Enhancing Software Composition Analysis Resilience Against Container Image Obfuscation
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 11:45· Level 1 | Hall Entrance S10 | Room D·
summary
Empirical analysis of eight scanners including Trivy Syft Grype Snyk and major cloud services shows that every tested scanner fails at least one obfuscation technique and that >10% OS obfuscation and ~20% images download software from the internet in real registries. A reproducible layer-by-layer analysis reconstructs file history, recovers package metadata and increases SBOM coverage; an open-source tool Orca produces more accurate SBOMs but multi-stage compressed images still lose retrievable data and remain hard to fully scan.
AI-written summary · about
chapters (12)
- 0:00Container image obfuscation intro
- 1:07Why obfuscation matters
- 2:12How scanners work
- 7:31Defining obfuscation
- 8:57Research objectives and assumptions
- 10:01Obfuscation techniques
- 12:56Testing tools vs obfuscation
- 16:54Detecting obfuscation
- 21:33Obfuscation attack example
- 23:19Mitigating with Orca
- 25:28Key takeaways
- 26:32Q&A
related talks
33mMalicious Compliance Automated: Building Secure Containers and Obfusca...
16mUnpacking Open Source Security in Public Repos
47mJavaScript Obfuscation: It’s All About the P a c k e r s
46mSCA for Containers: The Good, the Bad, and the Truth
50mContainer Attack Surface Reduction Beyond Name Space Isolation
34mUnpacking Open Source Security in Public Repos & Registries
40mSoftware Composition Analysis with Free Tools
43mA radiography of a SBOM vulnerability scanner