5 ms·
Denonia: The First Malware Specifically Targeting AWS Lambda
- jedberg 5y agoI'm confused why they think this is malware as opposed to just a miner optimized to run on Lambda. It even says, "we don't know how this gets deployed". Presumably someone just deploys it so they can do mining taking advantage of Lambda's free tier.
- maldeh 5y agoIt looks like it could be a binary intended to be snuck in with third party package dependencies and such that you might unintentionally execute within your lambda runtime. It's one thing doing mining at a slow trickle within the free tier of a single account, and another thing altogether when potentially millions of lambda functions in the wild are mining for you. But agreed, it's not necessarily functionally different from any other crypto-mining malware hidden in public repos, save for the focus on runtime. Presumably Lambda provides a standardized enough runtime for reliable execution.
- btown 5y agoIf you had a legitimate Lambda-optimized miner written in Python, I can't imagine a good reason to give it the filename "python" ...
- Operyl 5y agoTo try and hide from the abuse team at AWS.
- anothernewdude 5y agoAWS lambda has a bunch of python specific optimisations that make python the best candidate for lambdas, and solve cold-start and other issues you'd normally face with python. (Azure has similar for C#). I wonder if calling it python enables some of these, while allowing you to actually implement it in something efficient, like C.
- jamesfinlayson 5y agoDoes Lambda run a custom version of the Python interpreter then?
- Something1234 5y agoLambda runs a custom compiled interpreter with different flags set than most distros. In this case they don't compile python with optimizations on, which is weird, and they link an old version of SQLite.
- jamesfinlayson 5y agoI guess the different flags makes sense - the VMs Lambda runs on run Amazon Linux as far as I understand. But turning off optimisations does seem strange.
- guiriduro 5y agoI'd guess they'd run in firecracker VMs (a technology they open sourced), targeting faster starts. And perhaps turning off the compile time flags also results in a faster-starting binary, which is the more important metric for serverless, maybe at the expense of slower code/longer runtime, excepting that runtimes are on average quite short anyway.
- jamesfinlayson 5y agoAh true - the longer the execution time the more money they make.
- fivea 5y ago> AWS lambda has a bunch of python specific optimisations that make python the best candidate for lambdas (...) I don't believe there is any truth to this statement. The general guidelines for AWS lambda is that a) if you seek performance then Go is the way to go, b) for everything else nodejs (i.e., JavaScript/typescript) is by far the best runtime, specially given lambda's single-threaded nature and nodejs's support for concurrency. All other options are only relevant if you have very specific non-technical constraints, such as wanting to reuse code (JDK) or just leveraging whatever language your team already uses somewhere else.
- ec109685 5y agoAgree. This is just fancy content marketing.
- gazoakley 5y agoCurious to see how this would be deployed in the wild. A sneaky way would be to add this as an extension to existing Lambdas - it could run in parallel any time such a Lambda is invoked, and continue even after an initial response until the timeout for the function is reached.
- Techbrunch 5y ago“using advanced cloud-specific knowledge to exploit complex cloud infrastructure" = Checking if an environment variable is set
- avidphantasm 5y agoThey state that “the managed runtime environment reduces the attack surface compared to a more traditional server environment”, but is that true? Isn’t it just that the attack surface that you are responsible for is reduced? I could see all the lambda “magic” (i.e., reducing cold start times) actually adding to the runtime attack surface.