[论文解读] Threat Modeling and Security Analysis of Containers: A Survey

Ann Yi Wong, Eyasu Getahun Chekole+2 more|arXiv (Cornell University)|Nov 22, 2021

Network Security and Intrusion Detection参考文献 55被引用 16

一句话总结

本文采用STRIDE威胁建模框架，对容器生态系统的全生命周期（从镜像创建到部署）进行了全面的威胁建模，识别出其中的各类安全漏洞。文章调研了现有的缓解策略，评估其优势与局限性，并指出了关键的研究空白，以指导未来容器安全领域的研究工作。

ABSTRACT

Traditionally, applications that are used in large and small enterprises were deployed on "bare metal" servers installed with operating systems. Recently, the use of multiple virtual machines (VMs) on the same physical server was adopted due to cost reduction and flexibility. Nowadays, containers have become popular for application deployment due to smaller footprints than the VMs, their ability to start and stop more quickly, and their capability to pack the application binaries and their dependencies in standalone units for seamless portability. A typical container ecosystem includes a code repository (e.g., GitHub) where the container images are built from the codes and libraries and then pushed to the image registry (e.g., Docker Hub) for subsequent deployment as application containers. However, the pervasive use of containers also leads to a wide-range of security breaches, such as stealing credentials and sensitive data from image registry and code repository, carrying out DoS attacks, and gaining root access to the underlying host. In this paper, we first perform threat modeling on the containers ecosystem using the popular threat modeling framework, called STRIDE. Using STRIDE, we identify the vulnerabilities in each system component, and investigate potential security threats and their consequences. Then, we conduct a comprehensive survey on the existing countermeasures designed against the identified threats and vulnerabilities. In particular, we assess the strengths and weaknesses of the existing mitigation strategies designed against such threats. We believe that this work will help researchers and practitioners to gain a deeper understanding of the threat landscape in containers and the state-of-the-art countermeasures. We also discuss open research problems and future research directions in containers security, which may ignite further research to be done in this area.

研究动机与目标

• 分析容器生态系统的完整攻击面，涵盖代码仓库、镜像仓库和运行时环境。
• 利用STRIDE威胁建模框架识别并分类容器中的安全威胁与漏洞。
• 系统性地调研并评估现有针对容器特异性威胁的对策。
• 指出当前缓解策略的局限性，并识别容器安全领域中的开放性研究问题。

提出的方法

• 将STRIDE威胁建模框架应用于容器生态系统的各个组件，包括代码仓库、镜像仓库和运行时环境，以映射各类威胁。
• 将识别出的威胁映射到特定的威胁类别（如欺骗、篡改、权限提升等）及其相关漏洞。
• 对现有缓解技术进行系统性文献调研，按威胁类型进行分类，并评估其有效性。
• 评估cgroups、命名空间、权限分离以及基于机器学习的运行时监控等缓解策略的优势与劣势。
• 识别当前方法的局限性，包括入侵检测/防御系统（IDS/IPS）中的误报问题、基于机器学习的异常检测准确性不足，以及配置错误。
• 提出安全配置实践的改进建议，并指出需要进一步研究的领域。

实验结果

研究问题

• RQ1 从代码开发到生产部署的整个容器生命周期中，主要的安全威胁和漏洞是什么？
• RQ2 现有缓解策略在应对容器化环境中识别出的威胁时，其有效性如何？
• RQ3 当前容器安全机制（如cgroups、命名空间和能力）的关键局限性和缺陷是什么？
• RQ4 容器生态系统中的哪些组件（如Docker Hub、GitHub、Kubernetes）最容易遭受入侵，原因是什么？
• RQ5 在提升容器安全方面，存在哪些开放的研究挑战和未来研究方向？

主要发现

• 在400万个Docker Hub镜像中，51%含有可利用的漏洞，其中0.16%（6,432个镜像）托管了恶意软件，主要为加密货币挖矿程序。
• 攻击者利用配置不当的Docker API端点和默认网络设置，获得未授权访问权限并部署了挖矿恶意软件。
• 美国国家安全局（NSA）等机构报告了针对Kubernetes集群的大规模攻击，包括2018年特斯拉容器被入侵的事件。
• 现有的缓解策略（如cgroups和命名空间）在配置错误时，仍易受到容器逃逸和权限提升攻击。
• 基于机器学习的系统调用异常检测显示出潜力，但准确率较低，且在多样化使用场景中缺乏充分验证。
• 许多缓解策略已过时或不足，尚无单一解决方案能完全应对容器生态系统复杂且多层的攻击面。