Container Attack Surface Reduction Beyond Name Space Isolation
summary
Analyzes hundreds of Docker images with Clair scanner and finds thousands of vulnerabilities living in dependencies and unused binaries, then implements a user‑space profiler that records file/network calls to build reduced images (WordPress drops from 407 MB to 89.1 MB — about 80% size reduction) and removes many CVE hits (180+ → flagged zero due to missing packages). Also builds a Windows API specialization tool using IDA and Detours, tests 251 shellcodes and 30 ROP payloads against 10 real apps and shows substantial mitigation of ROP attacks.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:47Introduction
- 9:28Attack Surface Reduction: Approach
- 23:44Preliminary Results
- 28:46Mandatory Access Control (MAC) policy enforcement
- 47:26Conclusion
- 49:18Questions
related talks
33mMalicious Compliance Automated: Building Secure Containers and Obfusca...
41mIdentifying and Mitigating Cloud and Container Threats
35mSecuring Containers by Breaking In- 41mIdentifying and Mitigating Cloud and Container Threats
34mWhat We Learned Dissecting the World's Most Popular Containers
47mSecuring Containers By Breaking In
49mVulnerability Exploitation In Docker Container Environments
39mInsecure Containers? Continuous Defense Against Open Source Exploits