An Attacker Looks at Docker: Approaching Multi-Container Applications

Presented at DEF CON 26 (2018), Aug. 10, 2018, 11 a.m. (45 minutes).

Containerization, such as that provided by Docker, is becoming very popular among developers of large-scale applications. The good news: this is likely to make your life easier as an attacker.

While exploitation and manipulation of traditional monolithic applications might require specialized experience and training in the target languages and execution environment, applications made up of services distributed among multiple containers can be effectively explored and exploited "from within" using many of the system- and network-level techniques that attackers, such as penetration testers, already know.

The goal of this talk is to provide a hacker experienced in exploitation and post-exploitation of networks and systems with an exposure to containerization and the implications it has on offensive operations. Docker is used as a concrete example for the case study. A hacker can expect to leave this presentation with a practical exposure to multi-container application post-exploitation.

Presenters:

• Wesley McGrew - Director of Cyber Operations, HORNE Cyber
  Wesley currently oversees and participates in offense-oriented operations as Director of Cyber Operations for HORNE Cyber. He has presented on topics of penetration testing and and malware analysis at DEF CON and Black Hat USA. He teaches a self-designed course on reverse engineering to students at Mississippi State University, using real-world, high-profile malware samples. Wesley has a Ph.D. in Computer Science from Mississippi State University for his research in vulnerability analysis of SCADA HMI systens.

Links:

• https://defcon.org/html/defcon-26/dc-26-speakers.html#McGrew
• https://infocon.org/cons/DEF CON/DEF CON 26/DEF CON 26 video and slides/DEF CON 26 - Wesley McGrew - An Attacker Looks at Docker Approaching Multi-Container Applications.mp4
• https://infocon.org/cons/DEF CON/DEF CON 26/DEF CON 26 video and slides/DEF CON 26 - Wesley McGrew - An Attacker Looks at Docker Approaching Multi-Container Applications.srt (subtitles)
• https://www.youtube.com/watch?v=-Ug2vmRiI8g

Similar Presentations:

• AppSec USA 2016 / Breaking and Fixing your ‘Docker’ ized environments
• Black Hat USA 2018 / An Attacker Looks at Docker: Approaching Multi-Container Applications
• Black Hat Europe 2015 / Vulnerability Exploitation in Docker Container Environments