TY - GEN
T1 - Still Not Aware of the Loophole of Unintentional Access to Docker? A Proof of Concept
AU - Li, Luyi
AU - Li, Yueyang
AU - Luo, Ruxue
AU - Chen, Yuzhen
AU - Fan, Wenjun
N1 - Funding Information:
ACKNOWLEDGMENT This work was supported in part by XJTLU Research Development Funding RDF-21-02-012 and XJTLU Teaching Development Funding TDF21/22-R24-177. This work was also partially supported by the XJTLU AI University Research Centre and Jiangsu Province Engineering Research Centre of Data Science and Cognitive Computation at XJTLU.
Publisher Copyright:
© 2023 IEEE.
PY - 2023
Y1 - 2023
N2 - Due to the ease of management and the high performance of the containerization, many services have been deployed on container, e.g., Web server running in Docker. However, the Docker implementation suffers several fatal loopholes. In this paper, we study a persistent security problem of Docker, i.e., the port mapping statement results in a wrong IPTABLES rule, which has been disclosed for a while but is still not solved. Therefore, we are motivated to provide a technical primer as well as a proof of concept for this issue. Nevertheless, we discuss several methods to mitigate the security problem. Further, we apply our network testbed for demonstrating the loophole and the effectiveness of the defense methods. The experimental results show that our approach not only increase the time cost for the attacker to identify the target but also bring negligible overhead for deploying the countermeasures.
AB - Due to the ease of management and the high performance of the containerization, many services have been deployed on container, e.g., Web server running in Docker. However, the Docker implementation suffers several fatal loopholes. In this paper, we study a persistent security problem of Docker, i.e., the port mapping statement results in a wrong IPTABLES rule, which has been disclosed for a while but is still not solved. Therefore, we are motivated to provide a technical primer as well as a proof of concept for this issue. Nevertheless, we discuss several methods to mitigate the security problem. Further, we apply our network testbed for demonstrating the loophole and the effectiveness of the defense methods. The experimental results show that our approach not only increase the time cost for the attacker to identify the target but also bring negligible overhead for deploying the countermeasures.
KW - Container
KW - Docker
KW - IPTABLES
KW - Port Mapping
KW - Unintentional Access
UR - http://www.scopus.com/inward/record.url?scp=85171991835&partnerID=8YFLogxK
U2 - 10.1109/ISCC58397.2023.10218166
DO - 10.1109/ISCC58397.2023.10218166
M3 - Conference Proceeding
AN - SCOPUS:85171991835
T3 - Proceedings - IEEE Symposium on Computers and Communications
SP - 1331
EP - 1334
BT - ISCC 2023 - 28th IEEE Symposium on Computers and Communications
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 28th IEEE Symposium on Computers and Communications, ISCC 2023
Y2 - 9 July 2023 through 12 July 2023
ER -