Malicious code in Microsoft Azure Automation is almost impossible to detect
Cybersecurity experts from SafeBreach have created a new cryptocurrency miner that runs on the Microsoft Azure Automation cloud platform. What is unique in this case is that this technique is undetectable in the cloud service, which means it cannot charge for its use.
SafeBreach has identified three different ways to run the miner, one of which is to run it in the victim’s environment. This makes the process stealthy and difficult to detect.
On the one hand, Ariel Gamrian, an expert from SafeBreach, notes the importance of the new technology in cryptocurrency and mining development. On the other hand, globally, it poses a threat to other areas. For example, such methods can be used for various tasks via the Azure cloud platform, including for illegal purposes.
The initial objective of the research was to find the best crypto-miner in terms of technical characteristics. During the analysis process, the main requirements for the code were:
– ability to receive huge computing resources;
– minimal maintenance effort;
– free use;
– impossibility of detection.
Azure Automation, a cloud-based automation service that creates, deploys, and maintains processes in the Azure system, could be a great foundation for a miner.
How mining technology works
While researching various techniques, SafeBreach experts discovered an error in the Microsoft cloud platform’s price calculator. The latter can solve countless tasks and is completely free. As a result, Azure Automation has become an ideal option for illegal crypto-miners.
As soon as SafeBreach reported the results, Microsoft corrected the error.
Another mining option is developing a test item with the status Failed. After that, the system creates another dummy test, as it can only address one such problem at a time. Detecting malicious code is challenging due to its complete concealment within the Azure ecosystem.
The threat is that intruders can reverse the shell and authenticate at the endpoint of the system.
Additionally, SafeBreach found that attackers could conduct mining by downloading custom Python packages named “pip.” Azure Automation provides this functionality, and users download the packages through their platform accounts.
Despite experts’ analysis of Azure Automation’s capabilities for illegal crypto-mining, they emphasise that the platform’s functionality can be utilised for other forms of malicious code.
