How Container Escape Vulnerabilities Cause Massive Data Breaches

[johny899]

I wonder if you, like me, have looked at your containers to later think, "They’re safe. Nothing can escape from here." I used to think the same; until I learned how a small issue with a container can lead to a major data breach. So let’s discuss this in simple, friendly language.

Why Container Escapes Are Bad​

I picture containers like a lunch box that has everything held inside. But what happens if someone taps the bottom? That's a container escape. Trace and exploit some kind of escape in the container to get out to the host.

Once they are on the host they can access:

• Source files
• Databases
• Internal networks
• Cloud accounts

One escape can be the start of a big story.

How Hackers Escape from Containers​

Hackers often rely on a few common techniques:

Weak Isolation

Some container systems don't isolate the container from the host well. When that isolation fails, the hacker can fully compromise the host.

Kernel Bugs

A bug in the kernel can allow attackers to run malicious commands as root user. I spent one whole night fixing a bug in the kernel because I was concerned that it would allow someone to break the entire system.

Privileged Containers

If you ever started a container with --privileged just so it would "work," you just opened the door to let an attacker have access to the system.

The bottom line: One misconfigured setting + one bug = the attacker owns everything.

How Escapes Result in Large Data Breaches​

Because when an attacker has access to the host, they can:

• Move to other hosts
• Steal database backups
• Copy secret keys
• Install malware inside of your container images

Preventing Container Escapes​

These are simple steps that I follow:

• Use rootless containers
• Perform kernel updates for your operating system
• Update your container runtime
• Scan images for vulnerabilities
• Don't run containers in privileged mode
• Use security tools integrated with the container system like AppArmor, SELinux, and seccomp

Running containers without root may feel odd at first, but they are much more secure