Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fun-reliable side-channels for cross-container communication

h4x0r.org

Post reply on HN
Print view View original

1–7 of 7 posts

Re: Fun-reliable side-channels for cross-container communication

#2

Post by simonw »

Here's a recipe for running the proof of concept using Docker on a Mac:

  cd /tmp
  wget https://github.com/crashappsec/h4x0rchat/blob/9b9d0bd5b2287501335acca35d070985e4f51079/h4x0rchat.c
  docker run --rm -it -v "$PWD:/src" \
    -w /src gcc:13 bash -lc 'gcc -Wall -O2 \
    -o h4x0rchat h4x0rchat.c && ./h4x0rchat'
Animated screenshot demo here: https://simonwillison.net/2025/Nov/12/h4x0rchat/

Re: Fun-reliable side-channels for cross-container communication

#3

Post by restlake »

simonw wrote: post #2

Here's a recipe for running the proof of concept using Docker on a Mac: cd /tmp wget https://github.com/crashappsec/h4x0rchat/blob/9b9d0bd5b2287501335acca35d070985e4f51079/h4x0rchat.c docker run --rm -it -v "$PWD:/src" \ -w /src gcc:13 bash -lc 'gcc -Wall -O2 \ -o h4x0rchat h4x0rchat.c && ./h4x0rchat' Animated screenshot demo here: https://simonwillison.net/2025/Nov/12/h4x0rchat/

super interesting pseudo IPC channel and at least mildly concerning from a security perspective. saw it on your site first and am shocked there is not a single other comment yet here

was hoping to find at least one “cmon this is easy to avoid with X thing in the kernel/OS” info nugget dropped

Re: Fun-reliable side-channels for cross-container communication

#4

Post by simonw »

restlake wrote: post #3
simonw wrote: post #2

Here's a recipe for running the proof of concept using Docker on a Mac: cd /tmp wget https://github.com/crashappsec/h4x0rchat/blob/9b9d0bd5b2287501335acca35d070985e4f51079/h4x0rchat.c docker run --rm -it -v "$PWD:/src" \ -w /src gcc:13 bash -lc 'gcc -Wall -O2 \ -o h4x0rchat h4x0rchat.c && ./h4x0rchat' Animated screenshot demo here: https://simonwillison.net/2025/Nov/12/h4x0rchat/

super interesting pseudo IPC channel and at least mildly concerning from a security perspective. saw it on your site first and am shocked there is not a single other comment yet here was hoping to find at least one “cmon this is easy to avoid with X thing in the kernel/OS” info nugget dropped

I'm not sure how much of a security concern this one is, at least for the kinds of things I care about with respect to containers.

I want my containers to be able to run work without other containers spying on them (already hard thanks to timing attacks).

This IPC channel only works if both containers are collaborating together. I don't think you can use it to spy on my container if my container isn't actively participating.

Re: Fun-reliable side-channels for cross-container communication

#5

Post by viega »

restlake wrote: post #3
simonw wrote: post #2

Here's a recipe for running the proof of concept using Docker on a Mac: cd /tmp wget https://github.com/crashappsec/h4x0rchat/blob/9b9d0bd5b2287501335acca35d070985e4f51079/h4x0rchat.c docker run --rm -it -v "$PWD:/src" \ -w /src gcc:13 bash -lc 'gcc -Wall -O2 \ -o h4x0rchat h4x0rchat.c && ./h4x0rchat' Animated screenshot demo here: https://simonwillison.net/2025/Nov/12/h4x0rchat/

super interesting pseudo IPC channel and at least mildly concerning from a security perspective. saw it on your site first and am shocked there is not a single other comment yet here was hoping to find at least one “cmon this is easy to avoid with X thing in the kernel/OS” info nugget dropped

Agreed that this is not a critical problem, and the cooperative side channel can be useful in otherwise uncooperative environments.

The article does mention wanting to coordinate across multiple identical processes running on the same node in a wide variety of environments as the motivator.

So maybe it should be a feature, not a bug :)

Re: Fun-reliable side-channels for cross-container communication

#7

Post by restlake »

viega wrote: post #5
restlake wrote: post #3

Earlier quoted context omitted.

super interesting pseudo IPC channel and at least mildly concerning from a security perspective. saw it on your site first and am shocked there is not a single other comment yet here was hoping to find at least one “cmon this is easy to avoid with X thing in the kernel/OS” info nugget dropped

Agreed that this is not a critical problem, and the cooperative side channel can be useful in otherwise uncooperative environments. The article does mention wanting to coordinate across multiple identical processes running on the same node in a wide variety of environments as the motivator. So maybe it should be a feature, not a bug :)

two well-balanced takes making me think I should embrace the fun parts of this design and worry less about the risks! it’s a pretty cool idea and impressive it works
Post reply on HN