25% of Businesses Targeted with Cryptojacking in the Cloud

New public cloud security report detects a spike in cryptojacking, mismanaged cloud storage, account takeover, and major patches getting overlooked.

It seems like only yesterday we learned about the first of many Amazon S3 bucket leaks to expose troves of personal information in 2017. Poor cloud configuration was only one security issue to plague businesses last year; now, they have several to worry about.
RedLocks second annual Cloud Security Trends report digs into lessons learned from attacks and breaches over the past year. Researchers found the top issues in the cloud are account compromises, which affected 27% of organizations, cryptojacking (25%), risky configurations (51%), and missing high-severity patches in the cloud (24%).
Twelve months ago, in everyones minds, the biggest thing was cloud misconfigurations, S3 buckets, says RedLock cofounder and CEO Varun Badhwar. By now, the threats have escalated.
On average, 27% of organizations experienced potential account compromise, including major companies Uber, Tesla, OneLogin, Aviva, and Gemalto. Risky configurations affected 51%; among them were FedEx, Deep Root Analytics, and Under Armour. Nearly one-quarter (24%), including Drupal, MongoDB, Elasticsearch, and Intel, missed high-severity patches in the cloud.
Cryptojacking has gone mainstream as attackers have unprecedented access to high-powered public cloud computing resources, affecting major corporations like Tesla, Gemalto, and Aviva. One-quarter of organizations had cryptojacking in their environments, compared with just 8% last year. Badhwar says activity has ramped up 300% in the last quarter, partially because the bar to enter the world of cryptomining is low and the payoff is high.
Once the attackers are in, the ease of the cloud is really what makes it possible, he notes. They can spin up an infinite number of resources … its really a question of how aggressive they want to be. For some organizations, cryptomining incidents can cost between $50-100K per day, for every day an attacker is mining digital currency undetected on their network.
Researchers
also noticed account compromise has led to new attack vectors. Leaked credentials have been found in GitHub repositories, unsecured Kubernetes administrative interfaces, and public Trello boards; now, public cloud instance metadata APIs are an attack vector.
Public cloud instance metadata is data about your instance that can be used toconfigure or manage the running instance, researchers report. Essentially, an instances metadata can be queried via an API to obtain access credentials to the public cloud environment by any process running on the instance. Account compromise will continue to evolve, they anticipate.
There was a spot of good news in the report, Badhwar notes. One year ago, 82% of corporate databases were not encrypted. Now the number has dropped to 49%, marking a 67% improvement. However, he continues, the decline is most likely due to compliance and not because companies are becoming more security-conscious overall.
I have to say, because this is one of those outlier trends related to improvement … Im more inclined to say the majority is driven by the visibility and audits that GDPR is driving, he says. This isnt to say companies are excelling in compliance, however. Researchers found on average, businesses fail 30% of CIS Foundations best practices, 50% of PCI requirements, and 23% of NIST CSF requirements.
Visibility, along with speed of innovation, are two factors causing challenges in the cloud, Badhwar adds. As organizations rapidly adopt cloud services, security teams are often left in the dark when it comes to the applications developers are putting in the cloud. The cloud provides new tools and features to developers, who want to use them right away and dont consult with security as theyre building.
When you dont have visibility, how can you do any security or policy enforcement? Badhwar points out.
Related Content:
Taming the Chaos of Application Security: We Built an App for That
Gandcrab Ransomware Exploits Website Vulnerabilities
8 Ways Hackers Can Game Air Gap Protections
Risky Business: Deconstructing Ray Ozzies Encryption Backdoor

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
25% of Businesses Targeted with Cryptojacking in the Cloud