4 ms·

I wish that someone would put up a honeypot website running various containers holding a root user, where the only goal is to break out of the container. I sus

I wish that someone would put up a honeypot website running various containers holding a root user, where the only goal is to break out of the container. I suspect that nearly all containerization software is insecure. Especially with timing attacks like side-channel attacks (Row Hammer, etc): https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Side-channel_attack https://en.wikipedia.org/wiki/Side-channel_attack In the end, the only way to "prove" container security is to be able to point to the fact that nobody has broken out of it yet. It's ..remarkable that our entire cloud infrastructure runs on containers that have never been audited by brute-force in this manner.

bozhark 3y ago
Quantum hack? Nah, it’s 2023, brute it
zsims 3y ago
You mean like http://www.lambdashell.com/ http://www.lambdashell.com/ ?
Quarrel 3y ago
> I suspect that nearly all containerization software is insecure. This seems, well, naive? You think there aren't a lot of people that have tried to break out of cloud containers? Both EC2 and gcloud have had issues over the years with container breakout and leaks. Complex (ie literally layers of operating systems) software has bugs. Yes. But so does the non-containerised base-case. We have the best style of honeypots you could ever ask for already running- payment infrastructure on the internet. Go get 'em.
wmf 3y ago
That honeypot was called VPS hosting and over ten years it didn't get hacked much if at all.
insanitybit 3y ago
Lots of people have tested these systems. Here's work we did to exploit Firecracker. We had a known, promising vulnerability, and still failed to break out. https://web.archive.org/web/20220927150915/https://www.graplsecurity.com/post/attacking-firecracker https://web.archive.org/web/20220927150915/https://www.grapl... Exploitation is extremely hard. No one has ever exploited RowHammer in the wild, to my knowledge, and there are a lot of reasons why - but even still, RowHammer isn't magic, you can mitigate against it by increasing your refresh rate, or by limiting the attacker's execution time. Not to mention that vendors have deployed numerous methods of reducing the likelihood of an attack and it is quite complex to pull off these days.
- Borealid 3y ago
  I think transparent memory encryption effectively defeats RowHammer attacks. The CPU has a key it uses to decrypt memory on access - and that key is never known by the operating system or any software running within it. If you use RowHammer to access the "wrong" memory location, the decrypted values would be random garbage. Pure hardware protection, no changes to memory chips, almost no runtime performance cost, effective security.
  - insanitybit 3y ago
    AFAIK RowHammer is already a non issue on the latest hardware since the module will speculatively refresh rows that may be vulnerable. ie: If a ton of writes happen to row B then rows A and C will have a refresh triggered too.
remram 3y ago
Those are opensource, you can run them yourself, no need for a "honeypot" hosted by someone else. And I have no idea why you think no one is trying to break them or audit them.
zackmorris 3y ago
Apologies everyone, I've been a little too close to my work lately and jumping to conclusions. A normal person might have phrased this like: Hey that's an interesting solution you have there, do you think that emulation might help guard against side-channel attacks? Do you have any plans to mitigate them? I wonder if anyone has gamified container security, maybe with a honeypot somewhere where people could try to break out.

bozhark 3y ago

Quantum hack? Nah, it’s 2023, brute it

zsims 3y ago

You mean like http://www.lambdashell.com/ http://www.lambdashell.com/ ?

Quarrel 3y ago

> I suspect that nearly all containerization software is insecure. This seems, well, naive? You think there aren't a lot of people that have tried to break out of cloud containers? Both EC2 and gcloud have had issues over the years with container breakout and leaks. Complex (ie literally layers of operating systems) software has bugs. Yes. But so does the non-containerised base-case. We have the best style of honeypots you could ever ask for already running- payment infrastructure on the internet. Go get 'em.

wmf 3y ago

That honeypot was called VPS hosting and over ten years it didn't get hacked much if at all.

insanitybit 3y ago

Lots of people have tested these systems. Here's work we did to exploit Firecracker. We had a known, promising vulnerability, and still failed to break out. https://web.archive.org/web/20220927150915/https://www.graplsecurity.com/post/attacking-firecracker https://web.archive.org/web/20220927150915/https://www.grapl... Exploitation is extremely hard. No one has ever exploited RowHammer in the wild, to my knowledge, and there are a lot of reasons why - but even still, RowHammer isn't magic, you can mitigate against it by increasing your refresh rate, or by limiting the attacker's execution time. Not to mention that vendors have deployed numerous methods of reducing the likelihood of an attack and it is quite complex to pull off these days.

Borealid 3y ago
I think transparent memory encryption effectively defeats RowHammer attacks. The CPU has a key it uses to decrypt memory on access - and that key is never known by the operating system or any software running within it. If you use RowHammer to access the "wrong" memory location, the decrypted values would be random garbage. Pure hardware protection, no changes to memory chips, almost no runtime performance cost, effective security.
- insanitybit 3y ago
  AFAIK RowHammer is already a non issue on the latest hardware since the module will speculatively refresh rows that may be vulnerable. ie: If a ton of writes happen to row B then rows A and C will have a refresh triggered too.

remram 3y ago

Those are opensource, you can run them yourself, no need for a "honeypot" hosted by someone else. And I have no idea why you think no one is trying to break them or audit them.

zackmorris 3y ago

Apologies everyone, I've been a little too close to my work lately and jumping to conclusions. A normal person might have phrased this like: Hey that's an interesting solution you have there, do you think that emulation might help guard against side-channel attacks? Do you have any plans to mitigate them? I wonder if anyone has gamified container security, maybe with a honeypot somewhere where people could try to break out.