This document summarizes ways to attack and audit Docker containers. It discusses exploiting container capabilities, insecure volume mounts, and socket mounts. It also outlines auditing Docker images, containers, networks, volumes and registries to check for misconfigurations and vulnerabilities. The goal of auditing is to identify security issues when deploying and running Docker containers.

1. Attacking and Auditing Containers
Nishith K

2. #whoami
● TALLEST member in NS Family
● Twitter: @busk3r

3. Credits
This talk is based on research of these awesome people:
● Madhu Akula (@madhuakula)
● Jessica Frazzele (@jessfraz)

4. Outline
1. Docker Quick start
2. Attacking Docker Containers
3. Auditing Docker Containers

5. Docker QuickStart

7. Why docker?

8. Basic Terminology
Docker Image
Read Only OS with packages predefined
Container
Running state of image

9. Basic Terminology (Cont.)
Registry
Repository of Images
Public Hub
Pubic Docker Registry
Contains large number of images

10. Architecture

11. Basics (Cont.)
docker inspect <container name>
Gives complete information about container’s running state
● Start time
● Mount points
● Ports exposed
● IP

12. Docker volumes and networks
● Multiple services on different containers
● Communication between them

13. Attacking Docker Containers

14. ● Attacking container capabilities
● Attacking insecure volume mounts in containers
Attacking Docker containers/Docker escapes

15. Attacking container capabilities

16. Capabilities
● Capabilities define privileges
● Linux Capabilities are used for fine grained ACL
● “Need to know” concept , Whitelist approach
● By default the Docker drops all capabilities except those needed

17. Check container capabilities

19. Misconfiguration - ‘privileged=true’

20. Scenario

21. Capability - cap_sys_ptrace
To trace the process in host systems we require this privilege

22. Sharing Host System Processes
● Sometimes for debugging purpose people share host system
processes inside container

23. What can go wrong?

24. Exploit
Linux process injection
Find process running as host and inject payload

25. Attacking insecure volume mounts in containers

26. Socket as volume mount
● CI/CD guys run entire code in a docker which is already
running inside a docker
● To access host docker environment, pass the socket
● Attaching socket as volume mount (Portainer)

27. Scenario

28. Portainer - UI management for Docker
● Runs inside container
● Needs socket or API to access host system
● Socket as volume mount

29. Exploit
● Use docker client to access the socket mounted as volume
# docker -H unix:///var/run/docker.sock <command>

30. Auditing Containers

31. Auditing Containers
Goal: Identifying security misconfigurations while deploying and running docker
containers.
Auditing requires inspecting following components:
● Docker Images
● Docker Containers
● Docker networks
● Docker registries
● Docker volumes

32. Docker Images & Containers
Look at images configuration and options to find any issues or
misconfigurations.
# docker images --digests ubuntu

33. Check for content trust to get signatures
● Checking the image issuers with docker trust
# docker trust inspect mediawiki --pretty
● This shows who signed the repository

36. Looking for known vulnerabilities
● We can use docker hub registry scanning to check for
vulnerable packages in images
○ Clair (Vulnerability Static Analysis for Containers) - Opensource

37. Looking for known vulnerabilities
● vulners.com/audit: checks for known issues from them.

38. Docker benchmarking - Automation

39. Questions

40. References
● Docker Bench Security Audit
● Defcon 26 Docker Security Workshop
● Container Hacks and Fun Images

41. Thank You!!