Application Security , Containerization & Sandboxing , Data Breach

Attackers Could 'Break Out' via Runc Flaw to Compromise All Containers on Host(jeremy_kirk) • February 12, 2019    Photo: Ian Brown via Flickr/CC

A slew of technology giants have issued fixes for a dangerous vulnerability that could allow a malicious container to "break out" and gain root control of a host system. The emergency updates from the likes of Red Hat, Google and Amazon demonstrate that while containers are a popular and increasingly used computing resource, any underlying flaws pose a serious data security risk.

See Also: Sunset of Windows Server 2008: Migrate with Docker

Containers refer to a standardized way to package application code, configurations and dependencies into what's known as an object. "Containers share an operating system installed on the server and run as resource-isolated processes, ensuring quick, reliable and consistent deployments, regardless of environment," according to Amazon Web Services.

But a flaw, CVE-2019-5736, has been found in runc, which is a lightweight tool for spawning and running containers. The flaw could be exploited by a remote attacker to execute arbitrary code in the environment.

In other words, the knock-on effects resulting from this vulnerability and anyone who successfully exploits it could be severe, writes Scott McCarty, Red Hat's technical product manager for the container subsystem team.

"A cascading set of exploits affecting a wide range of interconnected production systems qualifies as a difficult scenario for any IT organization and that's exactly what this vulnerability represents," he writes.

"Exploiting this vulnerability means that malicious code could potentially break containment, impacting not just a single container, but the entire container host, ultimately compromising the hundreds-to-thousands of other containers running on it," McCarty writes.

Root-Level Code Execution

Runc gets used across many of the popular container platforms, including Docker, cri-o, containerd and Kubernetes, says Aleksa Sarai, one of the maintainers of runc and a senior software engineer with SUSE Linux GmbH. Sarai says the runc flaw also affects LXC, and Apache Mesos has said that it too is affected.

Credit for discovering the flaw goes to security researchers Adam Iwaniuk and Borys Poplawski, Sarai says.

"The vulnerability allows a malicious container to (with minimal user interaction) overwrite the host runc binary and thus gain root-level code execution on the host," Sarai writes.

In order to mount an attack, a malicious container would have to be deployed. Containers that aren't running as root are not affected.

Sarai published a patch as well as generic exploit code that he says vendors requested to ensure customized patches are effective. More specific exploit code will be released on Feb. 18, he says.

Meanwhile, here's what users of specific services need to do:

Amazon: In a security advisory, Amazon says most administrators don't need to take any action, with the exception of users of 11 specific Amazon Web Services offerings. Some of those services may require tweaks, such as launching new instances or following other specifics that are detailed in the advisory. Red Hat: McCarty of Red Hat says the flaw likely won't affect many of its customers, as SELinux - short for security-enhanced Linux - running in targeted enforcing mode would prevent the flaw from being exploited. Red Hat also issued an advisory. Google: In its advisory, Google writes that "Kubernetes Engine (GKE) Ubuntu nodes are affected by these vulnerabilities, and we recommend that you upgrade to the latest patch version as soon as possible, as we detail below." Docker: The same advice applies to popular containerization vendor Docker. It issued an update on Monday - version 18.09.2 - that includes a patch for the flaw.

Containers Are Targets

This isn't the first time a major flaw has been found in a container runtime and it's unlikely to be the last, especially as container popularity keeps rising, McCarty writes.

"Just as Spectre/Meltdown last year represented a shift in security research to processor architectures from software architectures, we should expect that low-level container runtimes like runc and container engines like Docker will now experience additional scrutiny from researchers and potentially malicious actors as well," he writes.

In December 2018, a security researcher revealed a severe vulnerability in Kubernetes, which is popular open-source software for managing Linux applications deployed within containers. The privilege escalation flaw could allow an attacker to steal data or disrupt production applications. In response, Kubernetes service providers rushed to put fixes into place (see Kubernetes Alert: Security Flaw Could Enable Remote Hacking).

Executive Editor Mathew Schwartz also contributed to this report.

Analytics , Blockchain & Cryptocurrency , Data Breach

'Deep Fakes' May Eventually Complicate Identity Verification(jeremy_kirk) • February 11, 2019    An illustration on the website of cryptocurrency exchange Binance shows how users can reset two-step verification. (Source: Binance)

When hackers try to steal someone's bitcoin from a cryptocurrency account, there's a roadblock that invariably appears: a request for a one-time passcode.

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

Some cryptocurrency exchanges mandate that customers use two-step verification. It requires a one-time passcode to be entered after someone logs in with a username and password. It's a crucial security tool that deflects account takeover attempts if thieves have already obtained someone's account credentials.

A one-time passcode may be sent over SMS, but the safer way is to use an authenticator app, such as Authy, Cisco's Duo or Google Authenticator, to generate the code.

Two-step verification is the most common security tool to prevent account takeovers, and it's kept many accounts secure against hostile takeover artists. But what happens if you lose your phone?

If users have not retained their set-up key or backup codes, they are locked out of their accounts. While some authenticator apps do allow syncing across devices, some don't. Resetting it without that information can be a frustrating, days-long process involving the service provider.

Many cryptocurrency exchanges handle this by requiring users to hold up a piece of ID, a sheet of paper with some information written on it, such as a date, and take a photograph of themselves.

Foolproof, right? Not so. There's a market for doctored photographs that aim to persuade exchanges to reset two-step verification, says Alex Holden, CISO at Hold Security, a Wisconsin-based consultancy.

Fake Image: $50

Analysts at Holden's company lurk in dark web hacking forums to learn of new data breaches and fraud techniques. Over the past six months, Holden says he's found some 10,000 doctored photographs, in part because the graphic designers are careless and publicly publish their work.

An altered photo costs $50, Holden says. Some are comically bad cut-and-paste jobs with mismatched pixel grains or glaring contrasts. But untrained eyes may have a hard time flagging the higher-quality fakes.

The people who actually appear in the photos may have no idea that they're part of a scam, Holden says. Their photos have been discovered or stolen and repurposed. Passport or ID details are changed to match the targeted victim's cryptocurrency account.

Cryptocurrency exchanges often have different account tiers. Accounts with higher trading limits or those opened in countries with know-your-customer regulations may require photo ID. But if the exchange doesn't have a photo on file to compare to the submitted one, there's no baseline to detect the ruse.

"Some companies have no ability to assert what their client looks like," Holden says. "They have to actually rely on this type of reset mechanism. How do you detect that there is something wrong with this picture?"

A doctored photo intended to try to reset two-step verification. The photo has been redacted by ISMG. (Source: Alex Holden)

Such fraud highlights the broader problem that has plagued the commercial internet since its inception: Proving identity is difficult because personal data - from credit card data to passport numbers - can be stolen and replayed.

"If there's a mechanism that needs to be overcome, a determined attacker with proper motivation is going to figure out a way around it," says Mark Loveless, a security researcher and authentication expert.

"Right now, the motivation is cash," he says. "They're going to think of some way to disengage whatever authentication may be in place to get access to that money."

Holden says the doctored photos appear to have had some success.

"It's not like hackers publish success rates," Holden says. "But because we know the guys that we are monitoring are actually making money off of it, I'd say yeah."

On the Horizon: Deep Fakes

Reached for comment, cryptocurrency exchanges - which are some of the most targeted businesses online - weren't eager to answer questions, for perhaps obvious reasons, given attackers' attention. But some offered insights.

San Francisco-based Coinbase declined to answer specific questions, but Elliott Suthers, its director of communications, does note that "to reset either the password or 2FA settings requires multiple levels of ID verification."

Kraken, another established exchange in San Francisco, says it requires a custom message to be displayed with each ID confirmation photo. Also, it matches the submitted photo with what it has on file, such as for Tier 3-level accounts. Kraken's exchange allows customers to do leveraged or margin trading, and Tier 3 approved accounts can borrow up to $50,000.

A less-convincing example of a manipulated photo (Source: Alex Holden)

Binance, one of the world's highest-volume exchanges, moved to Japan after China banned cryptocurrency trading. It reports seeing many attempts to hijack accounts with bogus photos. "Unfortunately, we're no stranger to these types of malicious attempts to gain access," it says.

Binance uses an automated risk management system that monitors users' behavior to look for strange actions. If someone wants to reset an account or two-step verification, Binance asks for a set of photos. The individual must also complete a "face verification" step where they record videos of themselves.

"Given the measures we currently have in place, I don't believe this threat is something for Binance to be particularly worried about at the present time," says a Binance customer support representative.

Loveless says requiring a video is clever - for now. But video manipulation is becoming more polished through advances in artificial intelligence, so much so that it has spawned a new category of deceptive content, or deep fakes.

Take the mashup of Jennifer Lawrence with Steve Buscemi's face or the convincing one featuring former President Barack Obama. Those techniques could also eventually be applied to videos created for resetting accounts, Loveless says (see: Face Off: Researchers Battle AI-Generated Deep Fake Videos).

"If someone's properly motivated, they don't even have to get good quality," Loveless says. "They could get something like that and make it a little grainy, and that will be good enough to pass."

Eventually, it will be difficult for service providers to trust nearly anything submitted by users. Loveless says authentication will have to progress, such as by requiring two pieces of biometric data combined with a cryptographic key stored in a hardware security module.

"We will have to keep raising the bar," Loveless says. "Even then, we are still going to encounter difficulty."

Cyberwarfare / Nation-state attacks , Endpoint Security , Fraud Management & Cybercrime

Secretary of State Pompeo Tours Europe to Discuss Countering China, Russia(euroinfosec) • February 11, 2019    U.S. Secretary of State Mike Pompeo arrives in Budapest, Hungary, on Monday for high-level discussions focused in part on countering Russian and Chinese influence. (Photo: State Department)

The Trump administration is leading a broadside against Chinese telecommunications giants Huawei and ZTE. But concerns that Chinese networking gear could be used as backdoors for facilitating state-sponsored surveillance or disrupting critical infrastructure are not limited to America. Multiple countries have banned Chinese equipment from their 5G rollouts or government networks, and more countries are weighing whether they should do so.

See Also: Live Webinar | Underestimated Risk & Overestimated Security: When All You Do Is React, it May Be Too Late

U.S. diplomats have already been meeting European leaders in Brussels, warning them that using Huawei or ZTE would pose a risk to their critical infrastructure, militaries and national security.

"We are saying you need to be very, very cautious, and we are urging folks not to rush ahead and sign contracts with untrusted suppliers from countries like China," an unnamed U.S. official told Reuters last week.

This week, U.S. Secretary of State Mike Pompeo is visiting Hungary, Slovakia and Poland. The State Department has signaled that Huawei and ZTE will feature in the discussions as Pompeo advocates working together to "counter Russian and Chinese influence."

Poland has already signaled that it plans to block Huawei from its 5G rollout.

Last month, officials in Poland arrested a Chinese employee of Huawei as well as a Polish security official on spying charges. In response, Huawei has offered to build a cybersecurity center in Poland, Reuters reported.

Five Eyes' Response

Australia and New Zealand have blocked Huawei and ZTE from networking projects or 5G rollout plans. Both are members of the "Five Eyes" intelligence alliance, together with the U.S., Canada and the U.K.

Last August, a U.S. bill signed into law by President Donald Trump as part of the Defense Authorization Act banned the U.S. government from using Huawei and ZTE equipment. The bill is due to take full effect over the next two years.

President Trump is now reportedly weighing using emergency powers to completely ban Huawei and ZTE from all U.S. telecommunications networks (see: Report: Trump Weighs Executive Order Banning Huawei, ZTE).

The White House has been upping its pressure on Huawei in particular. In late January, the U.S. Justice Department unsealed two indictments against Huawei, charging it with bypassing U.S. sanctions that prohibit sales to North Korea and Iran as well as economic espionage.

Huawei continues to deny that it ever has or ever would aid any country's intelligence establishment.

But the charges show the U.S. is continuing to accuse Chinese firms, including Huawei, of systemically stealing intellectual property via online hack attacks and espionage.

"These charges lay bare Huawei's blatant disregard for the laws of our country and standard global business practices," said FBI Director Christopher Wray. "Companies like Huawei pose a dual threat to both our economic and national security, and the magnitude of these charges make clear just how seriously the FBI takes this threat."

Many Countries Undecided

Canada remains undecided about using Chinese-built equipment in critical networks. Last month, a Canadian official told Reuters that a decision on whether to allow Huawei and ZTE equipment to be used as part of the nation's 5G networks remains "some ways off into the future yet."

Many European countries have said they are seeking consensus on whether Huawei and ZTE should be allowed or banned. During a visit last week to Japan, German Chancellor Angela Merkel said her country would require guarantees from Huawei that it would not steal data as a precondition of using the equipment, Reuters reported.

But in December 2018, the Czech Republic's National Cyber and Information Security Agency warned that Huawei and ZTE software and hardware posed a security threat. Such warnings trigger legal requirements. The Czech Republic is part of the EU as well as NATO.

"A warning means that system administrators in the critical information infrastructure, important information systems or essential service providers are obliged to acknowledge the threat and issue adequate measures," said Dusan Navratil, director of NCISA. "We do not differentiate between state-owned or privately owned systems. Our criterion is whether or not the intrusion of a specific system would have an impact on the functioning of the Czech Republic as a sovereign state."

Already, the Czech Republic's tax authority blocked Huawei from being considered to supply technology for a new tax portal, and the government has signaled that it may fully block Huawei and ZTE from government contracts.

In response, Huawei has threatened to sue.

Many other countries remain on the fence. Last year, India's Department of Telecommunications excluded Huawei and ZTE from its list of companies asked to participate in 5G trials. But many security experts, noting the lack of domestic alternatives, the long-term relationships that Chinese manufacturers have fostered with Indian firms and the affordability of Chinese wares, expect the Indian government to revise its opinion (see: Will Huawei Play a Key Role in 5G Network Development?).

UK Demands Improvements

The U.K. has not officially banned Huawei. But Alex Younger, the head of MI6, Britain's foreign intelligence service, said in a speech delivered last December in St. Andrews, Scotland, that serious questions have yet to be answered.

"We need to decide the extent to which we are going to be comfortable with Chinese ownership of these technologies and these platforms in an environment where some of our allies have taken a quite definite position," Younger said in a response to an audience question about 5G, the BBC reported. "We need to have a conversation. It's not wholly straightforward."

In December 2018, British telecommunications giant BT announced that it will not use Huawei as part of its 5G network. BT says it is removing Huawei equipment from its 3G and 4G networks as well.

'A Difficult Balance'

The choice of whether to exclude Chinese manufacturers is not an easy one to make, especially when attempting to balance espionage and surveillance concerns with innovation and other business imperatives.

"The U.K., like much of the west, struggles to know whether to see China as threat or opportunity," Robert Hannigan, former director of the British intelligence agency GCHQ and now European chairman of the cybersecurity company BlueVoyant, told the Guardian (see: Cybercrime Groups and Nation-State Attackers Blur Together).

"It's a difficult balance," Hannigan said. "My view is that we want the benefits of Chinese technology and inward investment, and we should find ways of managing the risks, pushing back where necessary."

In the U.K., Huawei's operations are monitored by the Huawei Cyber Security Evaluation Center, run by GCHQ. The government launched the center in 2010, which according to the Guardian is "staffed by 35 heavily vetted analysts."

In July 2018, they issued a report warning of serious concerns with Huawei's technology and engineering processes.

"Huawei's processes continue to fall short of industry good practice and make it difficult to provide long-term assurance," they said.

MP Norman Lamb, a Liberal Democrat who chairs the House of Commons science and technology committee, asked Huawei (PDF) how it planned to respond.

In response, Huawei defended itself against suggestions that it was a tool of Chinese state espionage agencies. It also pledged to spend $2 billion to improve its processes.

But in a letter to Lamb last month, the president of Huawei's carrier business group, Ryan Ding, warned that such efforts might take three to five years to come to fruition and said it would be "like replacing components on a high-speed train in motion."

'Trust But Verify' Has Limits

Alan Woodward, a visiting professor of computer science at the U.K.'s University of Surrey, last October told a Parliament joint committee that the country would do itself a disserve by restricting itself to only U.K. companies with U.K.-vetted supply lines.

"There is a spectrum, from 'implicitly trust, come what may' to 'implicitly distrust,' as some of our colleagues in the United States and Australia have said of 5G networks," he testified before the Joint Committee on the National Security Strategy. "I think there is a third way, which is 'trust but verify.' That is the approach we have taken so far in the U.K. For example, when Huawei was supplying the 21st century network, an evaluation cell was set up with vetted people from the government who were able to look at the devices, etc."

Woodward warned that "trust but verify" requires having complete visibility into every aspect of equipment design, production and delivery.

Yet GCHQ's Huawei Cyber Security Evaluation Center found that Huawei was not able to provide required verification for each process.

"As I understand it, Huawei was not able to guarantee, and did not have a process in place to show, that what was coming off the production line and going into the networks was what had been evaluated, which drives a bit of a coach and horses through the evaluation process," Woodward testified.