Death by Doki: A new Docker vulnerability with serious bite (and what you can do about it)

In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.

As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.

Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.

What is Doki, and how does it work?

As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.

Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.

The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.

Spotting a Doki pathway in code.

The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.

Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.

Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:

dockerd -H tcp://0.0.0.0:2375

Can you spot the misconfigurations? The secured version looks like this:

dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem

In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.

In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.

We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:

Secure cloud infrastructure is a team sport.

Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.

Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.