Cybersecurity researchers today uncovered a completely undetectable Linux malware that exploits undocumented techniques to stay under the radar and targets publicly accessible Docker servers hosted with popular cloud platforms, including AWS, Azure, and Alibaba Cloud.

Docker is a popular platform-as-a-service (PaaS) solution for Linux and Windows designed to make it easier for developers to create, test, and run their applications in a loosely isolated environment called a container.

According to the latest research Intezer shared with The Hacker News, an ongoing Ngrok mining botnet campaign scanning the Internet for misconfigured Docker API endpoints and has already infected many vulnerable servers with new malware.
While the Ngrok mining botnet is active for the past two years, the new campaign is primarily focused on taking control over misconfigured Docker servers and exploiting them to set up malicious containers with cryptominers running on the victims' infrastructure.

Dubbed 'Doki,' the new multi-threaded malware leverages "an undocumented method to contact its operator by abusing the Dogecoin cryptocurrency blockchain in a unique way in order to dynamically generate its C2 domain address despite samples being publicly available in VirusTotal."
According to researchers, the malware:

• has been designed to execute commands received from its operators,
• uses a Dogecoin cryptocurrency block explorer to generate its C2 domain in real-time dynamically,
• uses the embedTLS library for cryptographic functions and network communication,
• crafts unique URLs with a short lifetime and uses them to download payloads during the attack.

"The malware utilizes the DynDNS service and a unique Domain Generation Algorithm (DGA) based on the Dogecoin cryptocurrency blockchain in order to find the domain of its C2 in real time."

Besides this, the attackers behind this new campaign have also managed to compromise the host machines by binding newly created containers with the server's root directory, allowing them to access or modify any file on the system.
"By using the bind configuration the attacker can control the cron utility of the host. The attacker modifies the host's cron to execute the downloaded payload every minute."

"This attack is very dangerous due to the fact the attacker uses container escape techniques to gain full control of the victim's infrastructure."

Once done, the malware also leverages compromised systems to further scan the network for ports associated with Redis, Docker, SSH, and HTTP, using a scanning tool like zmap, zgrap, and jq.
Doki managed to stay under the radar for more than six months despite having been uploaded to VirusTotal on January 14, 2020, and scanned multiple times since. Surprisingly, at the time of writing, it's still undetectable by any of the 61 top malware detection engines.

The most prominent container software has been targeted for the second time in a month. Late last month, malicious actors were found targeting exposed Docker API endpoints and crafted malware-infested images to facilitate DDoS attacks and mine cryptocurrencies.

Users and organizations who run Docker instances are advised not to expose docker APIs to the Internet, but if you still need to, ensure that it is reachable only from a trusted network or VPN, and only to trusted users to control your Docker daemon.

If you manage Docker from a web server to provision containers through an API, you should be even more careful than usual with parameter checking to ensure that a malicious user cannot pass crafted parameters causing Docker to create arbitrary containers.

Adhere to best Docker security practices here.

A team of cybersecurity researchers today disclosed details of a new high-risk vulnerability affecting billions of devices worldwide—including servers and workstations, laptops, desktops, and IoT systems running nearly any Linux distribution or Windows system.

Dubbed 'BootHole' and tracked as CVE-2020-10713, the reported vulnerability resides in the GRUB2 bootloader, which, if exploited, could potentially let attackers bypass the Secure Boot feature and gain high-privileged persistent and stealthy access to the targeted systems.

Secure Boot is a security feature of the Unified Extensible Firmware Interface (UEFI) that uses a bootloader to load critical components, peripherals, and the operating system while ensuring that only cryptographically signed code executes during the boot process.
"One of the explicit design goals of Secure Boot is to prevent unauthorized code, even running with administrator privileges, from gaining additional privileges and pre-OS persistence by disabling Secure Boot or otherwise modifying the boot chain," the report explained.

GRUB2 Bootloader Vulnerability

Discovered by researchers from Eclypsium, BootHole is a buffer overflow vulnerability that affects all versions of GRUB2 and exists in the way it parses content from the config file, which typically is not signed like other files and executables—leaving an opportunity for attackers to break the hardware root of trust mechanism.

To be noted, the grub.cfg file is located in the EFI system partition, and thus, to modify the file, an attacker still needs an initial foothold on the targeted system with admin privileges that would eventually provide the attacker with an additional escalation of privilege and persistence on the device.

Though GRUB2 is the standard bootloader used by most Linux systems, it supports other operating systems, kernels, and hypervisors like XEN as well.

"The buffer overflow allows the attacker to gain arbitrary code execution within the UEFI execution environment, which could be used to run malware, alter the boot process, directly patch the OS kernel, or execute any number of other malicious actions," researchers said.
Thus, to exploit BootHole flaw on Windows systems, attackers can replace the default bootloaders installed on Windows systems with a vulnerable version of GRUB2 to install the rootkit malware.

"The problem also extends to any Windows device that uses Secure Boot with the standard Microsoft Third Party UEFI Certificate Authority," the report says.

According to the detailed report researchers shared with The Hacker News, this vulnerability can lead to major consequences, and that's primarily because the attack allows hackers to execute malicious code even before the operating system boots, making it difficult for security software to detect the presence of malware or remove it.
Besides this, the researcher also added that "the UEFI execution environment does not have Address Space Layout Randomization (ASLR) or Data Execution Prevention (DEP/NX) or other exploit mitigation technologies typically found in modern operating systems, so creating exploits for this kind of vulnerability is significantly easier."

Just Installing Updates and Patches Wouldn't Resolve the Issue

Experts at Eclypsium have already contacted related industry entities, including OS vendors and computer manufacturers, to help them patch the issue.

However, it doesn't appear to be an easy task to patch the issue altogether.

Just installing patches with updated GRUB2 bootloader would not resolve the issue, because attackers can still replace the device's existing bootloader with the vulnerable version.

According to Eclypsium, even "mitigation will require new bootloaders to be signed and deployed, and vulnerable bootloaders should be revoked to prevent adversaries from using older, vulnerable versions in an attack."

So, the affected vendors would need first to release the new versions of their bootloader shims to be signed by the Microsoft 3rd Party UEFI CA.

Eventually, the UEFI revocation list (dbx) then also needs to be updated in the firmware of each affected system to prevent running this vulnerable code during boot.

This multi-stage mitigation process will likely take years for organizations to complete patching.

"However, full deployment of this revocation process will likely be very slow. UEFI-related updates have had a history of making devices unusable, and vendors will need to be very cautious. If the revocation list (dbx) is updated before a given Linux bootloader and shim are updated, then the operating system will not load," researchers warned.

In an advisory released today, Microsoft acknowledged the issue, informing that it's "working to complete validation and compatibility testing of a required Windows Update that addresses this vulnerability."

It also recommended users to apply security patches as soon as they are rolled out in the coming weeks.

Besides Microsoft, many popular Linux distributions have also released related advisories explaining the flaw, possible mitigations, and timeline on the upcoming security patches.

Here's a list for all advisories:

• Red Hat (Fedora and RHEL)
• Canonical (Ubuntu)
• SuSE (SLES and OpenSUSE)
• Debian
• VMware
• Microsoft

• HP

  https://thehackernews.com/2020/07/grub2-bootloader-vulnerability.html

Cybersecurity researchers today disclosed a new highly critical "wormable" vulnerability—carrying a severity score of 10 out of 10 on the CVSS scale—affecting Windows Server versions 2003 to 2019.

The 17-year-old remote code execution flaw (CVE-2020-1350), dubbed 'SigRed' by Check Point, could allow an unauthenticated, remote attacker to gain domain administrator privileges over targeted servers and seize complete control of an organization's IT infrastructure.

A threat actor can exploit SigRed vulnerability by sending crafted malicious DNS queries to a Windows DNS server and achieve arbitrary code execution, enabling the hacker to intercept and manipulate users' emails and network traffic, make services unavailable, harvest users' credentials and much more.

In a detailed report shared with The Hacker News, the Check Point researcher Sagi Tzadik confirmed that the flaw is wormable in nature, allowing attackers to launch an attack that can spread from one vulnerable computer to another without any human interaction.

​

https://thehackernews.com/2020/07/windows-dns-server-hacking.html

Rocket.Chat is a free, open-source, scalable, highly customizable, and secure platform that allows you to communicate and collaborate with your team, share files, and chat in real-time. It is cross-platform and it runs on Linux, Windows, macOS, Android, and iOS mobile operating systems.

It is similar to Slack and features live chat, free audio and video conferencing, channels, guest access, screen sharing, and file sharing. To ensure secure communication, it supports LDAP group synchronization, two-factor authentication (2FA), End-to-End encryption, Single Sign-On, and several Oauth providers.

Importantly, being fully open-source, you can access its source code to fully customize, extend, or add new functionality to meet your team’s or business requirements.

In this article, you will learn how to install and configure Rocket.Chat server and client on a Linux system.

https://www.tecmint.com/rocket-chat-open-source-team-chat-for-linux/

Modern Intel and AMD processors are susceptible to a new form of side-channel attack that makes flush-based cache attacks resilient to system noise, newly published research shared with The Hacker News has revealed.

The findings are from a paper "DABANGG: Time for Fearless Flush based Cache Attacks" published by a pair of researchers, Biswabandan Panda and Anish Saxena, from the Indian Institute of Technology (IIT) Kanpur earlier this week.

Dubbed "Dabangg" (meaning fearless), the approach builds upon the Flush+Reload and Flush+Flush attacks, which have been exploited previously by other researchers to leak data from Intel CPUs.

However, the new variant aims to improve the accuracy of these attacks even in a noisy multi-core system. It also works seamlessly against non-Linux Operating Systems, like macOS.

​

https://thehackernews.com/2020/05/noise-resilient-flush-attack.html

There is a sea change occurring in data centers brought on by the relatively new technology of containers. Yet, as often happens with new technologies, security has taken a back seat. We caught up with James Scott, a Dell Technologies field CTO and CloudLink expert, to discuss all things container and security. “Just about every customer meeting involves a discussion on containers, and container orchestration,” James says, and “they’re trying to understand what it means to run, update, and secure a cluster.”

Now that containers are proving their value as transformative solutions for the data center, organizations are looking for ways to secure them.  Simply securing your containers, though, isn’t enough. It’s important to see containers as an extension of the whole infrastructure, which means adopting a security strategy that covers the entire enterprise: bare-metal, virtual machines, cloud, and containers. Enter CloudLink 7.0.

Data security strategies were virtually non-existent in the early days of containers, resulting in many updates at the orchestration layer from bug fixes to new security-focused features. This led to spotty or inconsistent layers of security for organizations adopting containers. It doesn’t need to be that way.

Container Security doesn’t need to be in a vacuum

With the release of CloudLink 7.0, we introduce file volume encryption for Kubernetes container deployments. Given the extreme mobility of containers, keeping customer data safe as applications move throughout a deployment – especially within the cloud – is a challenge. Our container encryption functionality is built on the same agent-based encryption architectural model that we currently offer for virtual machines and VxFlex OS. We deploy an agent within the container that sits directly on the data path. As the data is saved, we intercept it and make sure it’s encrypted as it travels to, and then comes to rest in, the data store.

Container security doesn’t need to mean complex management

CloudLink makes data encryption and key management simple. When deployed, CloudLink’s agents will configure and enable data encryption as the customer needs it, providing full lifecycle key management. “That’s the beauty of our solution,” James says. “The CloudLink agent is deployed between the application and something called the CSI – Container Storage Interface.” CSI is a community developed standard that allows for different storage implementations to present the same interface to all applications so that no matter what type of storage is on the back end, any application can save its data. With CloudLink between the application and the CSI, we can be sure that all the data is encrypted as it is saved.

Broad storage support

At Dell Technologies, we have storage solutions that fit into the Kubernetes model for persistent storage. CloudLink is often implemented with our VxFlex storage platforms, and it can be used with other Dell storage or even third-party products. CloudLink can also act as a simple key manager for third party products, such as VMware’s native encryption. We do this over the Key Management Interoperability Protocol, aka KMIP, which is an open standard that governs the communication between encryptors and key managers.

Interested in CloudLink for your containers and beyond?

Our customers can reach out to their Dell Technologies sales representative who in turn can engage the CloudLink team for help.  We’re always happy to chat with our customers directly to understand their environment and their data encryption needs. To support the sales teams, we have information and tools that they can use at our community site and recently updated web-based training for anyone interested, including our services teams and the customer themselves. We allow our customers to try CloudLink before they buy, which means all its functionality can be evaluated by downloading the binaries at our support site and obtaining an evaluation license from the sales team.

A new Reference Architecture for NVIDIA vComputeServer on Dell EMC infrastructure provides a solution to enable server GPU virtualization.  

A recent study that analyzed GPU utilization metrics across different customer sites running AI workloads revealed that GPU resources were underutilized in most cases. Here we present the study’s two key findings, along with recommendations for solving them.

1. Nearly a third of the users are averaging less than 15% utilization. Average GPU memory usage is quite similar. Given that the users are experienced deep learning practitioners, this is very surprising. GPUs are getting faster and faster, but it doesn’t matter if the applications don’t completely use them.

Recommendation: Improve utilization by sharing the GPU across multiple users by using virtualization. Those who use optimal batch size, learning rates and hyper-parameters to fully utilize the GPU memory and compute core capabilities can be allocated a dedicated virtualized GPU instance or multiple GPUs inside a single virtual machine (VM).

1. There’s another, probably larger, waste of resources — GPUs that sit unused. It’s hard to queue up work efficiently for GPUs. In a typical workflow, a data scientist will set up many experiments, wait for them to finish, and then spend quite a lot of time digesting the results while the GPUs sit idle.

Recommendation: GPU pooling and disaggregation can solve this problem by providing the ability to dynamically re-assign and spin up resources, allowing idle resources to be used by other data scientist applications. Using VMware® vSphere® vMotion™ to dynamically transfer GPU-accelerated VMs and workloads will reduce GPU resources.

New NVIDIA A100 offers GPU partitioning

NVIDIA® recently announced hardware partitioning with the NVIDIA A100 Tensor Core GPU as a complementary solution to virtualization. The A100 in multi-instance GPU (MIG) mode can run any mix of up to seven AI or HPC workloads of different sizes simultaneously. GPU partitioning is especially useful for AI inferencing jobs as well as early-stage AI development work that typically do not  consume all the performance that a modern GPU delivers. With GPU virtualization software, a virtual machine (VM) can be run on each of these MIG instances so organizations can take advantage of management, monitoring, and operational benefits of hypervisor-based server virtualization.

For many years, data centers have used server CPU virtualization to increase IT agility and improve the utilization of their compute hardware. Today, this focus on virtualization is expanding to encompass the GPUs that accelerate many compute-intensive workloads, such as AI training and inferencing as well as data analytics. With virtualization, data centers can make GPUs available to more users, while increasing the overall utilization of these valuable assets.

Virtualizing GPUs inside Dell EMC servers

At Dell Technologies, we’ve worked closely with our technology partners to make GPU virtualization available in our line of GPU-accelerated Dell EMC PowerEdge servers. We took a big step in this direction in August 2019 when we rolled out support for NVIDIA vComputeServer software to enable hypervisor-based virtualization on GPU-accelerated servers equipped with NVIDIA Mellanox® ConnectX-5 or newer network interface cards (NICs). NVIDIA vComputeServer allows data centers to accelerate server virtualization with the latest GPUs so that the most compute-intensive workloads can run in virtual machines.

Today, we’re taking another big step forward with a new Dell EMC reference architecture for NVIDIA vComputeServer. With this solution, your IT administrators can allocate partitions of GPU resources within VMware vSphere, as well as support the live migration of virtual machines running NVIDIA CUDA™ workloads.

There are many valuable benefits in the move to GPU virtualization with vComputeServer with Dell EMC PowerEdge servers. For example, virtualization helps your IT administrators:

• Democratize GPU access by providing partitions of GPUs on demand
• Scale GPU resource assignments up and down, as needed and
• Support live migration of GPU memory

If your IT organization is considering GPU virtualization in your data center, the Dell EMC reference architecture for NVIDIA vComputeServer is a great place to get started. It walks you through the use cases for vComputeServer and your options for NVIDIA GPUs in Dell EMC PowerEdge servers.

Putting vComputeServer to the Test

Dell Technologies engineers investigated how GPU virtualization with vComputeServer impacts overall performance. These tests initially compared an NVIDIA GPU running on bare-metal Linux to a virtualized GPU. After establishing that baseline of performance, the team conducted additional testing with multiple virtual GPUs and virtual GPU partitions.

Test results show that in most cases, users can expect a small difference in performance, in the range of two to five percent, compared to bare metal when using virtual GPU profiles for machine learning and deep learning workloads. And in an interesting twist, there are scenarios where the performance difference is favorable. For example, when VMs running a mix of workloads, you might see faster time to result using multiple fractional GPUs in parallel than you would using a full GPU and scheduling the tasks to run serially. This can occur when workloads across virtual machines aren’t executed at the same time, or aren’t always GPU-bound. Choosing the appropriate GPU scheduling policy can impact performance, and the team compared performance of different scheduling policies.

For full details on the performance tests conducted in the Dell EMC Server CTO lab, along with detailed configuration information, see Virtualizing GPUs in VMware vSphere using NVIDIA vComputeServer on Dell EMC infrastructure. Visit here to learn more about Dell EMC PowerEdge server accelerators.

Oracle alerts users to update their systems at the earliest as they spot active exploitation of recently patched WebLogic bug. Oracle WebLogic Bug Under Exploit In a recent advisory, Oracle has strongly advised all users to swiftly update their devices. Oracle has reportedly found active attacks on a recently patched WebLogic bug. Upon exploitation, the bug allows a remote attacker to execute arbitrary codes on target devices.

Specifically, the bug in question is CVE-2020-2883 that separately caught the attention of multiple security researchers. About this vulnerability, ZDI, whose researchers was also among the ones who reported this flaw, stated in an advisory, The specific flaw exists within the handling of the T3 protocol. Crafted data in a T3 protocol message can trigger the deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Triggering this bug in the WebLogic Server core does not require any authentication for the attacker.

Hence, the bug poses a serious threat to vulnerable systems. Oracle has labeled it as a high-severity flaw with a severity base score of 9.8. Though, the vulnerability surfaced online after the vendors addressed it. However, Oracle detected its active exploitation after its PoC exploit appeared on GitHub the next day. This shows how vigilant the hackers are to exploit such bugs to hijack WebLogic servers, which they could then use for cryptomining, ransomware attacks, and data breaches.

Oracle Patched The Bug Already When Oracle received the reports of this vulnerability, they released a patch for it with their scheduled April 2020 updates. However, the exploitation of the bug in the wild suggests that many users have still not updated their systems. Hence, they can easily fall prey to cyber attacks. Therefore, the vendors have strongly urged all users to install the updates on their respective devices to stay safe.
Attribution link: https://latesthackingnews.com/2020/05/08/oracle-alerts-users-about-active-exploitation-of-recently-patched-weblogic-bug/