The all in one place for non-profit security aid.
The threat actors behind the RomCom RAT have been suspected of phishing attacks targeting the upcoming NATO Summit in Vilnius as well as an identified organization supporting Ukraine abroad.
The findings come from the BlackBerry Threat Research and Intelligence team, which found two malicious documents submitted from a Hungarian IP address on July 4, 2023.
RomCom, also tracked under the names Read More
The Hacker News | #1 Trusted Cybersecurity News Site
10 Best Kubernetes Container Scanners In 2024
Kubernetes container scanners check containers for security vulnerabilities, misconfigurations, and compliance concerns. These scanners are essential to containerized applications and Kubernetes infrastructure security.
It provides two facilities: automation and declarative configuration. It can set the web server as per web traffic and maintain the level during production.
Before you read this topic, you may be wondering what Kubernetes is. Let us tell you that it is an extensible, portable, and open-source platform that manages containerized workloads and services.
Usually, the web server hardware is located in several data centers, where Kubernetes makes up the scale and serves according to the demand.
It also has an advanced load-balancing capability, which helps control the web traffic routing and web server.
Now you know about Kubernetes, but you might wonder about its security.
Nowadays, Kubernetes is one of the best container orchestration platforms, and more than 80% of organizations are using it in some way. It automates provisioning configuration and manages the containers.
Though it is very simple, security also matters for any containerized application. You may know how to provide robust protection for the application running on the Kubernetes cluster.
Now you know about basic Kubernetes, which works by default. It assigns the IP address to the port in the cluster and provides basic security.
Sometimes, third-party open-source Kubernetes scanners can help to secure the Kubernetes cluster.
Here we will discuss a few Kubernetes Container Scanner tools that can help find security vulnerabilities and misconfigurations and provide the best security.
In this article, we detail the top 10 Kubernetes container scanners.
Top 10 Kubernetes Container Scanner
Kubernetes Container Scanner Features
1. Kube Hunter
2. Kube Bench
3. Checkov
4. Anchore
5. Kubeaudit
6. Clair
7. Kubei
8. Kubesec
9. Kube Scan
10. MKIT
Kubernetes Container ScannerFeatures1. Kube Hunter1. Scanning
2. Attack Vectors
3. CVE Detection
4. Privilege Escalation2. Kube Bench1. Benchmarking
2. CIS Compliance
3. Security Checks
4. Automated Scanning3. Checkov1. Infrastructure as Code (IaC) Security
2. Configuration Scanning
3. Cloud Platform Support
4. Policy Checks4. Anchore1. Container Image Scanning
2. Vulnerability Detection
3. CVE Analysis
4. Configuration Assessment5. Kubeaudit1. Kubernetes Security Audit
2. Configuration Assessment
3. Manifest Scanning
4. Best Practices Checks6. Clair1. Container Vulnerability Scanning
2. Image Analysis
3. CVE Detection
4. Risk Assessment7. Kubei1. Kubernetes Runtime Vulnerability Scanning
2. Image Scanning
3. Risk Assessment
4. Security Audit8. Kubesec1. Kubernetes Security Analysis
2. Manifest Scanning
3. Security Controls Evaluation
4. Risk Assessment9. Kube Scan1. Kubernetes Security Scanning
2. Vulnerability Assessment
3. Misconfiguration Detection
4. CIS Benchmark Checks10. MKIT 1. Kubernetes Security Assessment
2. Cluster Configuration Analysis
3. Vulnerability Scanning
4. Risk Identification
Kube Hunter
Kube Bench
Checkov
Anchore
Kube audit
Clair
kubei
Kubesec
Kubescan
MKIT
This Aqua Security tool is a Kubernetes cluster vulnerability scanner.
Kube-hunter is an open-source Kubernetes security tool. It simulates assaults to find Kubernetes cluster security vulnerabilities.
Kube-hunter, a Kubernetes penetration testing tool, identifies vulnerabilities and misconfigurations that attackers might exploit.
This resource is useful for promoting safer online behavior. It searches for configuration, network, and other vulnerabilities that attackers might exploit.
Optional, standardized scans include network interleaving, remote, and vulnerability identification.
The binary zip file can be downloaded and extracted in a number of ways using the available tools.
Kube Hunter must be installed immediately to ensure the system has sufficient network access.
The cluster is now ready to begin vulnerability scanning. Kube Hunter may be run inside a Docker image.
You can scan the clusters immediately after installing it directly on the machine via the local network.
The active and passive tests for determining where in the cluster vulnerabilities lie are provided here.
Features
Finds frequent Kubernetes cluster configuration issues that might compromise security.
Finds API server, kubelet, and other Kubernetes security issues.
Simulates attacks to test cluster resilience and uncover vulnerabilities.
Checks the cluster’s compliance with corporate security best practices and CIS standards.
What is Good ?What Could Be Better ?Vulnerability DetectionNeeds to be done by handOpen SourceNot enough tracking in real timeActive DevelopmentEasy to Use
Demo video
Price
You can get a free trial and personalized demo from here…
The CIS Security Benchmark must be met for your deployment to pass the inspection of this open-source quality security tool.
Aqua Security created Kube-bench to verify Kubernetes cluster security setup. It helps administrators and businesses verify Kubernetes deployments satisfy security best practices and benchmarks.
Furthermore, it finds the mistakes and provides assistance in correcting them. One aspect of the job is coming up with solutions.
The correct permission and authentication of data is also guaranteed by this instrument. It also guarantees deployment, which is essential for CIS leaders.
You should complete the application by entering the required information.
The YAML definition format is required for all tests and allows for simple updates and additions.
Features
Compare CIS Kubernetes Benchmark to Kubernetes security settings.
checks for vulnerabilities and improper configurations against CIS Kubernetes Benchmark recommended practices.
You may test groups running different Kubernetes versions.
Automated scanning makes frequent security tests and cluster protection easier.
What is Good ?What could Be Better ?Security Best PracticesFew options for reporting and loggingComprehensive Security ChecksNo ways to send alertsCIS Kubernetes Benchmark ChecksAutomated Scanning
Demo video
Price
You can get a free trial and personalized demo from here…
Checkov
It’s another Kubernetes Container Scanner tool for avoiding mistakes in code during development (in languages like Terraform, serverless framework, cloud formation, and so on).
This Python-based language has two primary goals: improve security and guarantee best-practices compliance.
Only it is simple and completely open-source enough to construct with over 500 different security policies.
It provides guidance on the most effective use of AWS, GCP, and Azure.
The input folder, which may contain Terraform or CloudFormation files, is also scanned.
It’s also useful for checking out cd production lines.
It also works with numerous file types, including CLI, JSON, JUnit XML, and so on.
Features
Checks Terraform, CloudFormation, and Kubernetes IaC files for security and compliance.
It can perform comprehensive IaC scanning in AWS, Azure, Google Cloud, and Kubernetes.
Best practises, industry standards, and security frameworks like HIPAA, CIS, and PCI-DSS inform its many guidelines.
Users can create rules to meet their organization’s security and compliance needs.
What is Good ?What Could Be Better ?Infrastructure as Code (IaC) SecurityLimited Runtime Security CoverageWide Range of Built-in PoliciesLimited Language SupportEasy IntegrationExtensibility and Customization
Demo video
Price
You can get a free trial and personalized demo from here…
Anchore is a container security platform that helps companies ensure their containerized apps are safe, compliant, and complete.
It does this by giving them tools and services. Anchore has features that can be used during both the build and live stages of deploying containers.
The Docker image is analyzed in great detail. The level of safety is also communicated.
Any orchestration platform, such as Rancher, Docker Swarm, or Amazon ECS, can use this engine independently. The CI/CD pipeline provides access as well.
To verify the safety of your Kubernetes deployment, you’ll need a scanner.
The docker image must be provided for analysis and reporting purposes.
Custom security can also be used for testing purposes.
It deploys the potentially harmful image while accurately defining the policies.
It also encrypts the image so that it may develop an orchestration platform.
Features
Anchore checks container pictures for bugs and security holes.
Works with CI/CD processes to check for security automatically while images are being built.
It works with container registries to look at and scan pictures while they are being pushed or pulled.
Makes reports that show policy violations and security holes.
Takes care of the whole container picture lifecycle, including tracking and versioning.
What is Good ?What Could Be Better ?Container Image SecurityDependency on Vulnerability Database UpdatesComprehensive Vulnerability AnalysisChance of getting motion sicknessPolicy-Based ScanningContinuous Monitoring and Alerting
Demo video
Price
You can get a free trial and personalized demo from here…
Such a program is an example of a free auditing tool.
The incorrect configuration is located, and the necessary steps to correct it are provided.
The Go language tool is one example of a command-line tool that is commonly used.
Putting it on the PC and using it requires only one command after installation.
It displays a currently running application to which only the superuser has read/write access.
It also aids you in avoiding additional privileges, which helps it avoid typical security issues.
Three distinct modes are available, each with their own set of features.
Built auditing containers, namespaces, pods, etc., can be any of the three levels of severity.
Features
looks at Kubernetes groups to find security risks and possible holes.
Checks the settings of Kubernetes objects like pods, deployments, and services to make sure they follow security best practices and rules.
Helps you fix security problems and make the cluster safer by giving you suggestions and instructions.
Checks security standards and best practices, such as CIS measures, to ensure the cluster follows the rules.
What is Good ?What Could Be Better ?Kubernetes-specific Security AssessmentLimited ScopeLightweight and Easy to UseLimited Runtime MonitoringComprehensive Security ChecksCustomizable Assessments
Demo video
Price
You can get a free trial and personalized demo from here…
Kubeaudit – Trial / Demo
Clair is a free and open-source tool for checking the security of container files. Clair isn’t a Kubernetes tool in and of itself, but it can be used with Kubernetes settings to make containers safer.
It provides vulnerability scanning in addition to static security. This API-driven analysis engine ensures the smooth operation of all security-related processes.
You not only need to develop the service but also need to monitor it so that it continuously can do the vulnerability.
Clair can be added to Kubernetes settings to check container pictures before they are deployed. In CI/CD processes, it is often used to make sure that only safe container files are sent to a Kubernetes cluster.
It alerts you to the container’s potential vulnerability and relies only on CVE and related databases.
The National Vulnerability Database will issue a comprehensive report in the event of any impending danger that it is capable of mitigating.
Features
Clair is made to have conversations that feel normal and involve both parties.
Clair is very good at understanding what people say.
Depending on what is being said, Clair can understand and react.
Clair has access to a lot of data and can give you answers that are useful.
What is Good ?What Could Be Better ?Container Vulnerability ScanningLimited to Known VulnerabilitiesWide Range of Supported LanguagesLimited CustomizationIntegration with Container RegistriesDetailed Vulnerability Reports
Demo video
Price
You can get a free trial and personalized demo from here…
Kubei
Most of it is developed in the Go programming language, and it displays imminent danger in the cluster.
Everything included in the CIS Docker benchmark is covered.
Application pods, system pods, and Kubernetes clusters are all scannable options.
The scan can be modified in terms of its speed, depth, and sensitivity.
With the help of GUI, you may observe anything and mitigate them.
It monitors the public’s perception and gives updates in real time.
It has a web-based interface and supports multi-scanning.
Features
Sees pictures of containers to find risks and vulnerabilities like known holes in software.
Sees if there are any mistakes, vulnerabilities, or ways to attack Kubernetes setups.
It lets you always keep an eye on Kubernetes operations and container files to find and report security issues.
Checks for flaws by connecting to well-known sources to get the most up-to-date information and find out how dangerous container pictures are.
What is Good ?What Could Be Better ?Runtime Security ScanningAdditional Operational OverheadContainer Image ScanningResource IntensiveActive Monitoring and AlertsComprehensive Security Checks
Demo video
Price
You can get a free trial and personalized demo from here…
This security risk analysis tool configures and validates the manifest files that get used for cluster operations and deployment.
Users can install this with container images.
As an open-source tool, it comes with a bundle of HTTP servers where it comes with a background at 8080 by default.
It has the capacity to run the service via HTTPS at v2.kubersec.io/scan.
It also scans multiple YAML documents, but it must be a single input file.
Features
scans Kubernetes configurations to identify security risks and potential vulnerabilities.
assigns risk scores to configurations based on their security posture, allowing for prioritization of remediation efforts.
evaluates configurations against best practices and security standards to ensure adherence to industry guidelines.
provides recommendations on how to mitigate identified security risks and improve the security of Kubernetes configurations.
What is Good ?What Could Be Better ?Kubernetes-specific Security AssessmentLimited to Configuration AssessmentSimple and LightweightLimited CustomizationComprehensive Security ChecksIntegration with CI/CD Pipelines
Demo video
Price
You can get a free trial and personalized demo from here…
It is packaged in a container since it is a container scanner.
This can be installed in a fresh cluster, and after scanning the workload, a risk score and further information will be presented in a web-based user interface.
It also delivers a score between zero and ten, with ten indicating the highest danger.
This is a free, publicly available, and governed by the same principles as KCCSS.
More than 30 different security options, including capabilities, privilege level, risk baseline, etc., work analogous to CVVSS.
Exploitation is made simpler due to the correlation between the risk score and the risk baseline.
This rescan happens every 24 hours, and it operates in a container to deliver the best result.
Features
looks through Kubernetes systems to find security holes and incorrect settings.
checks whether Kubernetes clusters’ security settings are in line with best practices and industry norms.
Finds known security holes in Kubernetes parts like the API server, kubelet, and more.
checks against security standards, like CIS standards, to make sure that the cluster is following the rules.
What is Good ?What Could Be better?Lightweight and Easy to UseExpertise RequiredComprehensive Security ScanningMaintenance and UpdatesOpen SourceContinuous Integration and Deployment (CI/CD) Integration
MKIT
This tool is very helpful for the quick identification of security risks.
It keeps the cluster and its resources.
There is a quick and easy way to find out the misconfiguration in the cluster.
The interface for this Kubernetes Container Scanner tool is present, and it runs by default.
It helped you to see the passed and failed checks.
You can also know the reason behind the affected resource in detail by clicking on the affected resource section.
This software is straightforward to install and helps to build open-source libraries.
It also provides the support of multiple Kubernetes like AKS, EKS, and GKE.
It can also store sensitive data in the container.
Features
Designed to check how safe controlled Kubernetes services like Amazon EKS, Azure AKS, and Google GKE are.
Checks managed Kubernetes systems for security holes, incorrect settings, and problems with compliance.
looks at different Kubernetes parts, like the API server, kubelet, and others, to find possible vulnerabilities.
checks the cluster’s access control methods, like RBAC, to make sure they’re working right and lower the risk of someone getting in without permission.
What is Good ?What Could Be Better ?Kubernetes Security AssessmentLimited to Managed Kubernetes EnvironmentsComprehensive Security ChecksLearning Curve and Expertise RequiredCompliance AuditingCustomizable Assessments
Demo video
Price
You can get a free trial and personalized demo from here…
The above Kubernetes Container Scanner tools aim to secure the cluster so that hackers can not break it.
This scanner helps to deploy the application and helps to identify vulnerabilities.
To quickly discover and fix security concerns in Kubernetes, container scanners must be integrated into CI/CD pipelines and frequently scanned base images and runtime environments.
Choose a Kubernetes container scanner based on functionality, integration, and community support.
Also Read
Top 10 Best Free Penetration Testing Tools 2024
Top 10 Best Open Source Firewalls to Protect Your Enterprise Network 2024
Top 10 Cyber Attack Maps to See Digital Threats 2024
The post 10 Best Kubernetes Container Scanners In 2024 appeared first on Cyber Security News.
Cyber Security News
German Police Seize ‘Nemesis Market’ in Major International Darknet Raid
[[{“value”:”German authorities have announced the takedown of an illicit underground marketplace called Nemesis Market that peddled narcotics, stolen data, and various cybercrime services.
The Federal Criminal Police Office (aka Bundeskriminalamt or BKA) said it seized the digital infrastructure associated with the darknet service located in Germany and Lithuania and confiscated €94,000 ($102,107)”}]] Read More
The Hacker News | #1 Trusted Cybersecurity News Site
PlugX USB worm Infected Over 2.5M Devices
[[{“value”:”
A new menace has emerged, affecting millions of devices worldwide.
The PlugX USB worm, a sophisticated malware, has been reported to have infected over 2.5 million devices, posing a significant threat to global cybersecurity.
The PlugX malware, initially identified several years ago, has gained fame for its resilience and ability to spread through USB drives.
In March 2023, cybersecurity experts at Sophos highlighted a variant of PlugX with enhanced worming capabilities that could jump borders and infiltrate networks undetected.
Is Your Network Under Attack? – Read CISO’s Guide to Avoiding the Next Breach – Download Free Guide
By September 2023, the situation escalated when researchers successfully sinkhole a command and control (C2) server associated with the PlugX worms.
For a mere $7, they acquired a unique IP address linked to the worm variant, which revealed a staggering number of infected public IP addresses.
A graphic visualizing the spread of the PlugX USB worm across the globe, with hotspots indicating areas of high infection rates. (Source: Sekoia)
According to Sekoia’s findings, Despite the malware’s inception years prior, daily requests from approximately 90,000 to 100,000 unique IPs were still being sent to the sinkhole.
Over six months, more than 2.5 million unique IPs connected to it, indicating the worm’s extensive reach.
Document
Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:
Real-time Detection
Interactive Malware Analysis
Easy to Learn by New Security Team members
Get detailed reports with maximum data
Set Up Virtual Machine in Linux & all Windows OS Versions
Interact with Malware Safely
If you want to test all these features now with completely free access to the sandbox:
The battle against PlugX took a turn when experts cracked the cryptography of its communications.
This breakthrough allowed the development of disinfection commands that could be sent to compromised workstations.
Two methods were devised: one that cleanses the workstation and another, more intrusive technique that also purges the USB drive.
In an unprecedented move, a concept of sovereign disinfection was proposed. Law enforcement agencies and national Computer Emergency Response Teams were offered the tools to remove the malware from infected hosts remotely.
This approach aims to empower nations to take control of their cybersecurity by eliminating the threat from within their digital borders.
The PlugX USB worm’s vast infection rate is a stark reminder of the persistent threat cybercriminals pose.
While the worm cannot be entirely eradicated, the collaborative efforts of cybersecurity communities have opened a path to mitigating its impact.
The sovereign disinfection process is a novel strategy that offers a glimmer of hope in the fight against pervasive cyber threats.
The PlugX USB worm saga underscores the importance of global cooperation in cybersecurity and the need for continuous vigilance in an ever-changing threat landscape.
As the world becomes increasingly interconnected, resilient and adaptable cybersecurity measures will be paramount in safeguarding our digital future.
Files Hashes
432a07eb49473fa8c71d50ccaf2bc980b692d458ec4aaedd52d739cb377f3428
e8f55d0f327fd1d5f26428b890ef7fe878e135d494acda24ef01c695a2e9136d
3a53bd36b24bc40bdce289d26f1b6965c0a5e71f26b05d19c7aa73d9e3cfa6ff
2304891f176a92c62f43d9fd30cae943f1521394dce792c6de0e097d10103d45
8b8adc6c14ed3bbeacd9f39c4d1380835eaf090090f6f826341a018d6b2ad450
6bb959c33fdfc0086ac48586a73273a0a1331f1c4f0053ef021eebe7f377a292
b9f3cf9d63d2e3ce1821f2e3eb5acd6e374ea801f9c212eebfa734bd649bec7a
Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo
The post PlugX USB worm Infected Over 2.5M Devices appeared first on Cyber Security News.
“}]] Read More
Cyber Security News