It’s simple to use and is favored by developers, as a user can write services and deploy applications at great speed.
Of the two we identified here, the most interesting account for study was the alpineos account, which hosted malicious container images with over 150,000 pulls.ĭocker is a container services platform that helps developers follow a write-once-run-anywhere (WORA) practice. As a result, we found 26 unique DockerHub accounts that are either compromised or malicious. In July 2021, we published our research on TeamTNT’s malicious activities and found evidence of the group infiltrating via the Docker API. These DockerHub profiles were actively used to deploy malicious images containing the following: Unless a user is not logged out manually, the header “X-Registry-Auth" stores the credentials. The threat actors were logged in to their accounts on the DockerHub registry and probably forgot to log out. The account alpineos was used in exploitation attempts on our honeypots three times, from mid-September to early October 2021, and we tracked the deployments’ IP addresses to their location in Germany. We have notified Docker about these accounts. Our honeypots showed threat actor TeamTNT was leaking credentials from at least two of its attacker-controlled DockerHub accounts, namely alpineos (with over 150,000 pulls) and sandeep078 (with 200 pulls). Upon analyzing the samples, we realized and were able to understand the threat actors’ use of container registry features for Docker malware and tactics, techniques, and procedures (TTPs). One of these honeypots is based on exposed Docker REST API for analysis from cloud services providers’ and users’ perspectives. We constantly deploy and study our honeypots to get a view of actively exploited vulnerabilities and misconfigurations on platforms and services that pose cloud security risks.
0 kommentar(er)
