Mutual authentication with TLS can also be configured to secure the communication between the client and the remote daemon. The default TCP socket provides unencrypted and unauthenticated access to the Docker daemon. If a client needs to access a Docker daemon remotely, Docker daemon can open a TCP socket and listens on port 2375 for REST API requests. A Docker daemon can also communicate with other Docker daemons if multiple hosts are managed as a service or a cluster.īy default, Docker daemon creates a non-networked Unix domain socket at /var/run/docker.sock and only processes with root permission or Docker group membership can access it. Applications or users typically use Docker clients to authenticate and interact with Docker daemons.
#KITEMATIC CONTEXT CANCELED LOG LOCATION SERIES#
Docker daemon listens for REST API requests and performs a series of container operations accordingly. It is a self-sufficient runtime that manages Docker objects such as images, containers, network, and storage. Four categories of the observed malicious activities Docker Daemonĭocker daemon is a persistent background process that manages the containers on a single host.
Malicious payloads are then downloaded and executed inside the benign containers.Īdversaries mount the entire host file system to a container and access the host file system from the container.
#KITEMATIC CONTEXT CANCELED LOG LOCATION DOWNLOAD#
Deploy Benign Container Images and Download Malicious Payloads at Run Time.īenign images are deployed on the Docker hosts.
The images are then pulled and deployed on the unsecured Docker hosts. Malicious images are first pushed to a public registry.
One interesting tactic we frequently saw was attackers mounted the entire host file system to a container and accessed the host operating system (OS) from the container to read/write from it. Sensitive information, such as application credentials and infrastructure configuration were also found from the exposed logs. While the majority of the malicious activities involved cryptojacking (mostly mining for Monero), some compromised Docker engines were used for launching other attacks or installing rootkits on the hosts. While the technology is quickly evolving and being adopted, it also becomes a valuable target for adversaries. The Docker team worked quickly in tandem with Unit 42 to remove the malicious images once our team alerted them to this operation.Ĭontainer technology has gained enormous popularity in the past few years and is becoming the de facto way for packaging, delivering, and deploying modern applications. In total, 1,400 unsecured Docker hosts, 8,673 active containers, and 17,927 Docker images were discovered in our research. Between September and December 2019, Unit 42 researchers periodically scanned and collected metadata from Docker hosts exposed to the internet (largely due to inadvertent user errors) and this research reveals some of the tactics and techniques used by attackers in the compromised Docker engines.
0 kommentar(er)
