Stranger Danger: Securing Your Java Containers by Breaking In
summary
Docker images often carry full OS packages and old libraries so a Java container can expose real attack paths: a Debian-shipped ImageMagick allows an image magic RCE by crafting an image URL, Tomcat 8.5.21 in one demo accepts uploads to install a JSP web shell, and a maven+JDK build left in the image lets attackers recompile code if containers run as root. Snyk-style scanning finds one billion weekly-download ecosystems, shows Tomcat 8.5.21 has ~714 vulns (65 critical) vs 8.5.75 with ~116 (11 critical), and rebuilding/update policies fix a large share. Use multi-stage builds, run as non-root, and daily image scanning.
AI-written summary · about
chapters (7)
- 0:00Start
- 5:35Choose the Right Docker Base Image for Your Java Application
- 17:13Least Privileged Principle
- 21:38Monitoring
- 24:03What Can Possibly Go Wrong with a Vulnerability in an App
- 28:39Zip Files
- 31:47Docker File
related talks
52mSecuring Your Java Containers by Breaking In
40mSecuring Containers by Breaking in
47mSecuring Containers By Breaking In
50mStranger Danger: Your Java Attack Surface Just Got Bigger
26mStranger Danger: Your Attack Surface Just Got Bigger
35mSecuring Containers by Breaking In
32mTutorial: Yes, Your Applications are Under Attack - Struts2 Vulnerability Workshop
37mSecuring Containers by Breaking In