Search results

Webinars Panel: 5 ways to Better Manage your Network Security in 2020 Is your network ready for 2020? What practical steps are you taking to prepare for even more demanding security management in the new year? In this live panel discussion, Yitzy Tannenbaum, Product Marketing Manager and Avishai Wool, AlgoSec’s co-founder and CTO, will cover 5 practicalsteps to help you better manage your network security in the new year. Address these pressing network security challenges: Preventing breaches due to network misconfigurations Managing complex compliance requirements Determine the intention of your security controls and embracing intent-based network security Implementing datacenter micro-segmentation Understanding the shared responsibility model and effectively managing cloud security Kick off the new year better prepared to face the network security management challenges – don’t miss this important discussion. January 9, 2020 Prof. Avishai Wool CTO & Co Founder AlgoSec Yitzy Tannenbaum Product Marketing Manager Relevant resources Network security management: Components & features Keep Reading 5 Network Security Management Predictions for 2020 Watch Video 2020 vision predictions for the year ahead in network security Keep Reading Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Learn about the essential firewall change management process. Understand how to implement, track, and control changes to your firewall configurations for optimal security and compliance. Firewall change management process: How does It work? ---- ------- Schedule a Demo Select a size ----- Get the latest insights from the experts Network management & policy change automation Read more https://www.algosec.com/webinar/security-change-management-agility-vs-control/ Watch webinar Security policy change management solution Read more Choose a better way to manage your network

Network security management is crucial for safeguarding physical and virtual networks, reducing risks, and ensuring compliance Discover the essential practices and strategies to protect your network Network security management: Components & features Select a size Which network Can AlgoSec be used for continuous compliance monitoring? Yes, AlgoSec supports continuous compliance monitoring. As organizations adapt their security policies to meet emerging threats and address new vulnerabilities, they must constantly verify these changes against the compliance frameworks they subscribe to. AlgoSec can generate risk assessment reports and conduct internal audits on-demand, allowing compliance officers to monitor compliance performance in real-time. Security professionals can also use AlgoSec to preview and simulate proposed changes to the organization’s security policies. This gives compliance officers a valuable degree of lead-time before planned changes impact regulatory guidelines and allows for continuous real-time monitoring. What is network security management and why do we need it? Who owns network security management and why does it matter? What are the high-stakes tasks in network security management? What are the toughest challenges of network security management? Which approaches do network security management pros use? Which network security management tools are IT pros’ secret weapons? Where do network security management tools make the biggest difference? Network security management FAQs Get the latest insights from the experts Use these six best practices to simplify compliance and risk mitigation with the AlgoSec White paper Learn how AlgoSec can help you pass PCI-DSS Audits and ensure Solution overview See how this customer improved compliance readiness and risk Case study Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Explore Algosec's customer success stories to see how organizations worldwide improve security, compliance, and efficiency with our solutions. ORMAT MANAGES RISK AND NERC COMPLIANCE WITH ALGOSEC Organization ORMAT Industry Technology Headquarters Reno, Nevada, United States Download case study Share Customer
success stories "We’re managing our network security with much greater confidence. With the value of the time we save and our improved compliance readiness, we can clearly see that AlgoSec is delivering on our investment" Global Geothermal Power Producer Improves Security and Compliance and Takes Control of DailyFirewall Management Operations at 14 Global Facilities AlgoSec Business Impact • Automated notifications improve firewall management processes.• Visibility of firewall rules allows better management of security infrastructure.• Built-in reports provide instant proof of SOX and NERC compliance. Background Ormat Technologies, Inc. a world leader in the geothermal power plant sector, is committed to developing green, sustainable energy solutions. The company has installed over 2000 MW of geothermal and Recovered Energy (REG) power plants worldwide. Ormat’s global IT department manages network security and ensures compliance with SOX (Sarbanes-Oxley) regulations and NERC (North American Electric Reliability Corporation) at 14 of its power plants. Challenge Ormat’s firewall configurations typically need updating on a daily basis to address the changing roles and information technology requirements of Ormat’s global employees. As the department has assumed greater responsibility for regulatory compliance in addition to internal operations, firewall management has become cumbersome and costly.“With multiple managers adding and changing firewall configurations at our various locations, we had no way to review each change, see who made it, or know if a change was made at all,” explains Meir Moshka, IT Manager at Ormat. Without this information, reviewing firewall configurations against regulations and standards was difficult and time-consuming. “To stay compliant and secure, we needed better controls for firewall management, but we also had to stay responsive to the employees we serve,” says Moshka. Solution After evaluating several firewall management products, Ormat selected the AlgoSec Security Management solution for its ease of use, and for the superiority of its built-in SOX and NERC compliance reports. “The web user interface is easy and friendly,” comments Moshka. His team installed and tested AlgoSec themselves, in a matter of days. Another capability that drove Ormat to select AlgoSec was its ability to create a workflow for their firewall configuration process. “Every time a change is made, the security manager receives an email describing the new configuration,” says Moshka. “The change is only made after the manager approves it.” The new process will ensure that all configuration changes are properly reviewed. Results Today, in addition to maintaining its network security policies more effectively, Ormat is dramatically reducing the time spent preparing for compliance audits. “Together, the firewall management process and reports keep us ready for an audit at all times. We save a great deal of audit preparation time because we already review each configuration change against the requirements on a daily basis.” Automated compliance reporting also gives Ormat the power to demonstrate compliance to customers and prospects, as the company pursues new contracts for power plant operations in the US. “By using the built-in reports, we can instantly show we are NERC and SOX compliant. It’s a valuable proof for the plant owners.” Moshka and his team also rely on AlgoSec’s built-in knowledgebase of best practices for firewall configuration. Additionally, they have customized the out-of-the-box functionality by defining additional risks that apply to Ormat’s environment. With their customized risk profile in place, each firewall configuration change is evaluated against the knowledgebase to determine which configurations to improve or avoid. “Often, a change to the firewall needs to be more restrictive than we thought,” says Moshka. “AlgoSec gives us recommendations for each new change, and we minimize security risks by following them.” Another improvement is how AlgoSec’s policy cleanup and optimization features ensure Ormat’s security policy is streamlined and easy to maintain. “Now I see exactly which policy applies to which firewall, which rules are duplicated, expired, or unused, and get recommendations on the most effective way to reorder the most used rules,” says Moshka. With AlgoSec, Ormat has taken back control for its firewall policies and compliance requirements. “We’re managing our network security with much greater confidence,” Moshka says. “Add together the value of the time we save on a daily basis, and our improved compliance readiness, and we can clearly see that AlgoSec is delivering on our investment.” Schedule time with one of our experts

Explore Algosec's customer success stories to see how organizations worldwide improve security, compliance, and efficiency with our solutions. PORSCHE INFORMATIK SIMPLIFIES NETWORK OPERATIONS AND STRENGTHENS SECURITY Organization PORSCHE Industry Retail & Manufacturing Headquarters Austria Download case study Share Customer
success stories "We quickly saw a clear return on our investment with AlgoSec. It enabled us to significantly increase the efficiency of our firewall operations team without increasing head count. With AlgoSec, We can focus on what is most important to Porsche Informatik: our customers" Leading European Automobile Trading Enterprise Increases Security, Ensures Compliance, Optimizes Firewall Operations and Streamlines Productivity AlgoSec Business Impact • Increase IT productivity without adding headcount• Reduce time and resources required to implement firewall policy changes• Improve IT Governance and accountability over the network security policy• Improve security posture and gain visibility into the impact of proposed changes Background Porsche Informatik GmbH, a subsidiary of Porsche Holding, is one of the biggest private trading enterprises in Austria and the most successful automobile trade companies in Europe. The Company provides integrated software solutions for the automobile sector serving importers, retailers and financial service providers in over 21 countries. With its multi-vendor, multi-firewall infrastructure consisting of various Check Point clusters and firewalls, Porsche Informatik has been supporting some of the most successful automobile brands in the world including Volkswagen, Audi, Porsche, Seat and Skoda. Challenge As an enterprise serving the leading automobile brands, Porsche Informatik is committed to ensuring the integrity of its network and maintaining compliance with corporate security policies. Optimizing its operations is another top priority. With a large number of firewalls undergoing continuous rule changes, Porsche Informatik’s team had to manually confirm that all of the changes were correctly configured and adhered to corporate policy. To do this, Porsche Informatik needed to keep track of changes: when they were made, who made them and verify that they weren’t introducing clutter and subsequent risk into their environment. “As the rule base continued to grow, it became increasingly complex and harder to keep track of the details,” says Anton Spitzer, Infrastructure Services Manager at Porsche Informatik. “Monitoring and auditing of our firewalls and clusters has become a painstaking manual, time and labor intensive process and we needed to handle it more effectively.” Porsche Informatik looked for a solution that would allow them to automatically and comprehensively manage the entire change lifecycle of their heterogeneous firewall infrastructure to improve and optimize operations, bolster security and comply with the corporate security policy in an easier way. Solution Porsche Informatik selected the AlgoSec Security Management solution to provide automated, comprehensive firewall operations and security risk management.In particular, Porsche Informatik liked AlgoSec’s auditing capability as it tracks changes in real-time as well as provides analysis of the operational and security implications of those changes. Results With AlgoSec, Porsche Informatik can now intelligently automate manual, labor and time intensive tasks, optimize firewall operations and improve network security while enforcing corporate policies to provide improved IT Governance.“AlgoSec allows our team to quickly and easily understand the operational and security impact of rule changes on our corporate policy, while at the same time provides a detailed audit trail, which is crucial for us to maintain compliance,” says Spitzer. From an operations and risk perspective, AlgoSec enables Porsche Informatik to instantly know which rules and objects are obsolete, invalid and duplicate and where potential security holes exist. The ability to clean up the firewall policy has streamlined network operations and given Porsche Informatik better visibility into their firewall infrastructure. “We cleaned up our existing policy base and now utilize the “what if” analysis to prevent the introduction of clutter and risk into our environment,” explains Spitzer.Ultimately, with AlgoSec, Porsche Informatik can now easily determine the necessity of changes and their potential security implications which saves time and effort. As a result productivity has increased without adding headcount. “After several months of use, AlgoSec has made a quantifiable impact on our firewall operations and security risk management. We know exactly what changes are being made, by whom and the implications of those changes on our operations and security posture,” said Spitzer. “We now spend much less time analyzing and auditing our firewalls, allowing our IT personnel to work on additional projects. As a customer-centric company, optimized internal operations directly benefits our clients by allowing Porsche Informatik to focus wholly on their needs instead of on firewall management.” Schedule time with one of our experts

Learn best practices to secure your cloud environment and deliver applications securely Webinars State of Ransomware: Caught between perception and reality Ransomware continues to be a major problem—and the problem is only getting worse. An exclusive ExtraHop 2022 survey conducted with over 500 security and IT decision makers provided some sobering responses: 85% of those surveyed reported suffering at least one ransomware attack while an alarming 74% have experienced multiple attacks. Yet most IT decision makers (77%) are confident in their ability to prevent or mitigate all cybersecurity threats, including ransomware. In this webinar, we take an in-depth look into the implications of this alarming trend and provide a turnkey strategy that organizations can implement today to safeguard their most critical data stored in their business applications and increase their level of ransomware preparedness. Join us for: * In-depth analysis of infamous ransomware attacks * Ways to identify and remediate vulnerabilities at the application level * A practical application centric approach that can support your pre-existing security measures * Mitigation measures to consider at the onset of your next ransomware attack * Ransomware future trends predictions January 24, 2023 Eric Jeffery Regional Sales Engineer Relevant resources Reducing risk of ransomware attacks - back to basics Keep Reading Fighting Ransomware - CTO Roundtable Insights Keep Reading Ransomware Attack: Best practices to help organizations proactively prevent, contain and Keep Reading Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Introduction   Imagine your sensitive business data falling into the wrong hands. A data breach can be devastating, leading to financial... Cloud Security What Is Cloud Encryption? Your Key to Data Security Asher Benbenisty 2 min read Asher Benbenisty Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 12/16/24 Published Introduction Imagine your sensitive business data falling into the wrong hands. A data breach can be devastating, leading to financial losses, legal headaches, and irreparable damage to your reputation. Cloud encryption is your key to protecting your valuable data and ensuring peace of mind in the cloud. In this article, we'll explore cloud encryption and how AlgoSec can help you implement it effectively. We'll cover the basics of encryption, its benefits, the challenges you might face, and best practices to ensure your data stays safe. What Is Cloud Encryption? Cloud encryption is like creating a secret code for your data. It scrambles your information so that only authorized people with the key can read it. This process ensures that even if someone gains unauthorized access to your data, they won't be able to understand or use it. Cloud encryption is essential for protecting sensitive information like customer data, financial records, and intellectual property. It helps organizations meet compliance requirements, maintain data privacy, and safeguard their reputation. Encryption in Action: Protecting Data at Rest and in Transit Cloud encryption can be used to protect data in two states: Data at Rest: This refers to data that is stored in the cloud, such as in databases or storage buckets. Encryption ensures that even if someone gains access to the storage, they can't read the data without the encryption key. Data in Transit: This refers to data that is moving between locations, such as between your computer and a cloud server. Encryption protects the data while it travels over the internet, preventing eavesdropping and unauthorized access. How does it work? Cloud encryption uses algorithms to transform your data into an unreadable format. Think of it like this: Symmetric encryption: You and the recipient have the same key to lock (encrypt) and unlock (decrypt) the data. It's like using the same key for your front and back door. Asymmetric encryption: There are two keys: a public key to lock the data and a private key to unlock it. It's like having a mailbox with a slot for anyone to drop mail in (public key), but only you have the key to open the mailbox (private key). Why Encrypt Your Cloud Data? Cloud encryption offers a wide range of benefits: Compliance: Avoid costly fines and legal battles by meeting compliance requirements like GDPR, HIPAA, and PCI DSS. Data Protection: Safeguard your sensitive data, whether it's financial transactions, customer information, or intellectual property. Control and Ownership: Maintain control over your data and who can access it. Insider Threat Protection: Reduce the risk of data breaches caused by malicious or negligent employees. Multi-Tenancy Security: Enhance data security and isolation in shared cloud environments. Cloud Encryption Challenges (and How AlgoSec Helps) While cloud encryption is essential, it can be complex to manage. Here are some common challenges: Key Management: Securely managing encryption keys is crucial. Losing or mismanaging keys can lead to data loss. AlgoSec Solution: AlgoSec provides a centralized key management system to simplify and secure your encryption keys. Compliance: Meeting various regional and industry-specific regulations can be challenging. AlgoSec Solution: AlgoSec helps you navigate compliance requirements and implement appropriate encryption controls. Shared Responsibility: Understanding the shared responsibility model and your role in managing encryption can be complex. AlgoSec Solution: AlgoSec provides clear guidance and tools to help you fulfill your security responsibilities. Cloud Encryption Best Practices Encrypt Everything: Encrypt data both at rest and in transit. Choose Strong Algorithms: Use strong encryption algorithms like AES-256. Manage Keys Securely: Use a key management system (KMS) like the one provided by AlgoSec to automate and secure key management. Control Access: Implement strong access controls and identity management systems. Stay Compliant: Adhere to industry standards and regulations. Monitor and Audit: Regularly monitor your encryption implementation and conduct audits to ensure ongoing effectiveness. Conclusion Protecting your data in the cloud is non-negotiable. Cloud encryption is a fundamental security measure that every organization should implement. By understanding the benefits, challenges, and best practices of cloud encryption, you can make informed decisions to safeguard your sensitive information. Ready to protect your cloud data with encryption? AlgoSec helps businesses ensure data confidentiality and drastically lower the risk of cloud security incidents. Dive deeper into cloud security: Read our previous blog posts, Unveiling Cloud's Hidden Risks, A Secure VPC as the Main Pillar of Cloud Security, Azure Best Practices and Kubernetes Security Best Practices to uncover the top challenges and learn how to gain control of your cloud environment. These articles will equip you with the knowledge and tools to strengthen your cloud defenses. Subscribe to our blog to stay informed and join us on the journey to a safer and more resilient cloud future. Have a specific cloud security challenge? Contact us today for a free consultation. Want to learn more about how AlgoSec can help you secure your Kubernetes environment? Request a free demo today! Schedule a demo Related Articles Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Convergence didn’t fail, compliance did. Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

UseCase Cisco ACI Policy Migration Download PDF Schedule time with one of our experts Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Network Is A Maze AlgoSec Download PDF Schedule time with one of our experts Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Enterprise hybrid network management solutions Download PDF Schedule time with one of our experts Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

As you may have heard already, the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) released a joint... Cloud Security Drovorub’s Ability to Conceal C2 Traffic And Its Implications For Docker Containers Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 8/15/20 Published As you may have heard already, the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory about previously undisclosed Russian malware called Drovorub. According to the report, the malware is designed for Linux systems as part of its cyber espionage operations. Drovorub is a Linux malware toolset that consists of an implant coupled with a kernel module rootkit, a file transfer and port forwarding tool, and a Command and Control (C2) server. The name Drovorub originates from the Russian language. It is a complex word that consists of 2 roots (not the full words): “drov” and “rub” . The “o” in between is used to join both roots together. The root “drov” forms a noun “drova” , which translates to “firewood” , or “wood” . The root “rub” /ˈruːb/ forms a verb “rubit” , which translates to “to fell” , or “to chop” . Hence, the original meaning of this word is indeed a “woodcutter” . What the report omits, however, is that apart from the classic interpretation, there is also slang. In the Russian computer slang, the word “drova” is widely used to denote “drivers” . The word “rubit” also has other meanings in Russian. It may mean to kill, to disable, to switch off. In the Russian slang, “rubit” also means to understand something very well, to be professional in a specific field. It resonates with the English word “sharp” – to be able to cut through the problem. Hence, we have 3 possible interpretations of ‘ Drovorub ‘: someone who chops wood – “дроворуб” someone who disables other kernel-mode drivers – “тот, кто отрубает / рубит драйвера” someone who understands kernel-mode drivers very well – “тот, кто (хорошо) рубит в драйверах” Given that Drovorub does not disable other drivers, the last interpretation could be the intended one. In that case, “Drovorub” could be a code name of the project or even someone’s nickname. Let’s put aside the intricacies of the Russian translations and get a closer look into the report. DISCLAIMER Before we dive into some of the Drovorub analysis aspects, we need to make clear that neither FBI nor NSA has shared any hashes or any samples of Drovorub. Without the samples, it’s impossible to conduct a full reverse engineering analysis of the malware. Netfilter Hiding According to the report, the Drovorub-kernel module registers a Netfilter hook. A network packet filter with a Netfilter hook ( NF_INET_LOCAL_IN and NF_INET_LOCAL_OUT ) is a common malware technique. It allows a backdoor to watch passively for certain magic packets or series of packets, to extract C2 traffic. What is interesting though, is that the driver also hooks the kernel’s nf_register_hook() function. The hook handler will register the original Netfilter hook, then un-register it, then re-register the kernel’s own Netfilter hook. According to the nf_register_hook() function in the Netfilter’s source , if two hooks have the same protocol family (e.g., PF_INET ), and the same hook identifier (e.g., NF_IP_INPUT ), the hook execution sequence is determined by priority. The hook list enumerator breaks at the position of an existing hook with a priority number elem->priority higher than the new hook’s priority number reg->priority : int nf_register_hook ( struct nf_hook_ops * reg) { struct nf_hook_ops * elem; int err; err = mutex_lock_interruptible( & nf_hook_mutex); if (err < 0 ) return err; list_for_each_entry(elem, & nf_hooks[reg -> pf][reg -> hooknum], list) { if (reg -> priority < elem -> priority) break ; } list_add_rcu( & reg -> list, elem -> list.prev); mutex_unlock( & nf_hook_mutex); ... return 0 ; } In that case, the new hook is inserted into the list, so that the higher-priority hook’s PREVIOUS link would point into the newly inserted hook. What happens if the new hook’s priority is also the same, such as NF_IP_PRI_FIRST – the maximum hook priority? In that case, the break condition will not be met, the list iterator list_for_each_entry will slide past the existing hook, and the new hook will be inserted after it as if the new hook’s priority was higher. By re-inserting its Netfilter hook in the hook handler of the nf_register_hook() function, the driver makes sure the Drovorub’s Netfilter hook will beat any other registered hook at the same hook number and with the same (maximum) priority. If the intercepted TCP packet does not belong to the hidden TCP connection, or if it’s destined to or originates from another process, hidden by Drovorub’s kernel-mode driver, the hook will return 5 ( NF_STOP ). Doing so will prevent other hooks from being called to process the same packet. Security Implications For Docker Containers Given that Drovorub toolset targets Linux and contains a port forwarding tool to route network traffic to other hosts on the compromised network, it would not be entirely unreasonable to assume that this toolset was detected in a client’s cloud infrastructure. According to Gartner’s prediction , in just two years, more than 75% of global organizations will be running cloud-native containerized applications in production, up from less than 30% today. Would the Drovorub toolset survive, if the client’s cloud infrastructure was running containerized applications? Would that facilitate the attack or would it disrupt it? Would it make the breach stealthier? To answer these questions, we have tested a different malicious toolset, CloudSnooper, reported earlier this year by Sophos. Just like Drovorub, CloudSnooper’s kernel-mode driver also relies on a Netfilter hook ( NF_INET_LOCAL_IN and NF_INET_LOCAL_OUT ) to extract C2 traffic from the intercepted TCP packets. As seen in the FBI/NSA report, the Volatility framework was used to carve the Drovorub kernel module out of the host, running CentOS. In our little lab experiment, let’s also use CentOS host. To build a new Docker container image, let’s construct the following Dockerfile: FROM scratch ADD centos-7.4.1708-docker.tar.xz / ADD rootkit.ko / CMD [“/bin/bash”] The new image, built from scratch, will have the CentOS 7.4 installed. The kernel-mode rootkit will be added to its root directory. Let’s build an image from our Dockerfile, and call it ‘test’: [root@localhost 1]# docker build . -t test Sending build context to Docker daemon 43.6MB Step 1/4 : FROM scratch —> Step 2/4 : ADD centos-7.4.1708-docker.tar.xz / —> 0c3c322f2e28 Step 3/4 : ADD rootkit.ko / —> 5aaa26212769 Step 4/4 : CMD [“/bin/bash”] —> Running in 8e34940342a2 Removing intermediate container 8e34940342a2 —> 575e3875cdab Successfully built 575e3875cdab Successfully tagged test:latest Next, let’s execute our image interactively (with pseudo-TTY and STDIN ): docker run -it test The executed image will be waiting for our commands: [root@8921e4c7d45e /]# Next, let’s try to load the malicious kernel module: [root@8921e4c7d45e /]# insmod rootkit.ko The output of this command is: insmod: ERROR: could not insert module rootkit.ko: Operation not permitted The reason why it failed is that by default, Docker containers are ‘unprivileged’. Loading a kernel module from a docker container requires a special privilege that allows it doing so. Let’s repeat our experiment. This time, let’s execute our image either in a fully privileged mode or by enabling only one capability – a capability to load and unload kernel modules ( SYS_MODULE ). docker run -it –privileged test or docker run -it –cap-add SYS_MODULE test Let’s load our driver again: [root@547451b8bf87 /]# insmod rootkit.ko This time, the command is executed silently. Running lsmod command allows us to enlist the driver and to prove it was loaded just fine. A little magic here is to quit the docker container and then delete its image: docker rmi -f test Next, let’s execute lsmod again, only this time on the host. The output produced by lsmod will confirm the rootkit module is loaded on the host even after the container image is fully unloaded from memory and deleted! Let’s see what ports are open on the host: [root@localhost 1]# netstat -tulpn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1044/sshd With the SSH server running on port 22 , let’s send a C2 ‘ping’ command to the rootkit over port 22 : [root@localhost 1]# python client.py 127.0.0.1 22 8080 rrootkit-negotiation: hello The ‘hello’ response from the rootkit proves it’s fully operational. The Netfilter hook detects a command concealed in a TCP packet transferred over port 22 , even though the host runs SSH server on port 22 . How was it possible that a rootkit loaded from a docker container ended up loaded on the host? The answer is simple: a docker container is not a virtual machine. Despite the namespace and ‘control groups’ isolation, it still relies on the same kernel as the host. Therefore, a kernel-mode rootkit loaded from inside a Docker container instantly compromises the host, thus allowing the attackers to compromise other containers that reside on the same host. It is true that by default, a Docker container is ‘unprivileged’ and hence, may not load kernel-mode drivers. However, if a host is compromised, or if a trojanized container image detects the presence of the SYS_MODULE capability (as required by many legitimate Docker containers), loading a kernel-mode rootkit on a host from inside a container becomes a trivial task. Detecting the SYS_MODULE capability ( cap_sys_module ) from inside the container: [root@80402f9c2e4c /]# capsh –print Current: = cap_chown, … cap_sys_module, … Conclusion This post is drawing a parallel between the recently reported Drovorub rootkit and CloudSnooper, a rootkit reported earlier this year. Allegedly built by different teams, both of these Linux rootkits have one mechanism in common: a Netfilter hook ( NF_INET_LOCAL_IN and NF_INET_LOCAL_OUT ) and a toolset that enables tunneling of the traffic to other hosts within the same compromised cloud infrastructure. We are still hunting for the hashes and samples of Drovorub. Unfortunately, the YARA rules published by FBI/NSA cause False Positives. For example, the “Rule to detect Drovorub-server, Drovorub-agent, and Drovorub-client binaries based on unique strings and strings indicating statically linked libraries” enlists the following strings: “Poco” “Json” “OpenSSL” “clientid” “—–BEGIN” “—–END” “tunnel” The string “Poco” comes from the POCO C++ Libraries that are used for over 15 years. It is w-a-a-a-a-y too generic, even in combination with other generic strings. As a result, all these strings, along with the ELF header and a file size between 1MB and 10MB, produce a false hit on legitimate ARM libraries, such as a library used for GPS navigation on Android devices: f058ebb581f22882290b27725df94bb302b89504 56c36bfd4bbb1e3084e8e87657f02dbc4ba87755 Nevertheless, based on the information available today, our interest is naturally drawn to the security implications of these Linux rootkits for the Docker containers. Regardless of what security mechanisms may have been compromised, Docker containers contribute an additional attack surface, another opportunity for the attackers to compromise the hosts and other containers within the same organization. The scenario outlined in this post is purely hypothetical. There is no evidence that supports that Drovorub may have affected any containers. However, an increase in volume and sophistication of attacks against Linux-based cloud-native production environments, coupled with the increased proliferation of containers, suggests that such a scenario may, in fact, be plausible. Schedule a demo Related Articles Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Convergence didn’t fail, compliance did. Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

A ZeroTrust network architecture mitigates risk by only providing the minimally required access to your network resources But implementing it is easier said than done Webinars Micro-segmentation – from Strategy to Execution Organizations heavily invest in security solutions to keep their networks safe, but still struggle to close the security gaps. Micro-segmentation helps protect against the lateral movement of malware and minimizes the risk of insider threats. Micro-segmentation has received lots of attention as a possible solution, but many IT security professionals aren’t sure where to begin or what approach to take. In this practical webinar, Prof. Avishai Wool, AlgoSec’s CTO and co-founder will guide you through each stage of a micro-segmentation project – from developing the correct micro-segmentation strategy to effectively implementing it and continually maintaining your micro-segmented network. Register now for this live webinar and get a practical blueprint to creating your micro-segmentation policy: What is micro-segmentation. Common pitfalls in micro-segmentation projects and how to avoid them. The stages of a successful micro-segmentation project. The role of policy change management and automation in micro-segmentation. Don’t forget to also click on the links in the Attachments tab. July 7, 2020 Prof. Avishai Wool CTO & Co Founder AlgoSec Relevant resources Microsegmentation Defining Logical Segments Watch Video Micro-Segmentation based Network Security Strategies Keep Reading Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue