Insecure Containers? Continuous Defense Against Open Source Exploits
summary
Walks through concrete exploits—Heartbleed (25–50% of major sites), DROWN (~33% of sites), Shellshock and Dirty COW—and shows which are protocol flaws versus implementation bugs. Demonstrates a working Dirty COW container breakout (kernel exploit inside a container successfully escapes) and then repeats it with AppArmor denied ptrace, which crashes the exploit. Covers tools that found flaws (AFL, AddressSanitizer, fuzzing), pipeline defenses (Clair, Docker scan, TruffleHog), kernel mitigations (namespaces, seccomp, capabilities) and when containers only speed redeploys.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:34Open Source Exploits
- 0:47Insecure Containers?
- 1:38What this talk is about
- 4:02Heartbleed (2014)
- 7:58Shellshock (2014)
- 9:49Shellshock CVES
- 12:52Dirty COW (2016)
- 21:30Recap
- 23:41Reducing Vulnerabilities
- 24:09Container Security: Bad
- 25:35Docker Security Features
- 27:54Extended security features
- 34:14Autogenerated sec profiles • Generators and helpers
- 35:13Leaky-secrets Prevention
- 35:37Docker container scanning
- 36:29Host Analysis
- 36:43App-dependency analysis
- 37:09Web Application Scanners
- 37:39Intrusion detection
- 38:24Dangers of shiny things
- 38:47Prepare for the Unexpected
related talks
47mSecuring Containers By Breaking In
45mThe Container Escape Room: An Exploration of Container Escapes
41mIdentifying and Mitigating Cloud and Container Threats
57mBreaking and Fixing your ‘Docker’ ized environments
40mSecuring Containers by Breaking in
37mSecuring Containers by Breaking In
57mWhat vulnerabilities? Live hacking of containers and orchestrators
34mBeating the pentester