1. Real World Security: Software Supply Chain
David Lawrence Docker
Daniel Shapira Twistlock

2. Agenda What is: a supply chain? the threat model?
the real world problem?
Best Practices

3. What is a “Software Supply Chain”?

4.
R&D

6. Continuous Integration

7. Distribution

8. Deployment

9. The Complete Supply Chain

10. Why do we care about Software Supply Chain Security?

11. Attacks on the Software Supply Chain
2011
WinNTi
2015
League of Legends infected with PlugX
Juniper Networks finds unauthorized code in their products
2016
Transmission infected with KeRanger
Transmission infected again with OSX/Keydnap
2017
Kingslayer
Operation WilySupply
Handbrake contains Proton RAT
PetyaWrap
ShadowPad
CCleaner contains trojan

12. Software Supply Chain Threat Model

13. Entrypoints Upstream code Stackoverflow ??? Build-time dependencies
Base Images
API
API
Docker

14. Assets Proprietary code/data Service secrets Images User data Secrets
Compute

15. Data Flow <Developer> <CI> <Registry>
<Servers>

16. Which component is the #1 concern today?

17. Attacks on the Software Supply Chain
2011
WinNTi
2015
League of Legends infected with PlugX
Juniper Networks finds unauthorized code in their products
2016
Transmission infected with KeRanger
Transmission infected again with OSX/Keydnap
2017
Kingslayer
Operation WilySupply
Handbrake contains Proton RAT
PetyaWrap
ShadowPad
CCleaner contains trojan

18. Targets Developers Distribution Center
Juniper Networks finds unauthorized code in their products
Distribution Center
WinNTi
League of Legends infected with PlugX
Transmission infected with KeRanger
Transmission infected again with OSX/Keydnap
Kingslayer
Operation WilySupply
Handbrake contains Proton RAT
PetyaWrap
ShadowPad
CCleaner contains trojan

19. Data Flow <Developer> <CI> <Registry>
<Servers>

20. Real World Research Findings

21. Memories from the past MongoDB 18,000 instances hacked
7 years to patch

22. Memories from the past MongoDB Redis ??? Instances hacked
3 years to patch

23. Memories from the past MongoDB Redis Mirai Botnet
390,000 routers hacked
Time to path

24. Weak Defaults!

25. Research Motivation Most people didn’t change default settings
Popularity and adoption rate is huge
Easily execute apps (e.g. docker run registry)

26. Research Motivation
Trojanizing docker images – Daniel Garcia & Roberto Munoz @RootedCon
How can it be utilized?
What else can be gained?

27. The Possibilities Downloading all of your hosted docker images
Uploading malicious images
Modifying existing images
Uploading arbitrary files

28. OSS Registry Defaults?
No auth.

29. Research Methodology Identify how docker services are responding
Docker-Distribution-Api-Version:

30. Research Methodology Identify how docker services are responding
Use Shodan.io
Utilize registry API to confirm auth status:
Profit
Docker-Distribution-Api-Version:
HTTP GET request to /v2/: if HTTP status == 200: print “R/W access”

31. Research Methodology Identify how docker services are responding
Use Shodan.io
Utilize registry API to confirm auth status:
Profit
More profit: scan with zmap for common registry ports, repeat the API procedures on the results
Docker-Distribution-Api-Version:
HTTP GET request to /v2/: if HTTP status == 200: print “R/W access”

32. Research Findings Over 1000 exposed registries found
R/W access to 60% of the found registries
Read access to a further 30%
Only 10% securely configured
45% of those found owned by big companies
we didn’t even scan the whole internet!

33. HazAuth – a tool to aid
HazAuth is a tool that was developed in order to find authentication problems in a containerized environments (and more)
Modular Pluggable design
Written in Python
Can be deployed as a container
Will come with 3 plugins: mongoDB, Redis, and Docker Registry

34. HazAuth – a tool to aid

35. Changing the defaults Official Registry Image:
HTTP Basic Auth by default
OSS Registry Code:
Auto-generate htpasswd file with strong random password

36. Further Best Practices

37. TLS

38. Docker Content Trust

39. Docker Security Scanning

40. Thank you!
Questions?

41. New Docker Registry defaults2
Automatically generate a password, create an htpasswd file, and echo to stdout
By default Registry isn’t anonymously accessible, but you can easily override this if desired

42. Demo: New Docker Registry defaults
Default experience:
docker run -d registry
‘Legacy’ experience:

43. Traditional Package Signing TUF
Arbitrary Installation
Endless Data
Extraneous Dependencies
Fast Forward
Indefinite Freeze
Malicious Mirror
Mix-and-Match
Rollback
Slow Retrieval
Key Compromise
Wrong Installation