11. June 2021

This article has been indexed from E Hacking News – Latest Hacker News and IT Security News

Microsoft has discovered a new, widespread, ongoing threat that aims to infect Kubernetes clusters running Kubeflow instances with malicious TensorFlow pods that mine cryptocurrencies. Kubeflow is a popular open-source framework for conducting machine learning (ML) tasks in Kubernetes, while TensorFlow is an end-to-end, open-source ML platform. 

Microsoft security experts cautioned on Tuesday that they noticed a rise in TensorFlow pod deployments on Kubernetes clusters at the end of May — pods that were running legal TensorFlow images from the official Docker Hub account. However, a closer examination of the pods’ entry point revealed that they are used to mine cryptocurrency. 

In a post on Tuesday, Yossi Weizman, a senior security research software engineer at Microsoft’s Azure Security Center, said that the “burst” of malicious TensorFlow deployments was “simultaneous,” implying that the attackers scanned the clusters first, kept a list of potential targets, and then fired on all of them at the same time. The attackers used two distinct images, according to Weizman. The first is the most recent version of TensorFlow (tensorflow/tensorflow:latest), and the second is the most recent version with GPU support (tensorflow/tensorflow:latest-gpu). 

According to Weizman, using TensorFlow images in the network “makes a lot of sense,” because “if the images in the cluster are monitored, usage of a legitimate image can prevent attackers from being discovered.” Another rationale for the attackers’ decision is that the TensorFlow image they chose is an easy way to conduct GPU activities using CUDA, which “allows the attacker to optimize the mining gains from the

[…]

Content was cut in order to protect the source.Please visit the source for the rest of the article.

Read the original article: Kubeflow: The Target of Cryptomining Attacks