Pensieve: Finding Malicious Artifacts in Container Environments
summary
Claims that per-container memory and resource artifacts can be captured without dumping host RAM using CRIU checkpointing, demonstrated by checkpointing a vulnerable Apache Struts container, decoding the produced image files with crit image analysis, and listing processes, open files and network sockets (two active connections, later a reverse shell on port 4444). The demo uses Docker layered filesystems (AUFS/overlay) and Metasploit exploit, maps AUFS IDs to container layers, and restores the container successfully to repeat the attack.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:42Pensieve
- 3:11What are containers
- 3:56Namespaces
- 4:56C Groups
- 5:50Layered File System
- 7:07Overlay File System
- 7:43Memory Layout
- 8:06Disk forensics
- 9:02Live analysis
- 10:04Container metadata
- 13:59Traditional tools
- 15:48Cryo Image Tool
- 16:20Demo
- 19:31Summary
related talks
47mSecuring Containers By Breaking In
35mContainers Attack and Defense
37mSecuring Containers by Breaking In
45mThe Container Escape Room: An Exploration of Container Escapes
40mSecuring Containers by Breaking in
39mInsecure Containers? Continuous Defense Against Open Source Exploits
41mIdentifying and Mitigating Cloud and Container Threats
52mSecuring Your Java Containers by Breaking In