Actu
Microsoft Analysis Finds Misconfigured Kubeflow Workloads are a Security Risk
June 2020 by WEI LIEN DANG, CO-FOUNDER AND CHIEF STRATEGY OFFICER AT STACKROX
A unique cyberattack campaign that targets Kubeflow, a machine-learning
toolkit for Kubernetes, has affected large swathes of container
clusters, according to Microsoft.
Kubeflow is an open-source project, started as a project for running
TensorFlow jobs on Kubernetes. Kubeflow has grown and become a popular
framework for running machine learning tasks in Kubernetes. Nodes that
are used for ML tasks are often relatively powerful, and in some cases
include GPUs. This fact makes Kubernetes clusters that are used for ML
tasks a perfect target for crypto mining campaigns, which was the aim of
this attack.
According to an analysis, a suspicious Kubeflow image was seen deployed
to thousands of clusters in April, all from a single public repository.
Closer inspection showed that the image runs a common open-source
cryptojacking malware that mines the Monero virtual currency, known as
XMRIG.
WEI LIEN DANG, CO-FOUNDER AND CHIEF STRATEGY OFFICER AT STACKROX, A
MOUNTAIN VIEW, CALIF.-BASED LEADER IN SECURITY FOR CONTAINERS AND
KUBERNETES:
"Cryptojacking is a still a popular attack. It’s a threat similar to the
backdoored Docker Hub images or the Unit 42 cryptojacking "worm".
Organizations should be mindful of the registries that users/clusters
are allowed to download from. They should use private trusted
registries, whitelist allowed images, and take other precautions to
verify source assets. As Kubernetes clusters get larger and more
powerful (as in this case with GPUs to run ML), they’ll become even more
attractive for this type of attack. Organizations must take specific
steps to ensure they’re protecting their container and Kubernetes assets
across build, deploy, and runtime."
