配置不当的 Docker 服务器已成为TeamTNT的热门攻击目标

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"从上个月开始，一些配置不当的 Docker 服务器已经成为黑客组织TeamTNT的热门攻击目标，暴露的目标主机允许他们以 root 权限执行恶意代码。这显示出黑客组织对Docker 服务器的攻击手法越来越复杂，尤其是像 TeamTNT 这样高水平的攻击者。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"据 TrendMicro 研究人员的报告显示，攻击者有三个不同的目标："}]},{"type":"numberedlist","attrs":{"start":null,"normalizeStart":1},"content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":1,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"下载或捆绑 Monero 加密货币挖矿程序。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":2,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"扫描暴露在互联网上的易受攻击的 Docker 实例。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":3,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"使用container-to-host技术访问主机网络。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"如流程图所示，TeamTNT首先使用暴露的 Docker REST API 在目标主机上创建一个container。然后，攻击者使用受感染或受控制的 Docker Hub 帐户来托管镜像并将其部署在目标主机上，再利用这些container执行cronjobs任务。 "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/c6\/c6662454b196e36a0b3742fef7868045.png","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"作为该研究的一部分，TrendMicro 已经从恶意 Docker Hub 帐户中提取了超过 150,000 个镜像。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"在扫描易受攻击的实例时，黑客会检查端口 2375、2376、2377、4243、4244，并尝试收集服务器信息，例如操作系统类型、CPU 内核数量、容器注册表和当前群参与状态。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"黑客创建的容器镜像基于 AlpineOS 系统，并使用底层主机上的root权限来执行恶意代码。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"TrendMicro 报告称，攻击活动还使用受 TeamTNT 控制的受感染 Docker Hub 帐户来投放恶意 Docker 映像。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/79\/790c62ccdb6b9813d66e5a3c243db661.png","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"TeamTNT 是一个老练、高水平的组织，他们不断发展技术，对易受攻击的 Docker 系统带来了持续的威胁。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"2020 年 8 月，他们首先创建了一个蠕虫，通过蠕虫来"},{"type":"link","attrs":{"href":"https:\/\/www.bleepingcomputer.com\/news\/security\/cryptojacking-worm-steals-aws-credentials-from-docker-systems\/","title":null,"type":null},"content":[{"type":"text","text":"利用 Docker 和 Kubernetes"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"2020 年 10 月，"},{"type":"link","attrs":{"href":"https:\/\/www.bleepingcomputer.com\/news\/security\/crypto-mining-malware-adds-linux-password-stealing-capability\/","title":null,"type":null},"content":[{"type":"text","text":"攻击"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"者 "},{"type":"link","attrs":{"href":"https:\/\/www.bleepingcomputer.com\/news\/security\/crypto-mining-malware-adds-linux-password-stealing-capability\/","title":null,"type":null},"content":[{"type":"text","text":"添加了"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" 针对 Docker 实例的"},{"type":"link","attrs":{"href":"https:\/\/www.bleepingcomputer.com\/news\/security\/crypto-mining-malware-adds-linux-password-stealing-capability\/","title":null,"type":null},"content":[{"type":"text","text":"Monero 挖掘"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"和凭据窃取功能。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"2021 年 1 月，TeamTNT 使用"},{"type":"link","attrs":{"href":"https:\/\/www.bleepingcomputer.com\/news\/security\/linux-malware-uses-open-source-tool-to-evade-detection\/","title":null,"type":null},"content":[{"type":"text","text":"复杂的检测规避技巧"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"升级了其矿工，同时可从受感染的服务器中获取用户凭据。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"但Docker 提供了一些“强制”提示，可用于锁定 Docker REST API 并防止这些类型的攻击。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"“因此， "},{"type":"text","marks":[{"type":"italic"},{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"必须"},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":" 使用"},{"type":"link","attrs":{"href":"https:\/\/docs.docker.com\/engine\/security\/protect-access\/","title":null,"type":null},"content":[{"type":"text","text":"HTTPS 和证书"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"来保护 API 端点 ，还建议确保它只能从受信任的网络或 VPN 访问，”Docker 的"},{"type":"link","attrs":{"href":"https:\/\/docs.docker.com\/engine\/security\/","title":null,"type":null},"content":[{"type":"text","text":"安全指南"}],"marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#000000","name":"black"}}],"text":"解释道。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"参考链接："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https:\/\/www.trendmicro.com\/en_sg\/research\/21\/k\/compromised-docker-hub-accounts-abused-for-cryptomining-linked-t.html","title":null,"type":null},"content":[{"type":"text","text":"https:\/\/www.trendmicro.com\/en_sg\/research\/21\/k\/compromised-docker-hub-accounts-abused-for-cryptomining-linked-t.html"}],"marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}]}]}]}