A dedicated image built by the attacker - usually the attacker hides the main purpose of the image by using various techniques to conceal the malicious elements, or alternatively the attacker is doesn’t hide the main purpose but designs the attack according to his needs.Attackers then nefariously use these images to hijack resources on the host or to launch a Network Denial of Service against a 3 rd party target from the targeted host. For example xmrig/xmrig:latest or douglasslow/slowhttptest:latest, which are designed to mine cryptocurrency or conduct Denial of Service tests in the application layer. A dedicated image built by a 3rd party - this image is designed for a specific purpose.The image is usually one of 3 categories: Docker Hub) and spinning up the container on the targeted host environment. Normally, attacks against misconfigured Docker API are initiated by pulling an image from a public registry (i.e. Moreover, this technique emphasizes the importance of an ongoing dynamic scanning cadence in cloud-native environments. Using a Dynamic Threat Analysis (DTA) scanner that looks for behavior patterns, however, can help the defenders to detect these kinds of attacks. Therefore, in this case, having preliminary intelligence on a malicious image or source would be ineffectual. This makes it hard for defenders to add the image to a restricted list. In addition, the name of the image and possibly its ID are randomly generated and probably unique to each host. Since the image is not stored anywhere, no one will take it down. Additionally, the attacker can thus increase the persistency of his infrastructure by building it directly on the host. In this case, the attacker did not pull an image from a remote source but built it directly on the targeted host in order to bypass these defense mechanisms. A defender, on the other hand, can scan the images and react based on the results, or restrict communication with a suspicious source or registry. In previously observed attack scenarios, the attackers usually try to hijack resources from the host by running a cryptocurrency miner, launch a network denial-of-service attack against other hosts, or worse, escaping from the container and expanding onto the host’s network. As far as we know, this is the first time that an attack in which the attacker builds an image rather than pulling it from a public registry is observed in the wild. The attacker exploits a misconfigured Docker API port in order to build and run a malicious container image on the host. We at Team Nautilus - Aqua’s cyber security research team - discovered a new type of attack against container infrastructure.

Use gifsicle malicious image