Security Magazine logo
search
cart
facebook twitter linkedin youtube
  • Sign In
  • Create Account
  • Sign Out
  • My Account
Security Magazine logo
  • NEWS
    • Security Newswire
    • Technologies & Solutions
  • MANAGEMENT
    • Leadership Management
    • Enterprise Services
    • Security Education & Training
    • Logical Security
    • Security & Business Resilience
    • Profiles in Excellence
  • PHYSICAL
    • Access Management
    • Fire & Life Safety
    • Identity Management
    • Physical Security
    • Video Surveillance
    • Case Studies (Physical)
  • CYBER
    • Cybersecurity News
    • More
  • BLOG
  • COLUMNS
    • Cyber Tactics
    • Leadership & Management
    • Security Talk
    • Career Intelligence
    • Leader to Leader
    • Cybersecurity Education & Training
  • EXCLUSIVES
    • Annual Guarding Report
    • Most Influential People in Security
    • The Security Benchmark Report
    • The Security Leadership Issue
    • Top Guard and Security Officer Companies
    • Top Cybersecurity Leaders
    • Women in Security
  • SECTORS
    • Arenas / Stadiums / Leagues / Entertainment
    • Banking/Finance/Insurance
    • Construction, Real Estate, Property Management
    • Education: K-12
    • Education: University
    • Government: Federal, State and Local
    • Hospitality & Casinos
    • Hospitals & Medical Centers
    • Infrastructure:Electric,Gas & Water
    • Ports: Sea, Land, & Air
    • Retail/Restaurants/Convenience
    • Transportation/Logistics/Supply Chain/Distribution/ Warehousing
  • EVENTS
    • Industry Events
    • Webinars
    • Solutions by Sector
    • Security 500 Conference
  • MEDIA
    • Videos
      • Cybersecurity & Geopolitical Discussion
      • Ask Me Anything (AMA) Series
    • Podcasts
    • Polls
    • Photo Galleries
  • MORE
    • Call for Entries
    • Classifieds & Job Listings
    • Continuing Education
    • Newsletter
    • Sponsor Insights
    • Store
    • White Papers
  • EMAG
    • eMagazine
    • This Month's Content
    • Advertise
  • SIGN UP!
CybersecuritySecurity NewswireCybersecurity News

Azurescape attack allows cross-container cloud compromise

cloud-computing-freepik56457.jpg
September 10, 2021

The Unit 42 Threat Intelligence team has identified the first known vulnerability that could enable one user of a public cloud service to break out of their environment and execute code on environments belonging to other users in the same public cloud service.


According to the Palo Alto Networks Unit 42 Threat Intelligence team, this unprecedented cross-account takeover affected Microsoft’s Azure Container-as-a-Service (CaaS) platform. Researchers named the finding Azurescape because the attack started from a container escape – a technique that enables privilege escalation out of container environments.


Azurescape allows an ACI user to gain administrative privileges over an entire cluster of containers. From there, the user could take over the impacted multitenant clusters to execute malicious code, steal data or sabotage the underlying infrastructure of other customers. The attacker could gain complete control over Azure’s servers that host containers of other customers, accessing all data and secrets stored in those environments.


The main issue here involves the service provider failing to run the latest version of runC - a lightweight, universal container runtime and a command-line tool for spawning and running containers, explains Josh Angell, Managing Consultant at nVisium.


Angell says, “The vulnerability in runC allows a user to override the runC binary, thus allowing the user to gain root-level code execution on the host. Why is this significant? Because that host is a multitenant cluster, it allowed the attacker to gain control over the other users in that cluster.”


Since it’s a two-year-old vulnerability with a patch, Angell calls this a lesson learned in the importance of updating services and libraries to ensure they’re running the latest versions with all of the security patches in those services.


“Security teams must ensure they update their services and libraries — which was done quickly once this issue became known,” Angell says. “It is a well-known tactic that attackers most often identify older versions of services and libraries to research vulnerabilities within those outdated services, making it easier to gain a foothold into the system. You leave yourself wide open to situations like these by keeping vulnerable components exposed — you’re essentially providing adversaries an instruction manual titled, ‘How to Break My System.’”


Microsoft took swift action to fix the underlying issues as soon as we reported them to the Microsoft Security Response Center (MSRC).

Though the Unit 42 Threat Intelligence team is not aware of any Azurescape attacks in the wild, it is possible that a malicious user of the Azure Container Instances (ACI) platform could have exploited the vulnerability to execute code on other customers’ containers without any prior access to their environment. 


The Unit 42 Threat Intelligence Team says the vulnerability highlights the need for cloud users and organizations to take a “defense-in-depth” approach to secure their cloud infrastructure that includes monitoring for threats both inside and outside the cloud platform. Azurecape also underscores the need for cloud service providers to provide adequate access for outside researchers to study their environments, searching for unknown threats, researchers say.


Douglas Murray, CEO at Valtix, says, “There’s no doubt that the public cloud is an incredible enabler of business agility and net positive for organizations making the cloud transition. However, Azurescape and other such platform service vulnerabilities continue to highlight that the already difficult task of security is different in the cloud. Zero-day vulnerabilities will continue to occur, and the shared responsibility model often complicates remediation.


“In the end, the lesson learned is that same lesson we’ve known for many years – defense-in-depth is essential. While many tools can help, the network is still common ground – every app touches it. Organizations need to secure ingress, egress, and east-west network traffic to/from/between their cloud apps. Organizations must ensure that every application and cloud service has the necessary security controls to prevent data exfiltration or detect other malicious activity through network threat prevention.”

KEYWORDS: cloud security cyber security information security risk management

Share This Story

Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!

Recommended Content

JOIN TODAY
To unlock your recommendations.

Already have an account? Sign In

  • Security's Top Cybersecurity Leaders 2024

    Security's Top Cybersecurity Leaders 2024

    Security magazine's Top Cybersecurity Leaders 2024 award...
    Cybersecurity
    By: Security Staff
  • cyber brain

    The intersection of cybersecurity and artificial intelligence

    Artificial intelligence (AI) is a valuable cybersecurity...
    Logical Security
    By: Pam Nigro
  • artificial intelligence AI graphic

    Assessing the pros and cons of AI for cybersecurity

    Artificial intelligence (AI) has significant implications...
    Cybersecurity Education & Training
    By: Charles Denyer
Subscribe For Free!
  • Security eNewsletter & Other eNews Alerts
  • eMagazine Subscriptions
  • Manage My Preferences
  • Online Registration
  • Mobile App
  • Subscription Customer Service

More Videos

Sponsored Content

Sponsored Content is a special paid section where industry companies provide high quality, objective, non-commercial content around topics of interest to the Security audience. All Sponsored Content is supplied by the advertising company and any opinions expressed in this article are those of the author and not necessarily reflect the views of Security or its parent company, BNP Media. Interested in participating in our Sponsored Content section? Contact your local rep!

close
  • Crisis Response Team
    Sponsored byEverbridge

    Automate or Fall Behind – Crisis Response at the Speed of Risk

  • Perimeter security
    Sponsored byAMAROK

    Why Property Security is the New Competitive Advantage

  • Duty of Care
    Sponsored byAMAROK

    Integrating Technology and Physical Security to Advance Duty of Care

Popular Stories

Pills spilled

More than 20,000 sensitive medical records exposed

Laptop in darkness

Verizon 2025 Data Breach Investigations Report shows rise in cyberattacks

Coding on screen

Research reveals mass scanning and exploitation campaigns

White post office truck

Department of Labor Sues USPS Over Texas Whistleblower Termination

Computer with binary code hovering nearby

Cyberattacks Targeting US Increased by 136%

2025 Security Benchmark banner

Events

May 22, 2025

Proactive Crisis Communication

Crisis doesn't wait for the right time - it strikes when least expected. Is your team prepared to communicate clearly and effectively when it matters most?

September 29, 2025

Global Security Exchange (GSX)

 

View All Submit An Event

Products

Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

See More Products

Related Articles

  • open laptop beside phone

    Software supply chain compromise was fourth most frequent attack

    See More
  • Gaps in Cybersecurity Programs

    Thunderspy, New Attack Method, Allows Hackers to Steal Data in Less than 5 Minutes

    See More
  • cyberattack

    Cross-Border Cybersecurity Attack Simulation in Europe Next Week

    See More
×

Sign-up to receive top management & result-driven techniques in the industry.

Join over 20,000+ industry leaders who receive our premium content.

SIGN UP TODAY!
  • RESOURCES
    • Advertise
    • Contact Us
    • Store
    • Want More
  • SIGN UP TODAY
    • Create Account
    • eMagazine
    • eNewsletter
    • Customer Service
    • Manage Preferences
  • SERVICES
    • Marketing Services
    • Reprints
    • Market Research
    • List Rental
    • Survey/Respondent Access
  • STAY CONNECTED
    • LinkedIn
    • Facebook
    • YouTube
    • X (Twitter)
  • PRIVACY
    • PRIVACY POLICY
    • TERMS & CONDITIONS
    • DO NOT SELL MY PERSONAL INFORMATION
    • PRIVACY REQUEST
    • ACCESSIBILITY

Copyright ©2025. All Rights Reserved BNP Media.

Design, CMS, Hosting & Web Development :: ePublishing