MISCONFIGURATION (in the cloud) - Leads to "data breach" That was yesterday's news, today, Threat actors have exploited misconfigured Docker containers to deliver cryptomining malware

The attacks weren’t the result of the Docker engine being compromised or problems within Docker’s enterprise platform but instead were the result of misconfiguration set up at the administrator level

The attackers often exploited the misconfigurations to create Docker containers    through exposed API ports and then installing a wget package using system package manager, using wget to download an auto-deployment script, converting the script from DOS to Unix format, setting the executable permissions for the script, and running the script.

In order to prevent similar attacks researchers recommend organizations: harden their security posture; ensure that container images are authenticated, signed, and from a trusted registry; enforce the principle of least privilege; properly configure how much resources containers are allowed to use; and enable Docker’s built-in security features to help defend against threats.

https://www.scmagazine.com/home/security-news/cybercriminals-exploit-misconfigured-container-to-deliver-cryptominer/

With negligent admins , hackers don't have to work hard - A hacker managed to obtain the sensitive documents (U.S. Military Drone Documents) by gaining access to a Netgear router that was using the default FTP login settings for file sharing.

The authentication vulnerability in Netgear routers that hacker exploits to access the sensitive military data was initially discovered two years ago

After gaining access to the network, "the hacker first infiltrated the computer of a captain at 432d Aircraft Maintenance Squadron Reaper AMU OIC, stationed at the Creech AFB in Nevada, and stole a cache of sensitive documents, including Reaper maintenance course books and the list of airmen assigned to Reaper AMU,"

Ironically, a certificate found in the data archive reveals that the captain, whose system was compromised, recently completed the Cyber Awareness Challenge, but he did not set a password for an FTP server hosting sensitive files


https://thehackernews.com/2018/07/dark-web-military-drone_11.html

Why steal data when admins can expose them for you . Check "Misconfig" below.

Another (in)security admin error - By not properly protecting the administration console, Weight Watchers provided all the keys and information needed to gain full root access to their entire cluster. It was too easy.

A critical server for popular weight-loss service Weight Watchers was left unprotected, allowing researchers to take a bite out of dozens of exposed S3 buckets containing company data and AWS access keys.

Researchers at Kromtech Security said that they discovered a Weight Watchers Kubernetes administration console earlier this month that was accessible over the Internet – without any password protection





https://threatpost.com/unprotected-server-exposes-weight-watchers-internal-it-infrastructure/132713/

Why is "misconfiguration" becoming a common theme for data exposure. New story - Sysadmins have left thousands of Redis instances exposed on the Internet without setting authentication. (here is the bad news , Redis is designed to be accessed inside trusted environments, it should not be exposed on the Internet)

Redis, or REmote DIctionary Server, is an open source, widely popular data structure tool that can be used as an in-memory distributed database, message broker or cache. Since it is designed to be accessed inside trusted environments, it should not be exposed on the Internet.

A massive malware campaign designed to target open Redis servers, about which researchers warned almost two months ago, has now grown and already hijacked at least 75% of the total servers running publicly accessible Redis instances.

Out of total compromised servers, 68 percent systems were found infected using similar keys, named "backup1, backup2, backup3," which were attacked from a medium-sized botnet located at China (86% of IPs), according to the data Imperva collected.

Moreover, the attackers have now found using the compromised servers as a proxy to scan and find vulnerabilities, including SQL injection, cross-site scripting, malicious file uploads, and remote code executions, in other websites



https://thehackernews.com/2018/06/redis-server-hacking.html

Along with the "Weakest link", do not forget the "high-risk link" (your cloud app admin) in your security chain. Example - Misconfigured Google Groups can leak sensitive info.

Google Groups are private by default. Many businesses have this configured to "Public on the Internet." As a result, Google Groups can leak emails and expose passwords, financial data, and employee names, addresses, and email addresses.

More than 9,600 institutions - including hospitals, universities, media companies, government agencies, and Fortune 500 organizations - have public Google Groups settings. Of these, researchers found 3,000 are currently leaking some form of sensitive email

It's not just customer data at risk. Google Groups configured to Public can also leave corporate data and internal resources open to the Internet. Kenna's investigation unearthed real emails with GitHub credentials, password recovery, invoices, and suspension documents.

https://www.darkreading.com/cloud/google-groups-misconfiguration-exposes-corporate-data/d/d-id/1331951