Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Increasing Attacker Cost Using Immutable Infrastructure

diogomonica.com

Post reply on HN
Print view View original

31–37 of 37 posts

Re: Increasing Attacker Cost Using Immutable Infrastructure

#31

Post by digi_owl »

SixSigma wrote: post #17
runeks wrote: post #14

> Until we fix this RCE vulnerability, the attacker will > still be able to execute code on our host [...] With Docker, it seems to me like we're moving closer and closer to the server being an executable of its own, but with the necessary Linux kernel bits compiled in such that it can execute on (virtualized) hardware. I'm wondering how far we can take this. The ability to execute code on the host is there because t…

This industry is one of the least aware of its own history, everyone is focussed on tomorrow. We should really include History of Computing as a discipline. Round and Round and Round we go. --- You want to make your way in the CS field? Simple. Calculate rough time of amnesia (hell, 10 years is plenty, probably 10 months is plenty), go to the dusty archives, dig out something fun, and go for it. It’s worked for many…

I wonder how much of that has to do with the mainframe-minicomp era having been largely insular relative to the wider population.

Keep in mind that todays server hardware traces its lineage back to IBMs response to microcomputers like the AppleII and C64.

Re: Increasing Attacker Cost Using Immutable Infrastructure

#32

Post by digi_owl »

paulddraper wrote: post #30
digi_owl wrote: post #29

Earlier quoted context omitted.

Or as i like to call them, DOS-in-a-can...

DOS like Denial of Service? Or DOS like MS-DOS? Either one doesn't make sense to me.

the latter.

DOS was a downright minimal layer of code between the software and the hardware.

Little to no memory protection etc.

If it walks like a duck and quacks like a duck...

Re: Increasing Attacker Cost Using Immutable Infrastructure

#33

Post by nickpsecurity »

digi_owl wrote: post #29
stable-point wrote: post #16

Earlier quoted context omitted.

This is called a Unikernel: https://en.wikipedia.org/wiki/Unikernel > Unikernels are specialised, single address space machine images constructed by using library operating systems. A developer selects, from a modular stack, the minimal set of libraries which correspond to the OS constructs required for their application to run. These libraries are then compiled with the application and configuration code to build se…

Or as i like to call them, DOS-in-a-can...

That's not fair given DOS was 100% unsafe in architecture and implementation language. The Ocaml or Rust ones are more like the Pascal OS's (eg Solo) with a certain amount of safety built-in. I agree on the minimal part but the overall metaphor doesn't fit.

Re: Increasing Attacker Cost Using Immutable Infrastructure

#34

Post by JoachimSchipper »

wepple wrote: post #23
JoachimSchipper wrote: post #8

Docker is not (designed to be) a security technology. Yes, rolling back servers/VMs/containers to their previous state is a good capability to have (although most of us just use backups for that!), but assuming that an attacker cannot break out of a container is, at least, optimistic.

> assuming that an attacker cannot break out of a container is, at least, optimistic. Agreed. However as long as you don't look at it as your primary line of defense, it increases the cost to an attacker. And that's currently the best we can ever do.

There are arguments - which are at least plausible - that the same effort is better spent on VM / Solaris Zones / FreeBSD jails / traditional chroot / SELinux / just using dedicated hardware for everything / ...; several of these have the advantage of not encouraging people to throw up a compartment (of some kind) and never update it again, which is certainly something that happens with Docker.

Re: Increasing Attacker Cost Using Immutable Infrastructure

#35

Post by Animats »

Real immutability would be good in more applications, as when you load a program into the memory of an embedded processor and then blow the programming fuse so it can never be changed. Hardware where parts of memory can be made read-only after boot and can't be written again without a full processor reboot would be useful.

Re: Increasing Attacker Cost Using Immutable Infrastructure

#36

Post by justincormack »

runeks wrote: post #21
stable-point wrote: post #16

Earlier quoted context omitted.

This is called a Unikernel: https://en.wikipedia.org/wiki/Unikernel > Unikernels are specialised, single address space machine images constructed by using library operating systems. A developer selects, from a modular stack, the minimal set of libraries which correspond to the OS constructs required for their application to run. These libraries are then compiled with the application and configuration code to build se…

That is correct. I guess what I wanted to point out is that it would be cool if Linux could become this - a library that you can compile into your program, rather than a program in which you run your programs (an OS).

There is a library port of Linux, lkl https://github.com/lkl
Post reply on HN