LAS VEGAS—As Docker container use grows, so too is scrutiny into container security. In a session on July 27 at the Black Hat USA conference here, researchers from Aqua Security detailed vulnerabilities they found in Docker that could have put developers at risk.
The vulnerabilities discovered by Aqua Security have already been responsibly disclosed to Docker and were fixed in the Docker 17.05 update released at the end of May. The flaws specifically take aim at Docker for Mac and Docker for Windows desktop releases for developers and could have enabled an attacker to infect a system.
In an interview with eWEEK to discuss the findings, Sagie Dulce, senior security researcher at Aqua Security, explained that with Docker for Windows, the default configuration enabled anonymous access to the Docker API through an open TCP port. As it turns out, that TCP port could be abused by an attacker through a malicious webpage to attack a developer.
To see how far the vulnerability could be abused, the Aqua Security researchers were able to demonstrate how they could get a “shadow container”—that is, a malicious, unauthorized container—running on a target developer system to retain a persistent connection.
To resolve the flaw, Dulce said all Docker has done in the 17.05 update is make the TCP port an opt-in option. Architecturally, Docker still works the same, though there might be some impact on tools that were relying on the open TCP port, he said.
“You could still open the TCP port, but it’s not the default option,” Dulce said.
As far as Dulce is aware, there were no attacks in the wild against the vulnerability. Aqua Security is in the business of detecting runtime threats against containers. The vulnerability detailed at Black Hat is specific to developer environments and is not how Docker is typically used in server or cloud deployments.
“The risk is if someone hacks a developer and then infects the developer’s images, [Aqua] would detect that either through static scanning or during runtime analysis, when we see something strange going on,” he said.
One issue that Dulce has with the flaw and its fix is that developers will still likely open up their TCP ports on Docker to use tools. He also has some broader architectural concerns about the risks posed to developers, if they aren’t careful.
“If you attack a developer you can get access to the Docker daemon, and from there it’s easy to get complete control of the machine, whether it’s Windows, Mac or Linux,” Dulce said. “Once Docker is exposed, an attacker can pretty much take over a machine.”
Looking forward, Dulce said Aqua Security is looking at other areas of container security, including application images, orchestration technologies and the whole pipeline of running and managing containers to see if other risks can be identified.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.