Reflections on Trusting Docker: Invisible Malware in Continuous Integration Systems - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2023

Reflections on Trusting Docker: Invisible Malware in Continuous Integration Systems

Résumé

Continuous integration (CI) is a widely adopted methodology for supporting software development. It provides automated generation of artifacts (e.g., binaries, container images) which are then deployed in production. However, to which extent should you trust the generated artifacts even if the source code is clean of malicious code? Revisiting the famous compiler backdoor from Ken Thompson, we show that a container-based CI system can be compromised without leaving any trace in the source code. Therefore, detecting such malware is challenging or even impossible with common practices such as peer review or static code analysis. We detail multiple ways to do the initial infection process. Then, we show how to persist during CI system updates, allowing long-term compromise. We detail possible malicious attack payloads such as sensitive data extraction or backdooring production software. We show that infected CI systems can be remotely controlled using covert channels to update attack payload or adapt malware to mitigation strategies. Finally, we propose a proof of concept implementation tested on GitLab CI and applicable to major CI providers.
Fichier principal
Vignette du fichier
Reflections on Trusting Docker - Invisible Malware in Continuous Integration Systems.pdf (369.37 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04087018 , version 1 (02-05-2023)

Identifiants

Citer

Florent Moriconi, Axel Ilmari Neergaard, Lucas Georget, Samuel Aubertin, Aurélien Francillon. Reflections on Trusting Docker: Invisible Malware in Continuous Integration Systems. 17th IEEE Workshop on Offensive Technologies (WOOT 2023), IEEE, May 2023, San Francisco (CA, USA), United States. ⟨10.1109/SPW59333.2023.00025⟩. ⟨hal-04087018⟩
57 Consultations
130 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More