Tesseract : a proposal for a container breakout tool

Diplôme Master Tesseract : a proposal for a container breakout tool eng 2024-02-09 2024-02-09 author Pirkl Théo 0000-0003-0017-2171 937573 director Solana Eduardo 28093 Département d'informatique (DINFO) 95 Containers have tremendously simplified the job of Information Technology (IT) specialists. They offer a complete system abstraction, from hardware to networking. While containers offer powerful features, their thin isolation layer with the host renders misconfigurations dangerous, as they may leave the system or other containers vulnerable. As container use is on the up, so are attacks to break out of them. A category that is on the rise is automated attacks, which may allow an attacker to take over a system in a matter of seconds. We present a tool written in Rust to automate the exploration of containers from its environment to breakout attacks, showing what an attacker could automatically achieve, as well as mitigation advices to reduce the attack surface. Our tool is capable of compromising very popular containers, especially with third-party provided default configurations, and shows that breakouts could be achieved in seconds. We acknowledge that big organizations have assessed the risk of container breakouts and acted upon it, but notice no signs suggesting smaller organizations have followed through. We urge organizations to implement and enforce processes throughout the lifecycle of containers to reduce breakout risks, by implementing security measures at the very start of the container design. Dewey 025.063 32 Département d'informatique 18 false https://doi.org/10.13140/RG.2.2.29323.26405 951971eb-5641-4637-ab11-4d02e82158f4 Master thesis Restricted thesis.pdf 2366590 application/pdf 423182ca9e31bd487a3f5bf43a545a0a13ae5bff51f6f91b5d8fb15f1013feaa restrictedAccess Faculté des sciences / Département d'informatique

Title	Published in	Access level	OA Policy	Year	Views	Downloads

Tesseract : a proposal for a container breakout tool				2024	144	2

Archive ouverte UNIGE

Pirkl, Théo

account_balance Affiliation entities

Affiliation entities