Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Increasing Attacker Cost Using Immutable Infrastructure

diogomonica.com

Post reply on HN
Print view View original

21–30 of 37 posts

Re: Increasing Attacker Cost Using Immutable Infrastructure

#21

Post by runeks »

stable-point wrote: post #16
runeks wrote: post #14

> Until we fix this RCE vulnerability, the attacker will > still be able to execute code on our host [...] With Docker, it seems to me like we're moving closer and closer to the server being an executable of its own, but with the necessary Linux kernel bits compiled in such that it can execute on (virtualized) hardware. I'm wondering how far we can take this. The ability to execute code on the host is there because t…

This is called a Unikernel: https://en.wikipedia.org/wiki/Unikernel > Unikernels are specialised, single address space machine images constructed by using library operating systems. A developer selects, from a modular stack, the minimal set of libraries which correspond to the OS constructs required for their application to run. These libraries are then compiled with the application and configuration code to build se…

That is correct. I guess what I wanted to point out is that it would be cool if Linux could become this - a library that you can compile into your program, rather than a program in which you run your programs (an OS).

Re: Increasing Attacker Cost Using Immutable Infrastructure

#22

Post by wepple »

xorcist wrote: post #5

It is not a good idea to restore attacker-owned applications to a "known good" state before you have done at least a cursory post mortem. Not only do are the security holes intact but since the attacker now knows they been found out, you can invite more serious damage. The article tries to pitch read only Docker images some kind of solution, but running your applications read only (and what other permissions you gran…

I agree that rolling back an image to a "known good" state is not the appropriate solution; if you can do it efficiently, what's stopping you from doing it very regularly?

Attacking a system that disappears and restarts on a regular basis is a nightmare for current attackers; it's not something that they have the tooling to deal with yet.

I believe some of these ideas were discussed by Dino Dai Zovi in a talk[1] he did which combined a whole bunch of rather out of the box ideas on defense.

[1] https://www.youtube.com/watch?v=_A6Y62AcQ2g

Re: Increasing Attacker Cost Using Immutable Infrastructure

#23

Post by wepple »

JoachimSchipper wrote: post #8

Docker is not (designed to be) a security technology. Yes, rolling back servers/VMs/containers to their previous state is a good capability to have (although most of us just use backups for that!), but assuming that an attacker cannot break out of a container is, at least, optimistic.

> assuming that an attacker cannot break out of a container is, at least, optimistic.

Agreed. However as long as you don't look at it as your primary line of defense, it increases the cost to an attacker. And that's currently the best we can ever do.

Re: Increasing Attacker Cost Using Immutable Infrastructure

#24

Post by feld »

xorcist wrote: post #5

It is not a good idea to restore attacker-owned applications to a "known good" state before you have done at least a cursory post mortem. Not only do are the security holes intact but since the attacker now knows they been found out, you can invite more serious damage. The article tries to pitch read only Docker images some kind of solution, but running your applications read only (and what other permissions you gran…

The invention of containers (FreeBSD jails) was to automate restoring vulnerable web apps that couldn't be patched / updated (edit: as well as allowing shared hosting with different perl requirements to co-exist on the same server) Every time tampering was detected they automated restoration and watched the attacker squirm as their changes kept reverting and files were disappearing.

Don't dismiss this concept. It's a perfectly valid approach in some scenarios.

Re: Increasing Attacker Cost Using Immutable Infrastructure

#25

Post by hodgesrm »

xorcist wrote: post #5

It is not a good idea to restore attacker-owned applications to a "known good" state before you have done at least a cursory post mortem. Not only do are the security holes intact but since the attacker now knows they been found out, you can invite more serious damage. The article tries to pitch read only Docker images some kind of solution, but running your applications read only (and what other permissions you gran…

I'm not sure I understand the argument against reverting state. If you are cleaning up any sort of mess--including getting hacked--it's vastly easier to start with a good before-things-got-messed up state. This is one of the reasons people buy expensive storage arrays that support fast snapshot reversion.

Also, the author is arguing fix now but preserve all information for fault diagnosis later. For a lot of problems that seems like exactly the right choice.

Re: Increasing Attacker Cost Using Immutable Infrastructure

#26

Post by paulddraper »

runeks wrote: post #21
stable-point wrote: post #16

Earlier quoted context omitted.

This is called a Unikernel: https://en.wikipedia.org/wiki/Unikernel > Unikernels are specialised, single address space machine images constructed by using library operating systems. A developer selects, from a modular stack, the minimal set of libraries which correspond to the OS constructs required for their application to run. These libraries are then compiled with the application and configuration code to build se…

That is correct. I guess what I wanted to point out is that it would be cool if Linux could become this - a library that you can compile into your program, rather than a program in which you run your programs (an OS).

Linux is purposefully and by design monolithic.

However, you could base your unikernal capabilities on the same interface (like POSIX).

Current unikernals: http://unikernel.org/projects/

Re: Increasing Attacker Cost Using Immutable Infrastructure

#27

Post by digi_owl »

runeks wrote: post #21
stable-point wrote: post #16

Earlier quoted context omitted.

This is called a Unikernel: https://en.wikipedia.org/wiki/Unikernel > Unikernels are specialised, single address space machine images constructed by using library operating systems. A developer selects, from a modular stack, the minimal set of libraries which correspond to the OS constructs required for their application to run. These libraries are then compiled with the application and configuration code to build se…

That is correct. I guess what I wanted to point out is that it would be cool if Linux could become this - a library that you can compile into your program, rather than a program in which you run your programs (an OS).

The GPL would likely give any legal department pause for thought in that regard.

Re: Increasing Attacker Cost Using Immutable Infrastructure

#28

Post by ris »

drieddust wrote: post #10
xorcist wrote: post #5

It is not a good idea to restore attacker-owned applications to a "known good" state before you have done at least a cursory post mortem. Not only do are the security holes intact but since the attacker now knows they been found out, you can invite more serious damage. The article tries to pitch read only Docker images some kind of solution, but running your applications read only (and what other permissions you gran…

> It is not a good idea to restore attacker-owned applications to a "known good" state before you have done at least a cursory post mortem. Not only do are the security holes intact but since the attacker now knows they been found out, you can invite more serious damage. I would also add that attackers are actually after the data. Exploiting application vulnerabilities is just a mean to that end so bringing back expl…

> I would also add that attackers are actually after the data.

Not strictly true - depending on the parties it's still a very desirable goal to be able to snoop on a site's continued operations, inject some code into visitors' pages, or just have a platform for further attacks.

Re: Increasing Attacker Cost Using Immutable Infrastructure

#29

Post by digi_owl »

stable-point wrote: post #16
runeks wrote: post #14

> Until we fix this RCE vulnerability, the attacker will > still be able to execute code on our host [...] With Docker, it seems to me like we're moving closer and closer to the server being an executable of its own, but with the necessary Linux kernel bits compiled in such that it can execute on (virtualized) hardware. I'm wondering how far we can take this. The ability to execute code on the host is there because t…

This is called a Unikernel: https://en.wikipedia.org/wiki/Unikernel > Unikernels are specialised, single address space machine images constructed by using library operating systems. A developer selects, from a modular stack, the minimal set of libraries which correspond to the OS constructs required for their application to run. These libraries are then compiled with the application and configuration code to build se…

Or as i like to call them, DOS-in-a-can...

Re: Increasing Attacker Cost Using Immutable Infrastructure

#30

Post by paulddraper »

digi_owl wrote: post #29
stable-point wrote: post #16

Earlier quoted context omitted.

This is called a Unikernel: https://en.wikipedia.org/wiki/Unikernel > Unikernels are specialised, single address space machine images constructed by using library operating systems. A developer selects, from a modular stack, the minimal set of libraries which correspond to the OS constructs required for their application to run. These libraries are then compiled with the application and configuration code to build se…

Or as i like to call them, DOS-in-a-can...

DOS like Denial of Service? Or DOS like MS-DOS?

Either one doesn't make sense to me.

Post reply on HN