Docker can be your worst enemy if you don’t know what you’re doing.
What it’s about
With Roberto Muñoz we presented advanced techniques to trojanize Docker images and compromise systems through containers.
We talk about trojanizing images, backdoors in containers, attacks on registries (Docker Hub and private ones) and supply chain attacks through images. Also persistence and lateral movement via Docker.
Why it’s relevant
Everyone uses Docker and everyone trusts third-party images. Hardly anyone checks what’s inside them.
A trojanized image can compromise your whole infrastructure, and it’s easier than you think.
Impact
After this talk, many companies started scanning their Docker images and setting up private registries with security policies.
Dockerscan, my tool for Docker security analysis, was born from this research.