Where Are All of the Container Breaches?
summary
Sysdig’s honeypots show few noisy in-cluster exploits but active scans find thousands of images with crypto miners and other malware hidden in public and private registries; incidents include Tesla, WeightWatchers and Codecov supply-chain failures. Attacks move fast (miners spin up, run, and vanish), enable lateral escalation like SCARLETEEL lateral escapes to hosts and other accounts, and target free-tier CI/CD runners in campaigns dubbed PURPLEURCHIN free-jacking, so supply-chain and runtime visibility matter.
AI-written summary · about
chapters (18)
- 0:00RSAConference 2023
- 2:14What are containers?
- 3:23Container Popularity
- 4:00Where are the breaches?
- 4:40How do containers work?
- 5:50How are they used?
- 6:53Example Architecture
- 8:14Increased Attack Surface
- 9:07New Security Tools
- 10:28Detection is Hard
- 11:36Steep Learning Curve
- 12:18Past Container Incidents
- 14:39Cybercrime Evolution
- 17:56Container attacks are underestimated
- 20:01Supply Chain Attacks
- 22:03Container RCE Attack
- 24:40Apply
- 26:57Summary
related talks
32mContainer Security: Exploits, Vulnerabilities and Defense
44mContainers Everywhere: Advanced Threat Actors Heavily Leverage Them
11mLets secure our Kubernetes cluster
41mIdentifying and Mitigating Cloud and Container Threats
47mSecuring Containers By Breaking In
31mPrepare to Be Boarded! A Tale of Kubernetes, Plunder, and Cryptobooty
37mSecuring Containers by Breaking In
29mFrom Illuminating to Eliminating Crypto Jacking Techniques in Cloud Native