In what researchers say is a first, attackers are performing a new container attack technique in the wild, whereby they build their own malicious images on a targeted host instead of pulling preexisting ones from a public registry. This maneuver allows the adversaries to avoid static detection by scanners that are programmed to look for suspicious images.
The attack exploits misconfigured Docker API ports in order to infect victims with a resource-hijacking cryptominer, according to a new blog post from Aqua Security, whose researchers uncovered the scheme.
"This is yet another step in the super-fast evolution of attacks against cloud-native environments in just the past couple of years," said says the post, from Assaf Morag, lead data analyst.
Please register to continue.
Already registered? Log in.
Once you register, you'll receive:
The context and insight you need to stay abreast of the most important developments in cybersecurity. CISO and practitioner perspectives; strategy and tactics; solutions and innovation; policy and regulation.
Unlimited access to nearly 20 years of SC Media industry analysis and news-you-can-use.
SC Media’s essential morning briefing for cybersecurity professionals.
One-click access to our extensive program of virtual events, with convenient calendar reminders and ability to earn CISSP credits.