From Illuminating to Eliminating Crypto Jacking Techniques in Cloud Native
summary
Research from Aqua's Nautilus team shows cryptojackers move from browser and unpatched hosts into containers, Kubernetes and CI/CD by exploiting exposed Docker daemon ports, misconfigured kubelets and dashboards, and typosquatted images in registries. Campaigns hijack GitHub Actions with up to 20 parallel jobs, push miners via dependency confusion and npm-wrapped rootkits, and optimize miners with huge pages +50% efficiency. Detection and defense examples include Trivy and Chain-bench for scanning and Tracee (eBPF) for runtime rootkit/file detection.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:05What is crypto mining?
- 1:44To Become a Crypto Miner
- 2:35The Birth of Cryptojacking
- 4:51Why is it so appealing?
- 14:23CICD Free-Tier Hijacking
- 19:06Shift Left Cryptojacking
- 24:15Risks Prevention
- 27:08Detection
related talks
50mThe Anatomy of Cloud Attacks
44mContainers Everywhere: Advanced Threat Actors Heavily Leverage Them
31mPrepare to Be Boarded! A Tale of Kubernetes, Plunder, and Cryptobooty
41mIdentifying and Mitigating Cloud and Container Threats
28mWhere Are All of the Container Breaches?
18mSecuring cloud innovation: Lessons learned
39mReal-World Detection Evasion Techniques in the Cloud
28mHow We Stopped a Crypto-mining Attack in Kubernetes Caused...