Master
English

Tesseract : a proposal for a container breakout tool

ContributorsPirkl, Théoorcid
Number of pages95
Handover date2024-02-09
Defense date2024-02-09
Abstract

Containers have tremendously simplified the job of Information Technology (IT) specialists. They offer a complete system abstraction, from hardware to networking. While containers offer powerful features, their thin isolation layer with the host renders misconfigurations dangerous, as they may leave the system or other containers vulnerable. As container use is on the up, so are attacks to break out of them. A category that is on the rise is automated attacks, which may allow an attacker to take over a system in a matter of seconds. We present a tool written in Rust to automate the exploration of containers from its environment to breakout attacks, showing what an attacker could automatically achieve, as well as mitigation advices to reduce the attack surface. Our tool is capable of compromising very popular containers, especially with third-party provided default configurations, and shows that breakouts could be achieved in seconds. We acknowledge that big organizations have assessed the risk of container breakouts and acted upon it, but notice no signs suggesting smaller organizations have followed through. We urge organizations to implement and enforce processes throughout the lifecycle of containers to reduce breakout risks, by implementing security measures at the very start of the container design.

Citation (ISO format)
PIRKL, Théo. Tesseract : a proposal for a container breakout tool. Master, 2024.
Main files (1)
Master thesis
accessLevelRestricted
Identifiers
  • PID : unige:175106
100views
2downloads

Technical informations

Creation21/02/2024 15:25:47
First validation26/02/2024 11:30:56
Update time19/06/2024 15:52:22
Status update19/06/2024 15:52:22
Last indexation01/11/2024 09:37:59
All rights reserved by Archive ouverte UNIGE and the University of GenevaunigeBlack