配置不當的 Docker 服務器已成爲TeamTNT的熱門攻擊目標

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"從上個月開始，一些配置不當的 Docker 服務器已經成爲黑客組織TeamTNT的熱門攻擊目標，暴露的目標主機允許他們以 root 權限執行惡意代碼。這顯示出黑客組織對Docker 服務器的攻擊手法越來越複雜，尤其是像 TeamTNT 這樣高水平的攻擊者。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"據 TrendMicro 研究人員的報告顯示，攻擊者有三個不同的目標："}]},{"type":"numberedlist","attrs":{"start":null,"normalizeStart":1},"content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":1,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"下載或捆綁 Monero 加密貨幣挖礦程序。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":2,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"掃描暴露在互聯網上的易受攻擊的 Docker 實例。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":3,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"使用container-to-host技術訪問主機網絡。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"如流程圖所示，TeamTNT首先使用暴露的 Docker REST API 在目標主機上創建一個container。然後，攻擊者使用受感染或受控制的 Docker Hub 帳戶來託管鏡像並將其部署在目標主機上，再利用這些container執行cronjobs任務。 "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/c6\/c6662454b196e36a0b3742fef7868045.png","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"作爲該研究的一部分，TrendMicro 已經從惡意 Docker Hub 帳戶中提取了超過 150,000 個鏡像。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"在掃描易受攻擊的實例時，黑客會檢查端口 2375、2376、2377、4243、4244，並嘗試收集服務器信息，例如操作系統類型、CPU 內核數量、容器註冊表和當前羣參與狀態。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"黑客創建的容器鏡像基於 AlpineOS 系統，並使用底層主機上的root權限來執行惡意代碼。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"TrendMicro 報告稱，攻擊活動還使用受 TeamTNT 控制的受感染 Docker Hub 帳戶來投放惡意 Docker 映像。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/79\/790c62ccdb6b9813d66e5a3c243db661.png","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"TeamTNT 是一個老練、高水平的組織，他們不斷髮展技術，對易受攻擊的 Docker 系統帶來了持續的威脅。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"2020 年 8 月，他們首先創建了一個蠕蟲，通過蠕蟲來"},{"type":"link","attrs":{"href":"https:\/\/www.bleepingcomputer.com\/news\/security\/cryptojacking-worm-steals-aws-credentials-from-docker-systems\/","title":null,"type":null},"content":[{"type":"text","text":"利用 Docker 和 Kubernetes"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"2020 年 10 月，"},{"type":"link","attrs":{"href":"https:\/\/www.bleepingcomputer.com\/news\/security\/crypto-mining-malware-adds-linux-password-stealing-capability\/","title":null,"type":null},"content":[{"type":"text","text":"攻擊"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"者 "},{"type":"link","attrs":{"href":"https:\/\/www.bleepingcomputer.com\/news\/security\/crypto-mining-malware-adds-linux-password-stealing-capability\/","title":null,"type":null},"content":[{"type":"text","text":"添加了"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" 針對 Docker 實例的"},{"type":"link","attrs":{"href":"https:\/\/www.bleepingcomputer.com\/news\/security\/crypto-mining-malware-adds-linux-password-stealing-capability\/","title":null,"type":null},"content":[{"type":"text","text":"Monero 挖掘"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"和憑據竊取功能。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"2021 年 1 月，TeamTNT 使用"},{"type":"link","attrs":{"href":"https:\/\/www.bleepingcomputer.com\/news\/security\/linux-malware-uses-open-source-tool-to-evade-detection\/","title":null,"type":null},"content":[{"type":"text","text":"複雜的檢測規避技巧"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"升級了其礦工，同時可從受感染的服務器中獲取用戶憑據。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"但Docker 提供了一些“強制”提示，可用於鎖定 Docker REST API 並防止這些類型的攻擊。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"“因此， "},{"type":"text","marks":[{"type":"italic"},{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"必須"},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" 使用"},{"type":"link","attrs":{"href":"https:\/\/docs.docker.com\/engine\/security\/protect-access\/","title":null,"type":null},"content":[{"type":"text","text":"HTTPS 和證書"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"來保護 API 端點 ，還建議確保它只能從受信任的網絡或 VPN 訪問，”Docker 的"},{"type":"link","attrs":{"href":"https:\/\/docs.docker.com\/engine\/security\/","title":null,"type":null},"content":[{"type":"text","text":"安全指南"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"解釋道。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"參考鏈接："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https:\/\/www.trendmicro.com\/en_sg\/research\/21\/k\/compromised-docker-hub-accounts-abused-for-cryptomining-linked-t.html","title":null,"type":null},"content":[{"type":"text","text":"https:\/\/www.trendmicro.com\/en_sg\/research\/21\/k\/compromised-docker-hub-accounts-abused-for-cryptomining-linked-t.html"}],"marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}]}]}]}