Do Containers Enhance Application Level Security? Benjy Portnoy, - - PowerPoint PPT Presentation

▶
do containers enhance application level security
SMART_READER_LITE
LIVE PREVIEW

Do Containers Enhance Application Level Security? Benjy Portnoy, - - PowerPoint PPT Presentation

Jan 21, 2024 412 likes •961 views

Do Containers Enhance Application Level Security? Benjy Portnoy, CISA, CISSP # whoami BlueCoat-> Symantec Director, DevSecOps @AquaSecTeam I know, Ill use Ruby on Rails! * Thanks To Jim Brickman@gruntwork.io > gem install rails

slide-1
SLIDE 1

Do Containers Enhance Application Level Security?

Benjy Portnoy, CISA, CISSP

slide-2
SLIDE 2

# whoami

BlueCoat-> Symantec Director, DevSecOps @AquaSecTeam

slide-3
SLIDE 3

I know, I’ll use Ruby on Rails!

* Thanks To Jim Brickman@gruntwork.io

slide-4
SLIDE 4

> gem install rails

slide-5
SLIDE 5

> gem install rails Fetching: i18n-0.7.0.gem (100%) Fetching: json-1.8.3.gem (100%) Building native extensions. This could take a while... ERROR: Error installing rails: ERROR: Failed to build gem native extension. /usr/bin/ruby1.9.1 extconf.rb creating Makefile make sh: 1: make: not found

slide-6
SLIDE 6

Ah, I just need to install make

slide-7
SLIDE 7

> sudo apt-get install make ... Success!

slide-8
SLIDE 8

> gem install rails

slide-9
SLIDE 9

> gem install rails Fetching: nokogiri-1.6.7.2.gem (100%) Building native extensions. This could take a while... ERROR: Error installing rails: ERROR: Failed to build gem native extension. /usr/bin/ruby1.9.1 extconf.rb checking if the C compiler accepts ... yes Building nokogiri using packaged libraries. Using mini_portile version 2.0.0.rc2 checking for gzdopen() in -lz... no zlib is missing; necessary for building libxml2 *** extconf.rb failed ***

slide-10
SLIDE 10
  • Hmm. Time to visit StackOverflow.
slide-11
SLIDE 11

> sudo apt-get install zlib1g-dev ... Success!

slide-12
SLIDE 12

> gem install rails

slide-13
SLIDE 13

> gem install rails Building native extensions. This could take a while... ERROR: Error installing rails: ERROR: Failed to build gem native extension. /usr/bin/ruby1.9.1 extconf.rb checking if the C compiler accepts ... yes Building nokogiri using packaged libraries. Using mini_portile version 2.0.0.rc2 checking for gzdopen() in -lz... yes checking for iconv... yes Extracting libxml2-2.9.2.tar.gz into tmp/x86_64-pc-linux- gnu/ports/libxml2/2.9.2... OK *** extconf.rb failed ***

slide-14
SLIDE 14

Nokogiri, why do you never install correctly?

slide-15
SLIDE 15

> gem install rails ... Success!

slide-16
SLIDE 16

> rails new my-project > cd my-project > rails start

slide-17
SLIDE 17

Finally It Works!

slide-18
SLIDE 18
slide-19
SLIDE 19

You use the AWS Console to deploy an EC2 instance

slide-20
SLIDE 20

> ssh ec2-user@ec2-12-34-56-78.compute-1.amazonaws.com __| __|_ ) _| ( / Amazon Linux AMI ___|\___|___| [ec2-user@ip-172-31-61-204 ~]$ gem install rails ERROR: Error installing rails: ERROR: Failed to build gem native extension. /usr/bin/ruby1.9.1 extconf.rb

slide-21
SLIDE 21
slide-22
SLIDE 22

Spend 2 hours trying weird & random suggestions Replicate your dev environment in AMI

slide-23
SLIDE 23
slide-24
SLIDE 24

Now you urgently have to update all your Rails installations

slide-25
SLIDE 25

> bundle update rails

slide-26
SLIDE 26

> bundle update rails Building native extensions. This could take a while... ERROR: Error installing rails: ERROR: Failed to build gem native extension. /usr/bin/ruby1.9.1 extconf.rb checking if the C compiler accepts ... yes Building nokogiri using packaged libraries. Using mini_portile version 2.0.0.rc2 checking for gzdopen() in -lz... yes checking for iconv... yes Extracting libxml2-2.9.2.tar.gz into tmp/x86_64-pc-linux- gnu/ports/libxml2/2.9.2... OK *** extconf.rb failed ***

slide-27
SLIDE 27
slide-28
SLIDE 28

What Are Containers

Form of application deployment. Making a process think that it has the complete operating system & Dependencies for itself.

Container

[kuhn-TAY-ner] , noun

Containers to the rescue?

slide-29
SLIDE 29

Why Should you care?

Source: Datadog usage stats

Docker Hosts

slide-30
SLIDE 30

Runs Anywhere Up in Seconds Massive Scale

slide-31
SLIDE 31

How to create a containerized application?

< / >

.NET

slide-32
SLIDE 32

SECURING CONTAINERS ON THE HOST

Control Groups Namespaces Capabilities

CPU

slide-33
SLIDE 33

Lets deploy our Ruby application as a container

slide-34
SLIDE 34
slide-35
SLIDE 35

Dockerfile Example

< / >

slide-36
SLIDE 36

August 16th 2017

slide-37
SLIDE 37
  • Exploited Apache Struts Vulnerability
  • 143 Million customers impacted
  • Attack occurred from mid May to July prior to detection
  • Equifax hack shaved $4B, or about 25% of the company market

cap

September 7th 2017

slide-38
SLIDE 38

1) Apache Struts framework for dynamic web content 2) Arbitrary RCE if REST communication plugin enabled 3) The weakness is caused by how Xstream deserializes untrusted data represented as XML

CVE-2017-9805/5638 in a nutshell

slide-39
SLIDE 39

OWASP #1

Injection is #1 application attack vector

slide-40
SLIDE 40

Demo Scenario With Containers

Victim Container

  • Apache Struts server using vulnerable struts-2.3.24

Attacker Container

  • exploit CVE-2017-9805 using the victim as target
  • Python based exploit
  • Uploads a simple web shell as a web application to the

victim

slide-41
SLIDE 41
slide-42
SLIDE 42

Demo

slide-43
SLIDE 43

What if Equifax were using containers? Attack Success Criteria

  • 1. Compromise server
  • 2. Remain persistent
  • 3. Access additional internal resources
  • 4. Exfiltration of sensitive (PII) data
slide-44
SLIDE 44
  • Container Compromised and Not Host
  • Container breakout = kernel exploit
  • Less persistent (Average container life 6 hours!)
  • Minimal lateral network movement
  • Micro Service = Reduced Attack Surface
slide-45
SLIDE 45
slide-46
SLIDE 46

File Use

Le Lear arn an and A Apply ly Le Leas ast P Privile ivileges

Secrets Resource Use User Privileges Image Integrity Volumes Network Use Executables

Business Function

Shrink Wrapping Container

  • Each Micro-services should do very little
  • Learn normal behavior and block anything else (Shell.war)
  • Segment networking on, and between containers on same host
slide-47
SLIDE 47

So... Do Containers Enhance Security?

slide-48
SLIDE 48
slide-49
SLIDE 49

< / >

.NET

Docker Image Docker Host

Read Only

slide-50
SLIDE 50
slide-51
SLIDE 51

Container Security Concerns

  • Developer Controls Full Stack
  • Unauthorized images
  • Open Source vulnerabilities
  • East To West Traffic
  • Privilege escalation (Dirtyc0w?)
  • Host resource impact :(){ :|:& };:
  • Secrets Management

Attacker

Host 1 Host 2

Applicati
  • n
Applicatio n

Authenticate d User

slide-52
SLIDE 52

Call To Action

slide-53
SLIDE 53

Benjy@aquasec.com

Thank You!