ghost robbers in the cloud finding crypto miners › resources › papers › telaviv2019 ›...
TRANSCRIPT
![Page 1: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/1.jpg)
Ghost Robbers In The Cloud Finding Crypto Miners
Shira ShambanDome9 Security (acquired by CheckPoint)
0
![Page 2: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/2.jpg)
Money Heist – Let’s Review…
2
![Page 3: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/3.jpg)
Finders Keepers, Losers Weepers
3
![Page 4: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/4.jpg)
The 21st Century Gold Rush
“Overtaking Ransomware, Cryptominers affected over 42% of organizations worldwide, compared to 20.5% at the end of 2017”CheckPoint
CheckPoint
“During the first six months of 2018, Cryptomining attacks are estimated to have ‘earned’ their users more than $2.5 billion”4
![Page 5: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/5.jpg)
It WILL Be Your Fault
“Through 2022, at least 95% of cloud security failures will be the customer’s fault” Gartner
5
![Page 6: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/6.jpg)
MMM
6
![Page 7: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/7.jpg)
How?
7
![Page 8: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/8.jpg)
Docker
Containers!
8
![Page 9: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/9.jpg)
9
![Page 10: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/10.jpg)
10
![Page 11: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/11.jpg)
11
![Page 12: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/12.jpg)
MVD – minimal viable detection
Production environment
12
![Page 13: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/13.jpg)
MVD – minimal viable detection
Production environment –no standard services
13
![Page 14: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/14.jpg)
MVD – minimal viable detection
Miner traffic
14
![Page 15: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/15.jpg)
Tell-Tale Signs…
• Scan the code
• Monitor CPU
• Monitor the cost
• Ports (Docker, miner)
• First-time asset
• First-time connections
• Mind the socket
15
![Page 16: Ghost Robbers In The Cloud Finding Crypto Miners › resources › papers › telaviv2019 › Shira-Dome9 … · Ghost Robbers In The Cloud Finding Crypto Miners ... aws English Web](https://reader036.vdocuments.site/reader036/viewer/2022070814/5f0db2287e708231d43ba122/html5/thumbnails/16.jpg)
Any questions?
16