Friday, November 1, 2024
HomeCyber Security NewsFirst-Ever Cyber Attack Via Kubernetes RBAC to Create Backdoor on Clusters

First-Ever Cyber Attack Via Kubernetes RBAC to Create Backdoor on Clusters

Published on

Malware protection

Recently, a new attack campaign has been discovered by the cybersecurity researchers at Aqua Security that exploits Kubernetes RBAC to assemble backdoors and mine cryptocurrency like Monero.

Kubernetes API access control system known as RBAC enables administrators to specify which service accounts or users have access to API operations and resources. 

This system provides precise access control and enhances security measures by limiting access to critical resources.

- Advertisement - SIEM as a Service

Cyber Attack Via Kubernetes RBAC

Threat actors can establish persistence on compromised clusters even after addressing the initial access misconfiguration by exploiting RBAC to enforce malicious access control policies.

An Aqua Security team named ‘Nautilus’ made a discovery of this new type of attack, which they called ‘RBAC Buster.’ It has been reported that 60 misconfigured Kubernetes clusters were compromised as a result of this campaign.

The threat actor established a powerful and covert persistence by crafting a new ClusterRole with almost full admin privileges, producing a ‘kube-controller’ ServiceAccount within the ‘kube-system’ namespace, and then linking the ClusterRole with the ServiceAccount via a ‘ClusterRoleBinding’.

Here the attacker sought to exploit the AWS access keys exposed in its K8s honeypots to:-

  • Establish an ongoing foothold in the system.
  • Extract sensitive information
  • Evade the cluster’s restrictions

Several existing deployments were also deleted by the attacker in different namespaces, which include:-

  • kube-secure-fhgxtsjh
  • kube-secure-fhgxt
  • api-proxy
  • worker-deployment

The perpetrator’s last move involved generating a DaemonSet to spread a Docker-hosted container image (“kubernetesio/kube-controller:1.0.1”) on every node as part of the attack.

The cryptocurrency miner is hidden within the container, which has been downloaded over 14,000 times in the last five months. By typosquatting the legitimate ‘kubernetesio’ account, the ‘kuberntesio/kube-controller’ container image deceives users. 

The image further imitates the essential ‘kube-controller-manager’ container image, responsible for detecting and addressing node failures, and runs within a Pod on every master node.

Upon examining the configuration file, it became apparent that the perpetrator had already mined 5 XMR and could earn up to $200 annually per worker.

Moreover, RBAC Buster attacks on Kubernetes clusters can result in severe outcomes such as:- 

Mitigations

Here below we have mentioned the security measures that are recommended by the experts to mitigate the threat:-

  • Prohibit unauthenticated requests from anonymous users.
  • Make sure to secure the API server.
  • Ensure to employ Role-Based Access Control (RBAC) effectively.
  • Enforce strict API access policies.
  • Regularly monitor audit logs.
  • Make sure to encrypt any secrets with proper encryption.
  • Always secure the account credentials hosted in the cluster.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...