Aqua Security Blog

The original write-up is linked from this post https://www.crowdstrike.com/blog/cr8escape-new-vulnerability-discovere… - Good, lots of details on exact reproduction. One idea for mitigation before you can get a patch out for this would be to use admission control (e.g. OPA/Kyverno) to block setting custom sysctls altogether or blocking the characters used in the attack. There's some notes on that https://blog.aquasec.com/cve-2022-0811-cri-o-vulnerability and Kyverno have a mention of the finer grained policy https://twitter.com/kyverno/status/1504499323324678145 One thing that's worth noting is that to exploit this the attacker needs create pod rights (or rights to create a workload type that then creates pods), so it's probably not critical for every cluster.

>individual teams can’t deploy their code without coordinating with every other team, which yields long user feedback loops and a bunch of other knock-on effects Fine until one of the microservices needs an update with new features -> new API because Something Has Changed, and suddenly... >the whole purpose of containers is to decouple the application from the platform. Are containers not a de facto platform? >Literally laughing out loud at the idea that marketing people are behind microservices. Here's a moderately complete list of products. How many are pay-to-play? https://www.aquasec.com/cloud-native-academy/container-platforms/conta… All you're really doing with containers is creating a meta-monolith running on external hardware with custom automation - managed by an ever so handy third party software product. Also running on external hardware. All of which you're paying for. You can also DIY and not pay. In theory. But really...? This makes sense at global scale where you're drowning in income and need to handle all kinds of everything for $very_large_number customers. It's complete madness for a small startup that doesn't even have a proven market yet.

(Same discussion as on lobste.rs) Thank you for this link, I've only seen the initial CVE announcement. > This is not FUD [...] The site is practicing FUD, it accomplishes communicating a message in an untruthful fashion by mixing two different things into one. (Just check out their stack overflow links, it is not clear if they are talking about root or `--privileged`) People are confused wether `docker root == host system root` and this site doesn't help them to get a better understanding whether or not it is the case. (It isn't) Plus it misses what its main goal should be, running a Secure Docker environment. You are talking about a previous exploit, not a permanent issue. Keeping your host system up to date and additional hardenings is always going to be necessary in exposed environments. > Use Docker containers with SELinux enabled (--selinux-enabled). This prevents processes inside the container from overwriting the host docker-runc binary. Authors recommendation is also using SELinux, this also helped with outer Docker/Kernel related vulnerabilities in the past. Why isn't the page even mentioning this? --- I think it is important to give a proper outlook on how problematic things are and not to confuse people with super high expectations. You often end up running containers that you have only little control about. 1. Avoiding root in self-built containers is definitively the way to go, since it reduces (unnecessary) attack surface, but 1. It requires some…

They have written about it on github to my question: Trivvy hacked (https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-t… -> all circleci credentials leaked -> included pypi publish token + github pat -> | WE DISCOVER ISSUE | -> pypi token deleted, github pat deleted + account removed from org access, trivvy pinned to last known safe version (v0.69.3) What we're doing now: Block all releases, until we have completed our scans Working with Google's mandiant.security team to understand scope of impact Reviewing / rotating any leaked credentials https://github.com/BerriAI/litellm/issues/24518#issuecomment-411997237…

Sounds like Trivy is still compromised: https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-t…

This blog post[1] explains why that is not a safe assumption. [1]: https://www.aquasec.com/blog/container-isolation/

They're OCI images now, and Docker was largely a stolen idea from UNIXes* (unices?), including the term containers. As much as I like what Podman to open it up using Containerfiles and not defaulting to this, it might as well go even farther tweak the standard a bit - provide something like Dockerfile that's less golang-inspired and more linux-inspired, and improve the format for images - so the industry can move on from Docker lock-in. * https://www.aquasec.com/blog/a-brief-history-of-containers-from-1970s-…

The article misses one critical point in these attacks: practically all these attacks require downloading remote files to the server once they gain access, using curl, wget or bash. Restricting arbitrary downloads from curl, wget or bash (or better, any binary) makes these attacks pretty much useless. Also these cryptominers are usually dropped to /tmp, /var/tmp or /dev/shm. They need internet access to work, so again, restricting outbound connections per binary usually mitigates these issues. https://www.aquasec.com/blog/kinsing-malware-exploits-novel-openfire-v…

See the mitigation section in the article: https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-mill… UEFI won't help here. But keeping your system up to date and limiting the system to the necessary functionality will help you.

Direct link to the blog [1] [1] - https://blog.aquasec.com/loony-tunables-vulnerability-exploited-by-kin…

Is VS Code a text editor? I wouldn't consider anything that has internet access permissions or a suite of 3rd party user plugins/extensions a text editor but that's just me. Giving VS Code express permission to your home/filesystem (the default if you install it traditionally) is a security risk [0] [1] most people rarely think about. [0] https://blog.aquasec.com/can-you-trust-your-vscode-extensions [1] https://www.techradar.com/news/hackers-are-using-malicious-microsoft-v…

> However both are pretty much mimicked concept from Solaris Zones Your timeline is off. FreeBSD and Linux were within a year of each other (not in-tree on linux, but Debian packaged VServer kernels and VServer + GRSec kernels; we used vserver+grsec debian packaged kernels at work in the mid through late '00s). Solaris containers came years later. 2000 - FreeBSD jails 2001 - Linux VServer 2004 - Solaris Containers https://blog.aquasec.com/a-brief-history-of-containers-from-1970s-chro…

Not sure if this is common knowledge (??) but I feel I should note here: in my job we absolutely do not consider containers to be a security boundary[1]. On the other hand I still tend to use them for isolation on my personal boxen, because they at least reduce the blast radius of bugs or shitty packaging. [1] Random search result that appears to corroborate my claim: https://blog.aquasec.com/container-isolation

Aqua Security | Open Source Engineer (Go) | Remote Aqua Security provides the next generation of Cloud Native security solutions, and open source has been core to our DNA and strategy. Our Open Source team is fully remote worldwide. We are looking for engineers to work on: - https://github.com/aquasecurity/starboard : Golang, Kubernetes, K8s operator. - https://github.com/aquasecurity/trivy : Golang, OPA, vulnerabilities & Infrastructure as Code scanning. I'm the hiring manager, feel free to DM me on twitter @itaysk if you have questions. Apply here: https://www.aquasec.com/about-us/careers/co/engineering/81.E1B/open-so…

They aren't all over the place, in fact they are far more advanced than whatever you're referring to. Containers on Linux have also existed for a long time: https://blog.aquasec.com/a-brief-history-of-containers-from-1970s-chro… The containerization solutions you're referring to didn't gain widespread adoption like Docker and Kubernetes because they weren't as polished and lacked features and functionality that is available today. Windows containers have a big image requirement, and most server-side software is already optimized for Linux so they aren't in high demand. Just take a look at Docker Hub and tell me how many Windows containers you find compared to Linux, especially the official images of the most common software.

There are lots of options out there. I'm currently exploring Cloud Foundry for our platform, since our core API is written in Spring Boot. This page from AquaSec has lots of links to articles comparing Cloud Foundry to Kubernetes. https://www.aquasec.com/wiki/display/containers/Kubernetes+vs+Cloud+Fo… I also found this book to be helpful https://www.amazon.com/gp/product/B07T1Y2JRJ/ref=ppx_yo_dt_b_d_asin_ti…

Even earlier was Linux VServer, which was 2001 :) So yeah, Linux containers have been around in one form or another for over a decade before Docker helped popularise things. This makes some interesting reading: https://blog.aquasec.com/a-brief-history-of-containers-from-1970s-chro…

> Containers already existed Fascinating. I'm admittedly very new to container-land, but my understanding was precisely the opposite - that Docker invented this concept and practice of building a runtime environment that can then be replicated and deployed to many hosts. Do you have any search terms or articles I should pursue to learn more about the predecessors? I've read through this[0], but it mostly suggests that approaches prior to Docker provided isolation/jailing, which is an important part of containerization but neglects a lot of tooling around building, deploying, etc. [0] https://blog.aquasec.com/a-brief-history-of-containers-from-1970s-chro… EDIT: various other comments ("The Docker UX is what made the difference, not the underlying tech. Building containers in an easy incremental and reproducible way that could then be stored in a repo and pulled over HTTP was the evolution in packaging that was needed.", "I think the feature that won the hearts of devs was the incremental builds that let people fail quickly in a forgiving way", "Containers were painful as hell to set up and use; it was like using Git, but worse. Docker made it convenient, simple, and useful. By now everybody understands that immutable artifacts and simple configuration formats are extremely effective") seem to support this perception. EDIT2: Thanks to all those that replied!

It is unrealistic to fit Kubernetes Security Best Practices into a single blog post. Here are MANY other blog posts or other very similar content: https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-… https://www.aquasec.com/wiki/display/containers/Kubernetes+Security+Be… https://dev.to/petermbenjamin/kubernetes-security-best-practices-hlk https://techbeacon.com/hackers-guide-kubernetes-security https://www.sumologic.com/blog/devops/kubernetes-security-best-practic… https://news.ycombinator.com/item?id=16764743 https://speakerdeck.com/ianlewis/kubernetes-security-best-practices https://dzone.com/articles/kubernetes-security-best-practices and a quick search reveals a full length e-book about it: https://info.aquasec.com/kubernetes-security-sem (https://kubernetes-security.info/) https://cdn2.hubspot.net/hubfs/1665891/Assets/Kubernetes%20Security%20…

Multiple CVEs for escaping? E.g.: * https://blog.aquasec.com/cve-2022-0185-linux-kernel-container-escape-i… * https://securitylabs.datadoghq.com/articles/dirty-pipe-container-escap… * https://snyk.io/learn/docker-security/top-5-vulnerabilities/ * https://www.container-security.site/attackers/container_breakout_vulne… The only escaping of jails that I've heard of in the last ~20 years is one not in the jails code, but tunnelling out through devfs: * https://www.freebsd.org/security/advisories/FreeBSD-SA-14:07.devfs.asc