Kinsing Cryptojacking Hits Kubernetes Clusters via Misconfigured PostgreSQL

Jan 09, 2023Ravie LakshmananKubernetes / Cryptojacking

The threat actors behind the Kinsing
cryptojacking operation have been spotted exploiting misconfigured
and exposed PostgreSQL servers to obtain initial access to
Kubernetes environments.

A second initial access vector technique entails the use of
vulnerable images, Sunders Bruskin, security researcher at
Microsoft Defender for Cloud, said^[1]
in a report last week.

Kinsing has a storied history^[2]
of targeting containerized environments^[3], often leveraging
misconfigured open Docker daemon API ports as well as abusing newly
disclosed exploits to drop cryptocurrency mining software.

The threat actor, in the past, has also been discovered employing a rootkit^[4]
to hide its presence, in addition to terminating and uninstalling
competing resource-intensive services and processes.

Now according to Microsoft, misconfigurations in PostgreSQL servers^[5]
have been co-opted by the Kinsing actor to gain an initial
foothold, with the company observing a “large amount of clusters”
infected in this manner.

The misconfiguration relates to a trust authentication setting^[6], which could be abused
to connect to the servers sans any authentication and achieve code
execution should the option be set up to accept connections from
any IP address.

“In general, allowing access to a broad range of IP addresses is
exposing the PostgreSQL container to a potential threat,” Bruskin
explained.

The alternative attack vector targets servers with vulnerable
versions of PHPUnit, Liferay, WebLogic, and WordPress that are
susceptible to remote code execution in order to run malicious
payloads.

What’s more, a recent “widespread campaign” involved the
attackers scanning for open default WebLogic port 7001^[7], and if found, executing
a shell command to launch the malware.

“Exposing the cluster to the Internet without proper security
measures can leave it open to attack from external sources,”
Bruskin said. “In addition, attackers can gain access to the
cluster by taking advantage of known vulnerabilities in
images.”