Real World Security: Software Supply Chain David Lawrence Docker Daniel Shapira Twistlock

Agenda What is: a supply chain? the threat model? the real world problem? Best Practices

What is a “Software Supply Chain”?

https://cooking.stackexchange.com R&D

Continuous Integration

Distribution

Deployment

The Complete Supply Chain

Why do we care about Software Supply Chain Security?

Attacks on the Software Supply Chain 2011 WinNTi 2015 League of Legends infected with PlugX Juniper Networks finds unauthorized code in their products 2016 Transmission infected with KeRanger Transmission infected again with OSX/Keydnap 2017 Kingslayer Operation WilySupply Handbrake contains Proton RAT PetyaWrap ShadowPad CCleaner contains trojan

Software Supply Chain Threat Model

Entrypoints Upstream code Stackoverflow ??? Build-time dependencies Base Images API API Docker

Assets Proprietary code/data Service secrets Images User data Secrets Compute

Data Flow <Developer> <CI> <Registry> <Servers>

Which component is the #1 concern today?

Attacks on the Software Supply Chain 2011 WinNTi 2015 League of Legends infected with PlugX Juniper Networks finds unauthorized code in their products 2016 Transmission infected with KeRanger Transmission infected again with OSX/Keydnap 2017 Kingslayer Operation WilySupply Handbrake contains Proton RAT PetyaWrap ShadowPad CCleaner contains trojan

Targets Developers Distribution Center Juniper Networks finds unauthorized code in their products Distribution Center WinNTi League of Legends infected with PlugX Transmission infected with KeRanger Transmission infected again with OSX/Keydnap Kingslayer Operation WilySupply Handbrake contains Proton RAT PetyaWrap ShadowPad CCleaner contains trojan

Data Flow <Developer> <CI> <Registry> <Servers>

Real World Research Findings

Memories from the past MongoDB 18,000 instances hacked 7 years to patch

Memories from the past MongoDB Redis ??? Instances hacked 3 years to patch

Memories from the past MongoDB Redis Mirai Botnet 390,000 routers hacked Time to path

Weak Defaults!

Research Motivation Most people didn’t change default settings Popularity and adoption rate is huge Easily execute apps (e.g. docker run registry)

Research Motivation Trojanizing docker images – Daniel Garcia & Roberto Munoz @RootedCon How can it be utilized? What else can be gained?

The Possibilities Downloading all of your hosted docker images Uploading malicious images Modifying existing images Uploading arbitrary files

OSS Registry Defaults? No auth.

Research Methodology Identify how docker services are responding Docker-Distribution-Api-Version:

Research Methodology Identify how docker services are responding Use Shodan.io Utilize registry API to confirm auth status: Profit Docker-Distribution-Api-Version: HTTP GET request to /v2/: if HTTP status == 200: print “R/W access”

Research Methodology Identify how docker services are responding Use Shodan.io Utilize registry API to confirm auth status: Profit More profit: scan with zmap for common registry ports, repeat the API procedures on the results Docker-Distribution-Api-Version: HTTP GET request to /v2/: if HTTP status == 200: print “R/W access”

Research Findings Over 1000 exposed registries found R/W access to 60% of the found registries Read access to a further 30% Only 10% securely configured 45% of those found owned by big companies we didn’t even scan the whole internet!

HazAuth – a tool to aid HazAuth is a tool that was developed in order to find authentication problems in a containerized environments (and more) Modular Pluggable design Written in Python Can be deployed as a container Will come with 3 plugins: mongoDB, Redis, and Docker Registry

HazAuth – a tool to aid

Changing the defaults Official Registry Image: HTTP Basic Auth by default OSS Registry Code: Auto-generate htpasswd file with strong random password

Further Best Practices

TLS

Docker Content Trust

Docker Security Scanning

Thank you! Questions?

New Docker Registry defaults https://github.com/docker/distribution/pull/236 2 Automatically generate a password, create an htpasswd file, and echo to stdout By default Registry isn’t anonymously accessible, but you can easily override this if desired

Demo: New Docker Registry defaults Default experience: docker run -d registry ‘Legacy’ experience:

Traditional Package Signing TUF Arbitrary Installation Endless Data Extraneous Dependencies Fast Forward Indefinite Freeze Malicious Mirror Mix-and-Match Rollback Slow Retrieval Key Compromise Wrong Installation