Communication Dans Un Congrès Année : 2023

Reflections on Trusting Docker: Invisible Malware in Continuous Integration Systems

Résumé

Revisiting the famous compiler backdoor from Ken Thompson, we show that a container-based Continuous Integration system can be compromised without leaving any trace in the source code. Detecting such malware is challenging or even impossible with common practices such as peer review or static code analysis. We detail multiple ways to do the initial infection process such as malicious commit or dependencies confusion. Finally, we show that the malicious code is able to backdoor production images and to reinject itself on CI system updates to allow long-term compromise.

Fichier non déposé

Dates et versions

hal-05239752 , version 1 (04-09-2025)

Identifiants

  • HAL Id : hal-05239752 , version 1

Citer

Florent Moriconi, Axel Neergaard, Lucas Georget, Aubertin Samuel, Francillon Aurélien. Reflections on Trusting Docker: Invisible Malware in Continuous Integration Systems. Toulouse Hacking Convention (THCon 23), Apr 2023, Toulouse, France. ⟨hal-05239752⟩
80 Consultations
0 Téléchargements

Partager

  • More