cyber.hendryadrian.com
Security News · wiz.io

Wiz Recaps Notable Cloud Security Stories of 2024

· Original article ↗

Summary

Wiz’s year-end roundup revisits 2024 cloud security stories, including the XZ Utils backdoor, SAPwned vulnerabilities, exposed DeepSeek data, LLMjacking, and attacks targeting Linux and Ollama deployments.

Key points

  • The article describes the XZ Utils backdoor as a supply-chain attack that could compromise SSH authentication in certain Linux distributions; researcher Andres Freund uncovered it after noticing unusual SSH behavior.
  • Wiz researchers reported that weak isolation in SAP AI Core could expose customer data and cloud credentials and enable access to internal images and Kubernetes cluster administration; SAP fixed the flaws after disclosure.
  • Wiz researcher Gal Nagli found an unauthenticated DeepSeek ClickHouse database containing sensitive data, including model-training chat logs and API keys.
  • The LLMjacking account describes attackers using stolen cloud credentials to access hosted AI services, including credentials stolen through a publicly exposed Laravel instance.
  • Wiz’s Diicot campaign summary says attackers used weak SSH credentials against Linux environments, tailored payloads for containers or VMs, and shifted to HTTP command and control.
  • Wiz reported finding more than 1,000 internet-exposed Ollama instances; a path-traversal vulnerability could allow remote code execution, and the Ollama team fixed the issue within hours.

Article Details

Event Type
Year-end roundup of selected cloud security vulnerabilities, research findings, and security incidents from 2024.
Impact
The featured stories describe a backdoor in XZ Utils affecting SSH authentication in certain Linux distributions; vulnerabilities and misconfigurations that could expose cloud data, credentials, or administrative access; attacks abusing stolen cloud credentials to access AI services; a Linux malware campaign; and exposed Ollama instances vulnerable to remote code execution. The article reports that SAP fixed the SAPwned vulnerabilities after disclosure and that Ollama's team fixed its issue within hours.

CVE

CVE-2024-3094CVE-2024-3094 is one of the most intriguing stories of the year. A stealthy backdoor was hidden in XZ Utils, compromising SSH authentication in certain Linux distributions. The attack was highly sophisticated, with

People

Andres FreundSecurity researcher who discovered the XZ Utils backdoor after noticing unusual SSH behavior.Avigayil MechtingerLed the investigation into the SeleniumGreed campaign.Dor LaskaNamed as part of the investigation into the SeleniumGreed campaign.Gal NagliWiz researcher who discovered DeepSeek's exposed database.Gili TikochinskiNamed as part of the investigation into the SeleniumGreed campaign.Johann RehbergerInterviewed about AI security research and red teaming; identified as Red Team Director at EA.Roy ReznikWiz leader interviewed about leadership and R&D culture.

Threat Actors

DiicotRomanian-speaking threat group linked to a malware campaign targeting Linux environments.

Vendors

SAPIn July 2024, Wiz researchers discovered some serious security flaws in SAP’s AI Core platform, which they dubbed “SAPwned.” These issues could’ve let attackers get access to sensitive customer data and cloudTenableResearchers at Tenable discovered an interesting vulnerability affecting Azure, where firewall service tags could be abused to allow unintentional cross-tenant access. I found this research interesting because itWizIn July 2024, Wiz researchers discovered some serious security flaws in SAP’s AI Core platform, which they dubbed “SAPwned.” These issues could’ve let attackers get access to sensitive customer data and cloud

Products

Claudecase, they exploited a publicly exposed Laravel instance to steal credentials and target Anthropic’s Claude models. To evade detection, they automated credential validation using a script that enumeratesOllamaEden’s pick – Ollama SAP HANA Cloudaccess to sensitive customer data and cloud credentials across major services like AWS, Azure, and SAP HANA Cloud. The problem came down to weak isolation—basically, attackers could run malicious AI models orSelenium GridAmitai’s pick – Selenium Grid misconfiguration XZ UtilsMerav’s pick – XZ Utils backdoor 

Tools

KeyCheckeraccess to multiple compromised accounts while keeping the stolen keys hidden. Some attackers even used KeyChecker, a tool that assesses the AI-related value of stolen credentials by checking inference API access,OAI Reverse Proxywithout running actual queries. Additionally, they leveraged an open-source reverse proxy (OAI Reverse Proxy) to manage access to multiple compromised accounts while keeping the stolen keys hidden. Some

Related Articles