Download to read offline
![{
"name": ”open",
"action": "SCMP_ACT_ALLOW",
"args": []
}
{
"name": ”read",
"action": "SCMP_ACT_ALLOW",
"args": []
}
{
"name": "fchmodat",
"action": "SCMP_ACT_ERRNO",
"args": []
}](https://image.slidesharecdn.com/hackingattempts-kubecon-181208174927/75/Three-Years-of-Lessons-Running-Potentially-Malicious-Code-Inside-Containers-48-2048.jpg)
![🔥 CVE-2014-3519 and
CAP_DAC_READ_SEARCH 🔥
for (uint32_t i = 0; i < 0xffffffff; ++i) {
outh.handle_bytes = 8;
outh.handle_type = 1;
memcpy(outh.f_handle, &ino, sizeof(ino)); //get the '/etc''s inode
memcpy(outh.f_handle + 4, &i, sizeof(i)); //only try the last 4 bit
if ((i % (1<<20)) == 0)
fprintf(stderr, "[*] (%s) Trying: 0x%08xn", de->d_name, i);
if (open_by_handle_at(bfd, (struct file_handle *)&outh, 0) > 0) {
closedir(dir);
close(fd);
dump_handle(&outh);
return find_handle(bfd, path, &outh, oh);
}
}
open_by_handle_at(fd1, (struct file_handle *)&h, O_RDONLY))
https://github.com/xxg1413/docker-security/blob/master/shocker/](https://image.slidesharecdn.com/hackingattempts-kubecon-181208174927/75/Three-Years-of-Lessons-Running-Potentially-Malicious-Code-Inside-Containers-49-2048.jpg)
![Network Policy within Kubernetes
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: default-deny-all-egress
namespace: default
spec:
policyTypes:
- Egress
podSelector: {}
egress: []
https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/12-deny-all-non-whitelisted-traffic-from-the-
namespace.md](https://image.slidesharecdn.com/hackingattempts-kubecon-181208174927/75/Three-Years-of-Lessons-Running-Potentially-Malicious-Code-Inside-Containers-68-2048.jpg)
![Falco detecting Bitcoin!
- list: miner_ports
items: [
3333, 4444, 8333, 7777, 7778, 3357,
3335, 8899, 8888, 5730, 5588, 8118,
6099, 9332
]
- macro: miner_port_connection
condition: fd.sport in (miner_ports)
- rule: Detect outbound connections to common miner pool ports
desc: Miners typically connect to miner pools on common ports.
condition: node_app_frontend and outbound and miner_port_connection
output: "Outbound connection to common miner port (command=%proc.cmdline port=%fd.rport %container.info)"
priority: WARNING](https://image.slidesharecdn.com/hackingattempts-kubecon-181208174927/75/Three-Years-of-Lessons-Running-Potentially-Malicious-Code-Inside-Containers-74-2048.jpg)
Uploaded byBen Hall
Three Years of Lessons Running Potentially Malicious Code Inside Containers
This document discusses container security and potential attacks. It begins with an overview of existing container security features like non-root users, namespaces, and seccomp profiles. It then discusses potential attacks like cryptocurrency mining malware, kernel/host attacks that bypass security restrictions, and network-level attacks. Throughout, it provides examples of how to detect and mitigate these risks using tools like Falco, network policies, and restricting egress traffic. The overall message is that containers can improve security but are not a silver bullet, and visibility and limiting what containers can access is important.
More Related Content
Similar to Three Years of Lessons Running Potentially Malicious Code Inside Containers
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
![Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]](https://cdn.slidesharecdn.com/ss_thumbnails/codedagentsdeck-251215155422-5497c599-thumbnail.jpg?width=640&height=640&fit=bounds)
Three Years of Lessons Running Potentially Malicious Code Inside Containers
- 1. Three years ofLessons from Running Potentially Malicious Code Inside Containers @Ben_Hall Ben@BenHall.me.uk Katacoda.com
- 3.
- 4.
- 9.
- 10. Agenda? • Container Security101 • Cryptocurrency Mining • Kernel/Host Attacks • Network Level Attacks
- 12. What container securityfeatures exist?
- 13. Container (Docker) Security101 • Non-Root User: Run as user 1000 • User Namespaces • Copy on Write: File isolation • cgroups: How much resources can I use? • namespaces: What can I see? • Kernel Flags: • No New Priv: Block setuid/setgid to gain root • seccomp: What can I run? • Apparmor: What is my running profile? • Capabilities (CAP_*): Enable/Disable functionality
- 14. Everyone’s “Risk Profile” isdifferent Risk Profile === Threat Modeling
- 15. Hosted CI/CD Hosted PlatformAs a Service (Heroku)
- 18. Machine Learning orCryptocurrency Mining?
- 19. Bitcoin “Attacks” Most likelyto be Monero…
- 24.
- 25. The attackers hidthe malware behind an IP address hosted by security firm Cloudflare. They also configured the mining software to use a non-standard port to reach the Internet and to connect to an unlisted or semi-public endpoint rather than well-known mining pools. https://arstechnica.com/information-technology/2018/02/tesla-cloud-resources-are-hacked-to-run-cryptocurrency-mining-malware/
- 28. How do wesolve a problem like Mining?
- 29. How do wesolve a problem like Mining? https://medium.com/@nagarwal/understanding-the-docker-internals-7ccb052ce9fe
- 30. Memory: ✅ “CPU Shares”:❌ No (Docker) network traffic shaping: ❌ Traffic Shaping is coming to CNI: ✅
- 32. 1| Kill longrunning processes 2| Block / Restrict Egress
- 33. 1| Long Running Processes Realor Fake?
- 34. 2| Block /Restrict Egress Kill the connection to the miner pools, download services
- 35.
- 36. IPTables /sbin/iptables -A OUTPUT-p tcp --dport {PORT-NUMBER-HERE} -j DROP /sbin/iptables -A OUTPUT -p tcp --dport 25 -j DROP
- 37. This doesn’t workwith Docker 👿 Need to inject into Docker IPTables Chain $ iptables -I FORWARD -o docker0 -j PRE_DOCKER
- 38.
- 39. Network Policy /Service Mesh? Kubernetes and Istio!
- 42.
- 43.
- 44. Privileged Containers $ dockerrun –privileged ubuntu bash
- 46.
- 48. { "name": ”open", "action": "SCMP_ACT_ALLOW", "args":[] } { "name": ”read", "action": "SCMP_ACT_ALLOW", "args": [] } { "name": "fchmodat", "action": "SCMP_ACT_ERRNO", "args": [] }
- 49. 🔥 CVE-2014-3519 and CAP_DAC_READ_SEARCH🔥 for (uint32_t i = 0; i < 0xffffffff; ++i) { outh.handle_bytes = 8; outh.handle_type = 1; memcpy(outh.f_handle, &ino, sizeof(ino)); //get the '/etc''s inode memcpy(outh.f_handle + 4, &i, sizeof(i)); //only try the last 4 bit if ((i % (1<<20)) == 0) fprintf(stderr, "[*] (%s) Trying: 0x%08xn", de->d_name, i); if (open_by_handle_at(bfd, (struct file_handle *)&outh, 0) > 0) { closedir(dir); close(fd); dump_handle(&outh); return find_handle(bfd, path, &outh, oh); } } open_by_handle_at(fd1, (struct file_handle *)&h, O_RDONLY)) https://github.com/xxg1413/docker-security/blob/master/shocker/
- 50. Kernel Information $ uptime $uname –a Linux sd-138464-host14 4.4.0-122-generic #146-Ubuntu SMP Mon Apr 23 15:34:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux $ cat /proc/cpuinfo $ df -h
- 54.
- 55. 😈 Write Everythingto disk! 😈 dd if=/dev/zero of=file.txt count=1024 bs=1024
- 56. Storage Device havinga quota? Doesn’t matter. If you are root, you can write to /etc/hosts File is mounted to every container outside of quota
- 57. $ podman run-it alpine sh
- 58. :(){ :|: &};:
- 60. $ docker run-it -pid-limit=512 ubuntu bash https://www.twistlock.com/labs-blog/escaping-docker-container-using-waitid-cve-2017-5123/
- 61.
- 62. DDoS === Hostingprovider becomes unhappy
- 64. Can’t block outbound externalattacks with Istio Functionality similar to conntrack?
- 65.
- 66. If I’m onthe inside, I’ll spin up another container/pod, by- passing memory restrictions… Attacking Kubernetes API Server via Service Accounts & Tokens
- 67. Network Policy withinKubernetes kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: api-allow spec: podSelector: matchLabels: app: bookstore role: api ingress: - from: - podSelector: matchLabels: app: bookstore
- 68. Network Policy withinKubernetes kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: default-deny-all-egress namespace: default spec: policyTypes: - Egress podSelector: {} egress: [] https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/12-deny-all-non-whitelisted-traffic-from-the- namespace.md
- 70.
- 71. Log IPTables Drops iptables-F KC_LOG_DROP iptables -N KC_LOG_DROP iptables -A KC_LOG_DROP -j LOG --log-prefix "KATACODA:INPUT:DROP: " --log-level 7 iptables -A KC_LOG_DROP -j DROP
- 74. Falco detecting Bitcoin! -list: miner_ports items: [ 3333, 4444, 8333, 7777, 7778, 3357, 3335, 8899, 8888, 5730, 5588, 8118, 6099, 9332 ] - macro: miner_port_connection condition: fd.sport in (miner_ports) - rule: Detect outbound connections to common miner pool ports desc: Miners typically connect to miner pools on common ports. condition: node_app_frontend and outbound and miner_port_connection output: "Outbound connection to common miner port (command=%proc.cmdline port=%fd.rport %container.info)" priority: WARNING
- 75.
- 77. In Summary, Are ContainersSecure?
- 79. Think VMs contain? CVE-2016-3710:QEMU: out-of-bounds memory access issue Venom QEMU/KVM – Attack via floppy driver #include <sys/io.h> #define FIFO 0x3f5 int main() { int i; iopl(3); outb(0x0a,0x3f5); /* READ ID */ for (i=0;i<10000000;i++) outb(0x42,0x3f5); /* push */ }
- 81. Quick Wins! • Don’tallow root (limits easy attacks) • Read Only Filesystems • Block Egress – Why do I need to run apt-get in production? • Network Policies / Service Mesh / Istio! • Create Visibility
- 82.
Editor's Notes
- #59 :(){ :|:& };: \_/| |||| ||\- ... the function ':', initiating a chain-reaction: each ':' will start two more. | | |||| |\- Definition ends now, to be able to run ... | | |||| \- End of function-block | | |||\- disown the functions (make them a background process), so that the children of a parent | | ||| will not be killed when the parent gets auto-killed | | ||\- ... another copy of the ':'-function, which has to be loaded into memory. | | || So, ':|:' simply loads two copies of the function, whenever ':' is called | | |\- ... and pipe its output to ... | | \- Load a copy of the function ':' into memory ... | \- Begin of function-definition \- Define the function ':' without any parameters '()' as follows: