Google’s Vertex AI Platform Gets Freejacked

The Sysdig Threat Research Team (Sysdig TRT) recently discovered a new freejacking campaign abusing Google’s Vertex AI platform for cryptomining. Vertex AI is a SaaS, which makes it vulnerable to a number of attacks, such as freejacking and account takeovers. Freejacking is the act of abusing free services, such as free trials, for financial gain. This freejacking campaign leverages free Coursera courses that provide the attacker with no-cost access to GCP and Vertex AI. The attacker is able to generate free money while the service provider ends up footing the bill.

Using trial accounts seems inefficient on the surface, as many services require credit card checks and have other limiting features. However, we have observed attackers heavily automate the process and use sites that generate temporary email addresses, phone numbers, and even credit cards. CAPTCHAs are also a common defense, but we have seen attackers automate their resolution too. If scaled up, freejacking can be an effective way to earn money.

In this attack, we observed dozens of instances being created per fake account. Each fake account was created with automation, so the attacker could have quite a few instances running. The trials themselves are often limited by time and resources, so the amount of money per instance is probably only a dollar or two for its lifetime. But with enough scale, it can be worth the effort considering the cost of living where the attacker lives. We currently believe the attacker in this example is from Indonesia. Importantly, as we learned with PURPLEURCHIN, $1 of profit for an attacker can mean a $53 loss for the provider.

With AI being all the rage right now, these platforms are popping up all over the place. They are used to make machine learning/AI easier by providing pipelines and computing infrastructure, among a lot of other niceties. Part of the offering is compute infrastructure to train the models in a scalable and high-performance manner. With the AI gold rush occurring, teams all over the world are racing to field products, which means results first, and then “doing” security somewhere down the line.

These computing resources are what attackers are after and the graphics cards (GPUs) that come with them are ideal for mining cryptocurrency. GPUs have special chipsets which allow them to make calculations in a much more parallel way compared to CPUs. This parallelism allows the cryptomining program to perform roughly six times better than a similar CPU. With this kind of hardware, attackers can earn more money, more quickly.

In this attack, the attacker leverages Jupyter Notebooks provided by the Vertex AI platform in order to run their miner. It’s a rather simple, but effective tactic. A Jupyter Notebook is an interactive Python-based form that allows you to easily run code and commands while formatting the output. Since it provides such easy access to the command line, attackers are always happy to find them.

They run a script that creates three TensorFlow instances in multiple regions. TensorFlow is a popular machine-learning platform that can leverage GPUs and other specialized hardware. Next, they use a custom GCP machine type which launches a TensorFlow instance with six CPUs and 12GB of RAM. TensorFlow is an important aspect of the instances they are creating, as these images come with GPUs that can maximize cryptomining results.

Once the TensorFlow instances are created, the attacker pulls down their miner from a public repository and runs it as long as they can. The cryptocurrency used in this attack is called Dero, another privacy-focused coin like Monero. These coins are designed so it is difficult to track their transactions, making it a less risky choice for the attacker. The attacker launches their miner with a command like the one below.

The IP Address in the “nodes” command, 149.129.237.206, is a mining pool controlled by the attacker hosted on an Alibaba server.  The Dero wallet is a long unique string that is appended with an identifier (e.g. the date) which allows this mining instance to be considered a separate worker in the mining pool mainly for metrics. This miner will run until the users’ trial resources are expired.

Google’s Vertex AI is not the only AI platform vulnerable to this type of attack, any service which offers free/trial compute can and will be used for freejacking. Either their free trials will be abused, or their customers will be compromised and used to mine cryptocurrency. The shared responsibility model of security is important here as both the service providers and the customers need to ensure their ends are properly protected. Threat Detection and Response tools are very effective at countering cryptominers and should be used by both parties for runtime monitoring and suspicious account logins.