rootedcon 2017 - docker might not be your friend. trojanizing docker images

Docker Might not be your friendTrojanizing Docker like a Sir

RobertoMuñoz(robsky)-@skyeinthewildDanielGarcía(cr0hn)-@ggdaniel

Dockermightnotbeyourfriend-TrojanizingDockerlikeaSir

DanielGarcía(cr0hn)-@ggdaniel|RobertoMuñoz(robskye)-@skyeinthewild

<spam>AboutUs</spam>

• Creator/co-creatormanysecuritytools

• Securityresearcher/ethicalhacking

• ChapterLeaderOWASPMadrid

• Pythondeveloper

https://www.linkedin.com/in/garciagarciadaniel

https://www.linkedin.com/in/roberto-muñoz-fernández-8389a313/

• SecDevOPs

• Securityresearcher

• Former BOFH (Because even developersneedheroes)

What’sthistalkabout?

1. What’sDocker2. TheDockerenvironment3. What’saC.I./C.D.cycle?4. DissectingDockerimages5. AbusingDockerregistry?6. Conclusions

What’sthistalkabout?

1. What’sDocker2. TheDockerenvironment3. What’saC.I./C.D.cycle?4. DissectingDockerimages5. AbusingDockerregistry?6. Conclusions

WHAT’SDOCKER?

Ifyoufeellikethemonkeysof2001odyssey,thisischapterisimportanttoyou

What’sDocker-Abriefdefinition

What’sDocker-DockervsVM

IS NOT

VIRTUALIZATION

What’sDocker-Parts

Dockerfile Image Container

What’sDocker-PartsDifferent

But similar

THEDOCKERENVIRONMENTNeighbourhoodcolleagues

Dockerenvironment

DockerRegistry

Dockerenvironment

DockerRegistry DockerOrchestrators

Dockerenvironment

DockerHost

DockerRegistry DockerOrchestrators

Dockerenvironment

DockerHost

DockerRegistry

DockerImagebuilder

DockerOrchestrators

Dockerenvironment

DockerHost

DockerRegistry

DockerImagebuilder

DockerOrchestrators

WHAT’SAC.I./C.DCYCLE?

Ensurethatyourbossdoesnotseethis,hecouldrealisethatyouarenotreallynecessary….fired!fired!fired!

Summary-Definitions1. Continuous Integration - C.I:

“Is the practice of merging all developer working copies to a shared mainline several times a day.”

2. Continuous Deployment - C.D: “Is a software engineering approach in which teams produce software in short cycles, ensuring that the software can be reliably released at any time.”

Source Wikipedia

C.I-Classiccycle

C.I-ClassiccycleVery manual process

Restart the process is hard

C.I.-Newapproach

https://insights.sei.cmu.edu/devops/2015/01/continuous-integration-in-devops-1.html

C.I.-Newapproach

C.I.+C.D.-NewapproachwithDocker

DockerImagebuilder

DockerHost DockerRegistry

Orchestrator

DockerImagebuilder

Orchestrator

DockerImagebuilder

Orchestrator

DockerImagebuilder

Orchestrator

DockerImagebuilder

Orchestrator

DockerImagebuilder

Orchestrator

DockerImagebuilder

Orchestrator

DockerImagebuilder

Orchestrator

DockerImagebuilder

Orchestrator

DockerImagebuilder

Orchestrator

DockerImagebuilder

Orchestrator

DISSECTINGDOCKERIMAGES

ShutupandtellmehowIcanbreakitdown

What’sadockerimage?

Dockerimageparts-GlobalMetadata

GlobalmetadataJSONfile

• Globalinfoaboutimage• Modificationhistory• ASHA256hashofeachlayer.Storedinorder.

Dockerimageparts-Manifest

Manifestfile

• Areferencetoglobalconfigfile.

• Listoftagsfortheimage.• Listoflayers.INORDER

Dockerimageparts-Repositories

Repositories

• Repositorywitchbelongtheimage.

• Repositorytagsavailable.• Areferencetothelastlayer.

Dockerimageparts-Layers

Imagelayers

• Adockerimagecancontainsanynumberoflayers

• Eachlayerhastheirownfolder.

• Eachlayerhas3files:• json• layer.tar• VERSION

Dockerimageparts-Layercontent

• Layermetadata• Referencetotheparentlayer

• Layerversion

• Folders/files• Incrementalfilesystem

Dockerimageparts-Extractingcontent

ManipulatingDockerimages-Why?• Changeenvironmentvars

• ChangeEntryPoint

• Addnew/modifyfiles

• Analysetheimage

• Extractthecontent

ManipulatingDockerimages-Problems

Manifest/Metadataonlymeetthelayerhash

Thelayerhashisreferencedinmanyplaces

Atinychangeinalayercontentimpliesmanychangesinmany

files.

SHA256:f94a86523746be32e7981681172198717edd94333d263b1f64228a41e14dc6b5

Weneedtoupdatethereferencesandmetadata

SHA256:f94a86523746be32e7981681172198717edd94333d263b1f64228a41e14dc6b5

ManipulatingDockerimages-Attacks

LD_PRELOAD

Docker Scan

https://github.com/cr0hn/dockerscan

Docker Scan

¡Demotime!

TrojanizingDockerImageswithDockerScan

ABUSINGDOCKERREGISTRY?Yes,welovebreakthings…

DockerRegistry(D.R)-Briefsummary

• Storagedockerimages.• Indextheimageshashes• Create a logical structure to locatedockerimages:repository/image:tag

• ExposesaRESTAPItointeract.

D.R.-Asimagestorage

Storageserver Indexingserver

D.R.-Howregistrystoragetheimages?

……

Images

……

Images Tags

latest

1.1.10

1.11.10-alpine

1.10.3-alpine

……

Images Tags

D.R.-Asimagestorage:Uploadprocess

Client DockerRegistry

Iwantuploadtheimage:minion

Oks.HereisyouruploadPath

Uploading…

SHA256:f94a86523746be32e7981681172198717edd94333d263b1f64228a41e

14dc6b5

Uploading…

Addthetag:Latest

minion :Latest

Uploading…

Addthetag:Latest

minion :Latest

D.R.-Attacks:Uploadnonaccessiblefiles

Uploading…

Addthetag:Latest

minion :Latest

D.R.-Attacks:Uploadnonaccessiblefiles

¡Demotime!

Uploadingfilesthatonlyyoucandownload…

D.R.-Attacks:Uploadnonaccesiblefiles

D.R.-Attacks:Replaceremoteimages

latest

1.1.10

1.11.10-alpine

1.10.3-alpine

……

Images Tags

D.R.-Attacks:Replaceremoteimages

latest

1.1.10

1.11.10-alpine

1.10.3-alpine

……

Images Tags

latest

D.R.-AshortsearchinShodan

CONCLUSIONS

Theconclusionissimple:givemeyourmoneyandavoidintermediaries

WENEEDTOINVOKESECURITY!

BUILDBESTPRACTICES

• Donottrustnameortags,usedigestsinsteadinFROMdeclarations.

• Alwayschecktheintegrityofanythingdownloadedinbuildtime.

REGISTRYSECURIZATION• ImplementsomeoftheavailableauthN/authZoptions.

• Limittheexposure,thebestcasescenarioiswhereonlythebuildserversareallowedtopushimagestoregistries

• Implementsigning(https://github.com/docker/notary)anddon'texecuteunsignedimages.

RUNTIMEPROTECTION• Don'texecuteimageswithexcessiveprivileges(--privilegedflag,addedcapabilities,disablednamespaces,etc)

• Usenativedockersupportedcustomsecurityprofilesforyourcontainers(Seccomp,Selinux/Apparmor)

• Usedynamicanalysistoolstocreatebehaviouralprofilesofthecontainersandmonitoranysuspectchangeinthecontaineractivity.

Becareful….

…thereisalwayssomeonewatching

Questions

Thankyou!

rootedcon 2017 - docker might not be your friend. trojanizing docker images

Technology