Containers on fire: from container escapes to supply chain attacks
This Securelist article examines the evolving threat landscape targeting container environments, highlighting key attack vectors used by groups like TeamPCP. The analysis focuses on vulnerabilities, supply chain attacks (including image poisoning), and Kubernetes secrets theft, emphasizing the need for a comprehensive security approach across container infrastructure. The article details how attackers leverage vulnerabilities in host systems and container runtimes to achieve broader compromise, often targeting Kubernetes clusters and sensitive data.
The increasing adoption of containerization technologies like Docker and Kubernetes has created new attack surfaces for cybercriminals. Recent attacks, notably those orchestrated by the APT group TeamPCP, demonstrate a sophisticated and multi-stage approach to compromising container environments. These attacks often involve poisoning container images on platforms like Docker Hub, followed by the theft of Kubernetes secrets and the deployment of stealer malware during the KICS scanning process. The primary attack vectors include exploiting vulnerabilities in host systems and container runtimes, malicious activity within compromised containers, container escapes leading to host compromise, and misconfigurations within containerization and orchestration APIs. Attackers frequently aim to gain access to the entire Kubernetes cluster, secrets management systems, and other critical infrastructure components.
One prominent example is the exploitation of CVE-2019-5736, which affected the runC runtime environment, allowing attackers to execute arbitrary code on the host system with root privileges. Similarly, CVE-2022-0492, a Linux kernel vulnerability, enables container escape and arbitrary command execution. These vulnerabilities, combined with techniques like supply chain attacks and CI/CD pipeline compromises, create a complex and challenging environment for security teams to defend. A layered security approach encompassing configuration auditing, runtime protection, activity monitoring, and software supply chain security is crucial to mitigate these risks.