Malware? In my Docker container? It's more common than you think

Researchers say software prisons can hide nasty attack payloads

Black Hat Docker containers are the perfect disguise for malware infections, warn researchers.

Speaking at the 2017 Black Hat USA conference in Las Vegas, Aqua Security researchers Michael Cherny and Sagie Dulce said [PDF] the Docker API can be abused for remote code execution and security bypass.

Popular with developers as a way to test code, Docker allows for an entire IT stack (OS, firmware, and applications) to be run within an enclosed environment called a container. While the structure has great appeal for trying out code, it could also be abused by attackers to get malware infections running within a company.

By targeting the developers for invasion, the researchers explain, attackers could not only get their malware code running in the company network, but could do so with heightened privileges.

The attack involves duping the victim into opening a webpage controlled by the attacker, then using a REST API call to execute the Docker Build command to create a container that will execute arbitrary code. Through a technique called Host Rebinding, the attacker can bypass Same-Origin Policy protections and gain root access to the underlying Moby Linux VM.

An attacker could thus steal the credentials of the developer, get malware running on the developer's machine, or inject malware into the container image itself, allowing the infection to be spread every time the container is launched.

"After the attack is complete, the attacker will have gained persistent code with full access to the victim's network," the authors write. "That code runs within the Moby Linux VM, making it very difficult to detect."

Opening the door

What makes the attack worse is the high level of system access routinely granted to containers and developer accounts. When Docker is run locally on the developer's PC, they become vulnerable to attacks such as cross-site forgery exploits that could then exploit flaws, such as the handling of TCP requests.

"The thing is that every developer who installs Docker for Windows practically runs Docker directly on his local machine," point out the researchers. "The reason is that even if Docker daemon and containers are run within VM, the Docker client communicates with on-host daemon."

The Aqua Security duo says they have already reported one of the attack vectors – the vulnerable TCP component – to Docker, which has issued an update to remedy the flaw.

Still, Cherny and Dulce say that other flaws in Docker could be exploited to not only infect the container, but the host machines and other VMs running on the system as well.

"It is important to scan images to remove malicious code or vulnerabilities that may be exploited. Additionally, runtime protection ensures that your containers 'behave' and don't perform any malicious actions." ®