public cloud Cryptominers threaten GCP virtual servers What’s in Google’s report on typical attacks against cloud systems in Google Cloud Platform? Enoch Root January 11, 2022 At the end of 2021, Google released its first report on typical threats to cloud users, focusing on the security of Google Cloud Platform. The service provides corporate clients with multiple scenarios for building cloud systems, ranging from simply hosting and running individual applications to deploying high-performance computing. Reasons for attacking Google Cloud Platform instances The report focuses on the causes and consequences of attacks on custom GCP instances, analyzing 50 recent successful attacks on custom servers or applications. Of the cases Google analyzed, 48% were the result of a weak password (or no password) for server-based accounts. In 26% of cases, hackers used a vulnerability in the cloud-server software. Server or application misconfiguration enabled 12%, and only 4% were a result of password or access key leaks. The latter category includes an error not uncommon to developers: uploading authentication data along with source code to a public repository on GitHub or a similar service. According to a report by GitGuardian, up to 5,000 “secrets” (API keys, password/username pairs, certificates) are uploaded to GitHub every day, and 2020 saw 2 million leaks. Vulnerabilities leaving servers open to hacking, according to Google. Weak or absent passwords enabled most of the attacks. Source. Google notes that cybercriminals tend not to target specific companies, instead regularly scanning the full range of IP addresses belonging to Google Cloud Platform in search of vulnerable instances. The implication of this automation is clear: If you make an unprotected server accessible from the Internet, it will almost certainly be hacked, and probably soon (in a number of cases, the attack began within 30 minutes of a new instance being raised). The time between hacking and the start of malicious activity is even shorter, with most attacked servers being put into illegal operation within half a minute. Why attackers go for Google Cloud Platform instances What do cybercriminals do with cloud resources after hacking them? In the vast majority of cases (86%), a cryptominer (a program that uses the resources of others to generate cryptocurrency) was installed on the server. Most commonly, these are CPU/GPU resources, but the report also mentions the mining of Chia cryptocurrency, which involves the exploitation of free disk space. In another 10% of cases, compromised servers were used for port scanning — to search for new victims. In 8% of cases, an attack on other network resources was made from the server. Rarer types of illegal activities that involve hijacked cloud-platform servers include: hosting malware, prohibited content, or both; carrying out DDoS attacks; and distributing spam. Types of malicious activity on hacked cloud servers. In some cases, several types of illegal operations were carried out simultaneously. Source. If someone hacks a cloud service and installs a cryptominer, their actions not only harm the client’s reputation and puts access to their own application or website at risk, but victims could face eye-watering service bills as well, even from just a few hours of activity. Recommendations for securing GCP instances In most of the cases Google studied, users could have avoided trouble by following minimal security requirements: employing strong passwords and additional authorization factors; ensuring due diligence when uploading source code; and regularly updating installed software to patch known vulnerabilities. In general, cloud systems require the same protection measures as any other type of infrastructure. They need, at a minimum, regular audits, monitoring of suspicious activity, and isolation of critical data. But deploying infrastructure in public cloud services involves a few extra recommendations — and not only for organizations using Google Cloud Platform. One of the main ones, as Google notes, is to set automatic conditional alerts to determine when resource consumption exceeds certain thresholds or to spot a rapid increase in costs.
Read next NoReboot: A fake restart to gain a foothold in the system How a fake restart helps malware to gain a foothold in a smartphone’s operating system without exploiting a persistence vulnerability.
Tips Reading between the lines: how to read e-books safely We break down how to use e-books safely, and which rules to follow when searching for books online, so you don’t fall victim to scammers
Tips The eMudhra certificate incident: how organizations can respond How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.