\n
![](\"https:\/\/readwrite.com\/wp-content\/uploads\/2024\/03\/Massive-hack-hits-AI-servers-exploits-Ray-framework-vulnerability-900x600.png\")
<\/p>\n [ad_1]
\n<\/p>\n
Researchers have found that thousands of servers, running AI<\/a> infrastructure, have been hacked in an active attack campaign. This attack targets a reported vulnerability in Ray, a computing framework used by the likes of OpenAI, Uber, and Amazon.<\/p>\n According to analysts at Oligo, a cybersecurity firm, the vulnerability allows attackers to take over the companies\u2019 computing power and leak sensitive data. The blog post stated<\/a> that this flaw has been under active exploitation for the last seven months, affecting sectors like education, cryptocurrency, biopharma and more.<\/p>\n I discovered an active attack campaign targeting a vulnerability in Ray. Thousands of companies running AI infrastructure are exposed to the attack through a critical vulnerability that is under dispute and thus has no patch.<\/p>\n It all began with a client that was using Ray. pic.twitter.com\/BrVr2p8yOu<\/a><\/p>\n \u2014 Avi (@avi_lum) March 26, 2024<\/a><\/p>\n<\/blockquote>\n They claim that a trove of sensitive information from compromised servers has been leaked, targeting entities such as OpenAI<\/a>, Hugging Face<\/a>, Stripe, and Slack, as well as cloud environments like Amazon\u2019s AWS<\/a> and Microsoft Azure<\/a>.<\/p>\n Oligo reports that it discovered hundreds of compromised clusters, with hackers allegedly installing cryptocurrency miners on compromised infrastructure. The researchers explain that attackers choose to compromise these machines because they can obtain valuable sensitive information, and GPUs are very expensive and difficult to obtain.<\/p>\n The company reports that GPU on-demand prices on AWS can reach an annual cost of $858,480 per machine, which means the total amount of machines and computing power that might have been compromised is estimated to be worth almost a billion dollars. Attackers have also installed reverse shells, which are text-based interfaces that allow for remote server control.<\/p>\n In a statement, it continued: \u201cWhen attackers get their hands on a Ray production cluster, it is a jackpot. Valuable company data plus remote code execution makes it easy to monetize attacks\u2014all while remaining in the shadows, totally undetected (and, with static security tools, undetectable).<\/p>\n Ray, an open-source unified compute framework, simplifies the scaling of AI and Python workloads, including everything from reinforcement learning and deep learning to tuning and model serving.<\/p>\n These applications generally operate on large clusters of servers. A central dashboard serves as an interface for displaying and managing active tasks and applications. Among the programming interfaces accessible via this dashboard is the Jobs API. It enables users to dispatch a list of commands to the cluster through a straightforward HTTP request that doesn\u2019t require authentication.<\/p>\n In November 2023, analysts from the security outlet Bishop Fox spotted<\/a> a similar vulnerability in Ray, tracked<\/a> as CVE-2023-48022. Bishop Fox senior consultant Berenice Flores Garcia wrote in a blog post: \u201cIn the default configuration, Ray does not enforce authentication. As a result, attackers may freely submit jobs, delete existing jobs, retrieve sensitive information, and exploit the other vulnerabilities described in this advisory. \u201c<\/p>\n A spokesperson for Anyscale, the developer behind Ray, confirmed to ReadWrite that there were a number of issues it was fixing. In a statement, they said<\/a>: \u201cIn light of reports of malicious activity, we have moved quickly to provide tooling to allow users to verify proper configuration of their clusters to avoid accidental exposure.\u201d<\/p>\n They also said the firm was providing a client-side script and server-side code and that it had pre-configured the defaults of the client-side script to reach out to a server it has set up, simplifying the process of determining whether or not ports are unexpectedly open.<\/p>\n Last October, the company had initially denied the reports stating that four of the five reported bugs had already been fixed in November. They disputed the term \u201cvulnerability,\u201d referring to it as a bug instead.<\/p>\n\n
What is the Ray AI framework?<\/h2>\n
Anyscale response<\/h2>\n