Threat Actors Exploit Docker Remote API to Deploy SRBMiner Crypto Miner

EXECUTIVE SUMMARY:

An attack targeted Docker remote API server, exploiting misconfigurations to deploy the SRBMiner cryptominer and mine XRP cryptocurrency. Docker is a widely used containerization platform that allows developers to build, test, and deploy applications. Its remote API feature, which facilitates the management of containers, images, and volumes, poses a security risk when exposed to the internet without proper protection. This attack demonstrates how threat actors can leverage such vulnerabilities for malicious purposes.[emaillocker id="1283"]

The attacker began by assessing the availability and version of the Docker API before upgrading the connection to gRPC over h2c (clear text HTTP/2), a protocol chosen to avoid detection by traditional security measures. After confirming the API version, the actor interacted with Docker’s gRPC methods, including health checks, file synchronization, and authentication mechanisms, to manipulate Docker functionalities. The attacker then initiated a process to build a Docker container using a malicious Dockerfile, which included downloading and deploying the SRBMiner cryptominer from GitHub. Once deployed, the cryptominer was configured to mine XRP and send the mined currency to a wallet associated with the attacker’s public IP address.

This attack highlights the vulnerabilities inherent in Docker’s remote API feature when left exposed and inadequately secured. By exploiting gRPC over h2c, the attacker was able to bypass common security solutions and deploy a cryptominer on the Docker host. This case underscores the importance of securing remote API servers, ensuring proper access controls, and monitoring for unusual activity to protect containerized environments from malicious exploitation.

THREAT PROFILE:

REFERENCES:

The following reports contain further technical details:
https://thehackernews.com/2024/10/cybercriminals-exploiting-docker-api.html