Safebreach found three methods to run cryptominers in Azure Automation without costing anything and while hiding the job from the customer (so if an attacker somehow gained access to a target environment they could run cryptomining jobs undetected, in terms of both billing and job monitoring). Following disclosure, Azure fixed some of the bugs that enabled this.
Summary (give a brief description of the issue)
Safebreach found three methods to run cryptominers in Azure Automation without costing anything and while hiding the job from the customer (so if an attacker somehow gained access to a target environment they could run cryptomining jobs undetected, in terms of both billing and job monitoring). Following disclosure, Azure fixed some of the bugs that enabled this.
References (provide links to blogposts, etc.)
https://www.safebreach.com/blog/cryptocurrency-miner-microsoft-azure