Docker Windows Port 2375
Docker Port 2375
Docker Port 2375 Connection Refused

Accessing Docker Daemon on port 2375. Docker Desktop for Mac. Qtzar (Qtzar) May 26, 2016, 7:58pm #1. Is it possible to allow application on the Mac access to.
Description Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp with tls but without tls-auth), an attacker can create a docker container with the '/' path mounted with read/write permissions on the host server that is running the docker container and use chroot to escape the container-jail.

Attackers are actively scanning for exposed Docker APIs on port 2375 and use them to deploy a malicious payload which drops a Dofloo Trojan variant, a malware known as a popular tool for building large scale botnets.

The Dofloo (aka AESDDoS) malware was first detected in 2014 [1, 2, 3, 4] and it is known for allowing hackers to quickly assemble vast numbers of compromised machines used to create botnets that can launch DDoS attacks and — in the case of some variants — to load cryptocurrency miners to the infected machines.

Misconfigured Docker services being abused is a known trend given that they have been under constant attack since early-2018 after coinminer campaigns started spreading to the cloud following the drop in activity seen by ransomware operations after the end of 2017.

Unit Description=Docker HTTP Socket for the API Socket ListenStream=2375 BindIPv6Only=both Service=docker.service Install WantedBy=sockets.target Register the new systemd http socket and restart docker systemctl enable docker-tcp.socket systemctl stop docker systemctl start docker-tcp.socket. The docker socket can be configured on any port with the dockerd -H option. Common docker ports that I see include: 2375: unencrypted docker socket, remote root passwordless access to the host. 2376: tls encrypted socket, most likely this is your CI servers 4243 port as a modification of the https 443 port. 2377: swarm mode socket, for swarm. Port 2375 Details. A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. Affected Products: This vulnerability affect all releases of Cisco CloudCenter Orchestrator (CCO.

Attacks, infection, and abuse

In the campaign observed by Trend Micro, misconfigured APIs of the Docker Engine-Community DevOps utility that allow external access to the communication ports are abused by attackers making it possible to infiltrate misconfigured servers.

'Allowing external access — whether intentionally or by misconfiguration — to API ports allows attackers to gain ownership of the host, giving them the ability to poison instances running within it with malware and to gain remote access to users’ servers and hardware resources,' says Trend Micro.

The attacks begin with an Internet scan for vulnerable Docker hosts by sending TCP SYN packets to port 2375 — the Docker daemon communication port which allows for unencrypted and unauthenticated communication— using an open source SYN/TCP port scanner, with the bad actors connecting to all live host they found and asking for running containers.

The Dofloo botnet malware is subsequently 'deployed using the docker exec command' to all discovered containers says Trend Micro's research, executing the malware that will enable the 'attackers to launch several types of DDoS attacks, such as SYN, LSYN, UDP, UDPS, and TCP flood.'

System information is also collected by the Trojan after execution, with the data being packed and sent to its command-and-control (C&C) server allowing its masters to decide what the next course of action will be depending on the hardware configuration of the compromised machine.

Trend Micro's research team provides a list of Indicators of Compromise (IOCs) containing hashes of malware samples used during these attacks at the end of the report.

Previous Dofloo and Docker attacks

Dofloo was previously detected while being dropped by a malicious campaign that exploited a critical server-side template injection Atlassian Confluence Server and Data Center vulnerability to compromise Linux and Windows servers in late April.

Exposed Docker APIs were abused by other malicious campaigns, with one being detected in March by Imperva while exploiting the CVE-2019-5736 runc vulnerability disclosed one month earlier allowing attackers to overwrite the host runc binary and gain root-level code execution privileges.

Cryptojacking operations have also actively targeted misconfigured Docker services in November 2018 as unearthed by Juniper Networks researchers, with cybercriminals adding their own containers which executed Monero mining scripts.

Further back, in October 2018 and March 2018, other campaigns have also been observed while scanning the Internet for easy to infiltrate Docker hosts and deploy containers that would download and execute coin miners.

Securing Docker servers

While Docker Engine API abuse is not something new, it keeps being an issue because administrators do not know how to properly secure their systems.

Docker Windows Port 2375

To make sure that their Docker hosts are secured against this types of attacks, admins should be using adequate security controls that allow only trusted sources to access the Docker API as explained in the Securing Docker remote daemon chapter available on the Docker documentation website.

Related Articles:

In linux distros running systemd, like Ubuntu 15.04, adding -H tcp://0.0.0.0:2375 to /etc/default/docker does not have the effect it used to.

Docker Port 2375

Instead, create a file called /etc/systemd/system/docker-tcp.socket to make docker available on a TCP socket on port 2375:

Then enable this new socket:
systemctl enable docker-tcp.socket
systemctl enable docker.socket
systemctl stop docker
systemctl start docker-tcp.socket
systemctl start docker

Docker Port 2375 Connection Refused

Test that it's working:
docker -H tcp://127.0.0.1:2375 ps

Source: https://coreos.com/docs/launching-containers/building/customizing-docker/