Wiz Warns of Security Risks From Cloud Agents Installed on Customer VMs
Summary
Wiz warns that cloud-provider agents may be installed on customer VMs without clear awareness or consent, creating security risks and uncertainty over patching. It launched a community-driven dataset to help identify these agents and their attack surface.
Key points
- Cloud middleware agents can be installed on customer virtual machines without customers’ awareness or explicit consent.
- Wiz cites Azure’s OMI agent and the OMIGOD vulnerabilities, which included root remote command execution; the vulnerabilities affected Azure customers and there was evidence of in-the-wild exploitation.
- After Microsoft released patches for the OMI vulnerabilities, customers were initially responsible for updating installations they might not know existed.
- Wiz says its research found cloud middleware across major providers and warns that vulnerabilities in such agents could enable local privilege escalation or remote command execution.
- The article recommends documenting installed cloud-provider software and urges providers to be transparent about the middleware used on customer VMs.
- Wiz launched a community-driven dataset to map cloud-provider agents and the additional attack surface they introduce.
Article Details
- Topic
- Security risks from cloud-provider-installed middleware agents, including undisclosed installation, vulnerability patch responsibility, and customer exposure.
Vendors
Products
AzureThis topic, which we will present at RSA Conference 2022, builds upon our previous study on the Azure Open Management Infrastructure (OMI) agent and the OMIGOD findings - a set of vulnerabilities found and published inAzure Open Management Infrastructure (OMI)which we will present at RSA Conference 2022, builds upon our previous study on the Azure Open Management Infrastructure (OMI) agent and the OMIGOD findings - a set of vulnerabilities found and published in