Containers: The ultimate Trojan horse

guest · Nov 14, 2022

By Stefano Chierici - November 12, 2022

Containers are meant to be immutable. Once the image is made, it is what it is, and all container instances spawned from it will be identical. The container is defined as code, so its contents, intents and dependencies are explicit. Because of this, if used carefully, containers can help reduce supply chain risks.

However, these benefits have not gone unnoticed by attackers. A number of threat actors have started to leverage containers to deploy malicious payloads and even scale up their own operations. For the Sysdig 2022 Cloud-Native Threat Report, the Sysdig Threat Research Team (Sysdig TRT) investigated what is really lurking in publicly available containers.
Click to expand...

Public registries: A double-edged sword
Docker Hub is the most popular free public-facing container registry.
While public registries save developers time, if a user is not careful, there could be malicious aspects to the container they pull. With so many containers to choose from, it is easy to choose the wrong one.

According to the Sysdig threat report, DockerHub is being used by malicious actors to deliver malware, backdoors, and other unwelcome surprises to users and companies. One specific practice to watch out for is typosquatting, which is when an image is disguised as legitimate while hiding something nefarious within its layers.
Click to expand...

Upon taking a closer look, we see that cryptomining images are the most common malicious image type.

Embedded secrets in Docker images is the second most prevalent attack technique. In this case, attackers insert secrets in an image and use this information to get a foothold in your environment and then try to move laterally.
Click to expand...

Containers are here to stay in the supply chain. In fact, their adoption continues to increase. Organizations must understand the risks that premade images can introduce. Cryptominers can get very expensive very fast, and backdoors can lead to a compromise of your entire infrastructure. Everyone loves containers. Attackers love containers too.
Click to expand...

Sysdig 2022 Threat Report: Cloud-native threats are increasing and maturing

The first annual cloud-native threat report from Sysdig explores some of the year’s most important security topics in the cloud. As the use of containers and cloud services keeps growing, threat actors are increasingly turning their attention to this new attack surface. The cloud offers unique opportunities for threat actors due to the inherent scalability and complexity of cloud resources.

It turns out, a single malicious person can be prolific and quite impactful just by abusing misconfigurations and old exploits. As we will see, they can earn thousands of dollars almost passively off of their victims’ infrastructure.
Click to expand...

Containers are great, as they allow developers to quickly get infrastructure up and running. However, threat actors can hide malicious code inside of these pre-built containers. If one wrong image is loaded, the entire environment can be compromised.
Click to expand...

guest · Nov 24, 2022

Docker Hub repositories hide over 1,650 malicious containers
By Bill Toulas @billtoulas - November 24, 2022

Over 1,600 publicly available Docker Hub images hide malicious behavior, including cryptocurrency miners, embedded secrets that can be used as backdoors, DNS hijackers, and website redirectors.
Click to expand...

Docker Hub is a cloud-based container library allowing people to freely search and download Docker images or upload their creations to the public library or personal repositories.

Docker images are templates for the quick and easy creation of containers that contain ready-to-use code and applications. Therefore, those looking to set up new instances often turn to Docker Hub to quickly find an easily deployable application.
Click to expand...

Unfortunately, due to abuse of the service by threat actors, over a thousand malicious uploads introduce severe risks to unsuspecting users deploying malware-laden images on locally hosted or cloud-based containers.
Researchers at Sysdig looked into the issue, trying to evaluate the scale of the problem, and reported on the found images that feature some form of malicious code or mechanism.

Sysdig used its automated scanners to scrutinize 250,000 unverified Linux images and identified 1,652 of them as malicious.
Click to expand...

A worsening problem
Sysdig says that in 2022, 61% of all images pulled from Docker Hub come from public repositories, a 15% rise from 2021 stats, so the risk for users is on the rise.

Unfortunately, the size of the Docker Hub public library does not allow its operators to scrutinize all uploads daily; hence many malicious images go unreported.
Click to expand...

Sysdlg: Analysis on Docker Hub malicious images: Attacks through public container images

By Stefano Chierici - November 23, 2022
Containers have become a hugely popular attack vector in recent years. Since container images are designed to be portable, it is very easy for one developer to share a container with another individual.

There are multiple open source projects available providing the source code to deploy a container registry, or free access container registries for developers to share container images. Docker Hub is the most popular free and public-facing container registry.
Attackers understand these benefits and can create images that have malicious payloads built in.
Click to expand...

Typosquatting, Cryptominers, and Keys
The Sysdig Threat Research Team built a classifier to extract and collect information about recently updated images in Docker Hub to determine if those images contained anything anomalous or malicious within the image layers.
Click to expand...

guest · Feb 1, 2023

87 percent of container images have high risk vulnerabilities
By Ian Barker @IanDBarker - February 1, 2023

Due to the nature of modern software design and the sharing of open source images, security teams face a large number of container vulnerabilities according to a new report.
Click to expand...

The study from Sysdig, based on real-world data sets covering billions of containers, thousands of cloud accounts, and hundreds of thousands of applications, finds 87 percent of container images have high or critical vulnerabilities.
Click to expand...

On a slightly more positive note only 15 percent of critical and high vulnerabilities with an available fix are in packages loaded at runtime. This means that by focusing on those vulnerable packages that are actually in use, teams can target their efforts at a smaller fraction of the fixable vulnerabilities that represent true risk.

Data from the report also shows that 90 percent of permissions are unused. If attackers compromise credentials from identities with privileged access or excessive permissions, they have the keys to the kingdom in a cloud environment.

"Looking back at last year's report, container adoption continues to mature, which is evident by the decrease in container life spans. However, misconfigurations and vulnerabilities continue to plague cloud environments, and supply chains are amplifying how security problems manifest. Permissions management, for users and services alike, is another area I’d love to see people get stricter about," says Michael Isbitski, director of cybersecurity strategy at Sysdig.
Click to expand...

Sysdig 2023 Cloud-Native Security and Usage Report

Dig into this report to get real-world customer data and insights on cloud and container security and usage for environments. We looked at data from companies around the world, from a broad range of industries.
Based on data from billions of containers!
This year’s report has new data on cloud security, container vulnerabilities, and Kubernetes capacity planning.
Click to expand...

Log in or Sign up

Containers: The ultimate Trojan horse

guest Guest

guest Guest

guest Guest

Log in or Sign up

Containers: The ultimate Trojan horse

guest Guest

guest Guest

guest Guest

Useful Searches