Ethminer.

“The attacks are still ongoing and all new Kubernetes clusters with the open panel Kubeflow are hit, - Waitsman warned.

Cybersecurity specialist advised administrators to always include authentication when accessing the panel, and also limit access to it. Besides, He advised to monitor his infrastructure and unfolded containers.

At the end of April, it was reported, that Microsoft will add Intel technology to detect threats, To increase the response rate to the malicious programs of hidden mining at workstations.