Hacker News Reader

Comment by zackmorris | Hacker News Reader

I wish that someone would put up a honeypot website running various containers holding a root user, where the only goal is to break out of the container.

I suspect that nearly all containerization software is insecure. Especially with timing attacks like side-channel attacks (Row Hammer, etc):

https://en.wikipedia.org/wiki/Timing_attack

https://en.wikipedia.org/wiki/Side-channel_attack

In the end, the only way to "prove" container security is to be able to point to the fact that nobody has broken out of it yet. It's ..remarkable that our entire cloud infrastructure runs on containers that have never been audited by brute-force in this manner.

View on HN

Lots of people have tested these systems.

Here's work we did to exploit Firecracker. We had a known, promising vulnerability, and still failed to break out.

https://web.archive.org/web/20220927150915/https://www.grapl...

Exploitation is extremely hard. No one has ever exploited RowHammer in the wild, to my knowledge, and there are a lot of reasons why - but even still, RowHammer isn't magic, you can mitigate against it by increasing your refresh rate, or by limiting the attacker's execution time. Not to mention that vendors have deployed numerous methods of reducing the likelihood of an attack and it is quite complex to pull off these days.

I think transparent memory encryption effectively defeats RowHammer attacks.

The CPU has a key it uses to decrypt memory on access - and that key is never known by the operating system or any software running within it. If you use RowHammer to access the "wrong" memory location, the decrypted values would be random garbage.

Pure hardware protection, no changes to memory chips, almost no runtime performance cost, effective security.

AFAIK RowHammer is already a non issue on the latest hardware since the module will speculatively refresh rows that may be vulnerable. ie: If a ton of writes happen to row B then rows A and C will have a refresh triggered too.

> I suspect that nearly all containerization software is insecure.

This seems, well, naive?

You think there aren't a lot of people that have tried to break out of cloud containers?

Both EC2 and gcloud have had issues over the years with container breakout and leaks.

Complex (ie literally layers of operating systems) software has bugs. Yes. But so does the non-containerised base-case.

We have the best style of honeypots you could ever ask for already running- payment infrastructure on the internet. Go get 'em.

You mean like http://www.lambdashell.com/ ?

Apologies everyone, I've been a little too close to my work lately and jumping to conclusions. A normal person might have phrased this like:

Hey that's an interesting solution you have there, do you think that emulation might help guard against side-channel attacks? Do you have any plans to mitigate them? I wonder if anyone has gamified container security, maybe with a honeypot somewhere where people could try to break out.

Those are opensource, you can run them yourself, no need for a "honeypot" hosted by someone else.

And I have no idea why you think no one is trying to break them or audit them.

That honeypot was called VPS hosting and over ten years it didn't get hacked much if at all.

Quantum hack?

Nah, it’s 2023, brute it

Reply on news.ycombinator.com