4 ms·

According to their report [1], "critical vulnerabilities" include: * coin miners, including images designed to mine coins, eg. kannix/monero-miner * images fo

According to their report [1], "critical vulnerabilities" include: * coin miners, including images designed to mine coins, eg. kannix/monero-miner * images for "Hacking Tools" These two categories account for 64% of the 51%. [1] https://prevasio.com/static/Red_Kangaroo.pdf https://prevasio.com/static/Red_Kangaroo.pdf

redgc 6y ago
Just remember, this is not limited to official images, and it's not weighted in any way based on usage/downloads. So a crypto image that's pushed and never downloaded has equal weight with the ubuntu:18.04 image
detaro 6y ago
No, those are not out of the 51%, but of the 0.16% "Malicious / potentially harmful images"
- vmception 6y ago
  which is not a vulnerability or malicious if people are looking for that didn’t realize crypto ignorance was still that pervasive and discriminatory I can see “potentially harmful” to a place the image was deployed on without authorization or against terms of use, or if the image contained a miner and didnt tell the user.
  - detaro 6y ago
    Yes, I think if you offer e.g. auditing of all containers a company runs flagging even above-board crypto miners as "potentially harmful" is fair (I doubt very many companies intentionally deploy those parallel to other workloads, and if they do it's easily cleared), but otherwise it would make sense to differentiate between them and maliciously hidden ones.
jandrese 6y ago
I hate the "hacking tools" category. I can't have a copy of netcat on my work machine because it gets flagged as a "hacking tool" and automatically deleted.
- oauea 6y ago
  Reformat your work machine and regain control.
  - MBlume 6y ago
    This is terrible, terrible advice and it's going to get someone fired. I got fired for similar behavior back in 2016. If your company's device policy is preventing you from doing your work, talk to your manager, talk about the work on your plate and the way in which the device policy is slowing you down, make sure your manager understands in concrete terms how this affects your estimates, and then -- either you'll come to a solution, or you'll have to deal with a device policy that slows you down, or you can line up a job elsewhere and resign. Unilaterally breaking the device policy will get you fired, which is a lot more stressful than resigning on a date of your choosing.
    - MBlume 6y ago
      I'll add that if you're doing work on managed hardware, you really want IT to be your friends, and this is not a good way to accomplish that. Certainly talk to them too about the impact the device policy is having on you, but don't treat them as the source of your problems, treat them as colleagues who are themselves under various regulatory/policy restrictions and who may be able to help you.
    - mr_toad 6y ago
      > talk to your manager, talk about the work on your plate and the way in which the device policy is slowing you down, make sure your manager understands in concrete terms how this affects your estimates, Maybe if you’ve got a sympathetic manager. Otherwise you might just get a reputation as a whiny trouble maker.
  - 6y ago

redgc 6y ago

Just remember, this is not limited to official images, and it's not weighted in any way based on usage/downloads. So a crypto image that's pushed and never downloaded has equal weight with the ubuntu:18.04 image

detaro 6y ago

No, those are not out of the 51%, but of the 0.16% "Malicious / potentially harmful images"

vmception 6y ago
which is not a vulnerability or malicious if people are looking for that didn’t realize crypto ignorance was still that pervasive and discriminatory I can see “potentially harmful” to a place the image was deployed on without authorization or against terms of use, or if the image contained a miner and didnt tell the user.
- detaro 6y ago
  Yes, I think if you offer e.g. auditing of all containers a company runs flagging even above-board crypto miners as "potentially harmful" is fair (I doubt very many companies intentionally deploy those parallel to other workloads, and if they do it's easily cleared), but otherwise it would make sense to differentiate between them and maliciously hidden ones.

jandrese 6y ago

I hate the "hacking tools" category. I can't have a copy of netcat on my work machine because it gets flagged as a "hacking tool" and automatically deleted.

oauea 6y ago
Reformat your work machine and regain control.
- MBlume 6y ago
  This is terrible, terrible advice and it's going to get someone fired. I got fired for similar behavior back in 2016. If your company's device policy is preventing you from doing your work, talk to your manager, talk about the work on your plate and the way in which the device policy is slowing you down, make sure your manager understands in concrete terms how this affects your estimates, and then -- either you'll come to a solution, or you'll have to deal with a device policy that slows you down, or you can line up a job elsewhere and resign. Unilaterally breaking the device policy will get you fired, which is a lot more stressful than resigning on a date of your choosing.
  - MBlume 6y ago
    I'll add that if you're doing work on managed hardware, you really want IT to be your friends, and this is not a good way to accomplish that. Certainly talk to them too about the impact the device policy is having on you, but don't treat them as the source of your problems, treat them as colleagues who are themselves under various regulatory/policy restrictions and who may be able to help you.
  - mr_toad 6y ago
    > talk to your manager, talk about the work on your plate and the way in which the device policy is slowing you down, make sure your manager understands in concrete terms how this affects your estimates, Maybe if you’ve got a sympathetic manager. Otherwise you might just get a reputation as a whiny trouble maker.
- 6y ago