WTF my container just spawned a shell!

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Jorge Salamero Sanz
@bencerillo
WTF my
container just
spawned a shell!

Sysdig
Open Source system troubleshooting
with native container support
(htop, vmstat, netstat, lsof, tcpdump…)
Monitoring...

Securing Microservices
Defense in depth Microservices
Single responsibility principle:
• Principle of least privileges
• P...

Container Security Techniques
• New workflows (docker pull vs previous apt update/yum update)
• CI/CD Pipeline (Jenkins, O...

Docker Security Techniques
• Drop privileges
• Limit capabilities
• Do not run as root! containers are not VMs!
• cgroups
...

Scanning
What are my containers doing?
• Static scanning
• Dynamic scanning

Static Scanning
Yay, this was soo easy to deploy! I Docker Hub!
(your developers too, actually they were already using it ...

Image Vulnerability Scanning
• Scan contents of images looking for software versions with
known defects
• Container image ...

Image Vulnerability Scanning
• Scan contents of images looking for software versions with
known defects
• Container image ...

Image Vulnerability Scanning
• Scan contents of images looking for software versions with
known defects
• Container image ...

Image Vulnerability Scanning
• Scan contents of images looking for software versions with
known defects
• Container image ...

Container Security Techniques
OK, no known vulnerabilities, still secure?
Containers are black boxes exposing a behaviour,...

Tools
• Basic sandboxing: seccomp
• Sandboxing with policies: seccomp-bpf
• Mandatory access control systems: SELinux, App...

Seccomp
• Seccomp: application system call “sandboxing”
• One-way transition to a restricted state
• Limited set of system...

Seccomp-bpf
• Security profiles per application/container:
• Create filter (BPF program ) with lists of allowed syscalls
•...

Mandatory Access Control
• SELinux or AppArmor
• Same mechanisms: kernel-level interception/filtering
• features++ && comp...

Auditd
• Access monitoring system
• Logger for SELinux
• Rules based on files and syscalls:
# Alert whenever anyone perfor...

Sysdig Falco
An anomaly detection system built on
top of the sysdig engine

Sysdig
Kernel
Docker
Container
1
Container
2
Container
3
App App
rkt LXC
Kernel module
Instrumentation

Event stream
Open
Read
Close
Connect
Read
Write
Read
Read
Write
Close
Dump to Disk
Filter
Analyze

Events context
• Syscalls are turned into events with context:
• the process name performing the system call
• the process...

What is Sysdig Falco?
• Detects suspicious activity defined by a set of easy
rules
• Uses sysdig’s flexible and powerful f...

Quick Examples
A shell is run in a container container.id != host and proc.name = bash
Overwrite system binaries
fd.direct...

Falco Rules
• .yaml file containing Macros, Lists, and Rules
- macro: bin_dir
condition: fd.directory in (/bin, /sbin, /us...

Alerts and Outputs
• Events that match filter expression (rule) result in alerts
• output field used to format event into ...

Falco Demo

Further reading
● Documentation:
○ https://sysdig.com/blog/selinux-seccomp-falco-technical-dis
cussion/
○ https://sysdig.c...

Thank You!

You are reading a preview.

Activate your 30 day free trial to continue reading.

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

LinkedIn
Facebook
Twitter
Email

Replay

Top clipped slide

1 of 28 Ad

1 of 28 Ad