Death by Doki: A new Docker vulnerability with serious bite (and what you can do about it)
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud.
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoMatias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Click on the link below and download the PDF of this one pager.
DownloadSecure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demoMatias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
Table of contents
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
DigitalOcean Decreases Security Debt with Secure Code Warrior
DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.
Resources to get you started
Coders Conquer Security: Share & Learn - Cross-Site Scripting (XSS)
Cross-site scripting (XSS) uses the trust of browsers and ignorance of users to steal data, take over accounts, and deface websites; it's a vulnerability that can get very ugly, very quickly. Let's take a look at how XSS works, what damage can be done, and how to prevent it.
Coders Conquer Security: Share & Learn - Cross-Site Scripting (XSS)
Cross-site scripting (XSS) uses the trust of browsers and ignorance of users to steal data, take over accounts, and deface websites; it's a vulnerability that can get very ugly, very quickly. Let's take a look at how XSS works, what damage can be done, and how to prevent it.