Pentesting Cloud Sandboxes in the wild

Recordings

https://www.youtube.com/watch?v=4g0Q3YJ7JY4

View Recording

Slides

/files/slides/01-01_Pentesting_Cloud_Sandboxes_in_the_wild.pdf

View Slides

Abstract

Building on last year’s explanation of container workings under the hood (F***ing Containers - how do they work?), we explain several techniques for breaking out of misconfigured containers/container hosts. We will discuss the most common misconfigurations (such as extensive container privileges, exposed network services, mounted sockets, internal cluster privileges) and how to test for them. For each discussed attack vector, we will show how it can be automated (and integrated into build pipelines) using a tool of choice. Finally, a comparison of the well known container execution platforms (AWS, Azure, fly.io, GCP, Heroku) will be presented.

Outline

  • Short Container Re-Cap (make sure to be familiar with F***ing Containers - how do they work?)
  • Attack Vectors
    • Container Privileges
    • Network Services (Generic, Cloud, Cluster)
    • Cluster Privileges
    • Sockets
  • Cloud Platform comparison
  • Testing how-to with botb and amicontained
  • Mitigations
  • Conclusions

Matthias Luft

@uchi_mata

Matthias Luft is a Principal Platform Security Engineer at Salesforce Heroku. After more than 10 years in IT Security, he is still excited about a broad range of topics (from hypervisor security to IT security management) and has presented on them on various occasions. Currently he works on container and cloud security topics.

 

Jan Harrie

@NodyTweet

Jan Harrie is freelancing as a Security Consultant. Currently, he spends the majority of his research time on containers and their run-time environments. If he is not digging into containers, the daily business consists of securing container environments, security risk assessments, and conceptional topics. In the past he worked as penetration tester, consultant and spend a while in academia.