Down by the Docker
A presentation at NotSoSecure Webinar by Anant Shrivastava
Down by the Docker © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
About Presenter Anant Shrivastava (@anantshri) ● ● ● ● ● ● Regional Director - NotSoSecure Global Services Limited 9 yrs of corporate experience Expertise in Network, Mobile, Application and Linux Security Speaker / Trainer : BlackHat, Nullcon, RootConf, c0c0n Co-author for OWASP Testing guide version 4 Project Lead : Code Vigilant, Android Tamer © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Docker Overview © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Why Docker • Allows to get rid of “It works on my System” syndrome • Easy & Quick to setup environments and test beds • Loved by start-up’s and for PoC Development teams • Loved by Google and likes for scalability and deployment ease • Secure: as secure as you configure it. © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
How does it differs for pentesters • From outside it will all be the same • /proc/1/cgroup will show docker references • pid 1 != init / launchd © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
How does it differs for pentesters • Bash / Python / Perl isn’t usually available • Containers are disposable hence no Persistence ensured • Containers can have different resources shared • Container crash === new spawn anywhere • Docker Internal Network (172.17.0.0/16) – • https://docs.docker.com/engine/userguide/networking/ Video: https://vimeo.com/219495998 © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Docker goof up: Running container process as root • By default host UID == container UID • Root in container == root on base box. • If a file system or part of it is shared, you have direct path to write privileges files and get root • docker run -itv /:/host alpine /bin/sh DEMO © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Docker goof up: Exposing docker sock / tcp • Docker socket == access to docker daemon • Docker could listen on port 2375 (noauth) 2376 (tls) • Generally: Dashboard or reporting application containers • Misconfiguration, (un)intended exposure == host compromise DEMO © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Docker goof up: Unpatched host / guest • Docker shares kernel with the host • Kernel bugs will result in host compromise • Unpatched guest will result in guest compromise • Video: https://vimeo.com/218622598 DEMO © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Security is by secure configuration • Docker security relies on secure configuration at all levels – Scrutinize “docker” group – Docker Socket : only available to root and docker group users – Docker daemon: only available to root and docker group users – Docker containers: run processes via limited users – Docker host + Guest: Keep then up-to-date • Scan Docker configuration files © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Docker configuration Review • Docker Security Scanning via DockerHub • Clair : https://github.com/coreos/clair • Atomic Scan: https://developers.redhat.com/blog/2016/05/02/introducing-atomicscan-container-vulnerability-detection/ • https://anchore.com/ • Dockerscan : https://github.com/cr0hn/dockerscan • Dockscan: https://github.com/kost/dockscan • Nessus: https://www.tenable.com/blog/auditing-docker-with-nessus-66 © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Docker VM • We have created a vulnerable docker VM that suffers from many of the vulnerabilities discussed throughout this session. This is available to download from the following URL: https://www.notsosecure.com/vulnerable-docker-vm/ © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Questions? © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
END PRESENTATION © Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Docker is the new kool kid in town. This presentation covers some of the common goof-ups and what should be kept in mind when dealing with docker configurations.
Video
Resources
The following resources were mentioned during the presentation or are useful additional information.
Buzz and feedback
Here’s what was said about this presentation on social media.
