Google Cloud instances are hacked to mine cryptocurrencies

[ad_1]

Google’s November 2021 Threat Horizons report revealed that a large number of Google Cloud instances that are hacked are being used to mine cryptocurrency. It revealed that up to 86% of the 50 recently compromised Google Cloud instances were used to mine cryptocurrency; while the hacker manages to get rid of any cryptocurrency they mine, the victim of the attack is left to foot the bill for usage.

Providing the most common reasons for how the breach occurred, Google said 48% of instances had weak or no passwords for user accounts or no authentication for APIs, 26% of incidents occurred due to a vulnerability in third-party software in the Cloud instance, 12% were attributed to “other problems”, another 12% were due to incorrect configuration of Cloud instances or in third-party software, and only 4% of the hacks were the result of leaked credentials such as keys published on GitHub.

Google believes that many of the attacks were planned and did not require human intervention because, in 58% of the situations, it noticed that the mining software had been downloaded to the instances within 22 seconds of the breach. He said that manually responding to scripts is next to impossible, so users should make sure their system isn’t vulnerable or have automated systems to stop the attack.

In most cases, the victims are not specifically chosen by hackers, but they scan Google Cloud IPs and look for any vulnerable systems. Google said unsafe instances can be targeted in as little as 30 minutes, so it’s very important to follow best practices.

In addition to following Google’s best practices, you should make sure your accounts always have strong passwords, keep third-party software up to date before allowing your instance to be exposed to the web, and you should also be careful not to expose credentials on GitHub.

[ad_2]