This week, I came across an article discussing how attackers were targeting Docker remote API servers recently. Docker is something we have discussed in my CS 348 class, so this was immediately intriguing. I know that Docker is used on many projects so that teams can all work with the same software. Obviously, attacks on these servers is something of great concern. The article begins by stating the issue and giving an example of a recent attack. It quickly jumps into explaining the process of how these attackers are pulling this off. The attack starts with a ping to the remote API server. Once they are able to get the information from the server, they create a container with the same name and allow themselves access to privileged mode. From there, the attackers have the reigns to complete the attack. The article then goes on to show how exactly the attackers do it with shell scripts and examples. It concludes with a list of recommendations on how to prevent these attacks for your own Docker remote API servers.
I found this article quite interesting for a couple of reasons. First being that, as I am still new to Docker and its features, I was unaware that it was susceptible to attacks such as this. Now, I am aware that it is not a normal occurrence, it was still surprising to me. However, I am now aware that whoever is running the server must make sure to configure the settings properly and pay attention to the server. Another reason I found this interesting is that I also have an interest in cybersecurity and networking. Not only was I able to learn more about what we had talked about in class, but also what I am learning outside of class.
There was a good amount of knowledge to take away from this article. I learned that even in software created by and for computer scientists, you can’t trust it blindly. This is not to knock Docker, but more of a reminder to myself, as it is something I am responsible for, not the software. It also shows how much more there is to being a computer scientist than just writing code, and if that is the only responsibility you prioritize, it will prove to be problematic for you and those you are working with. It was also pretty cool for me to see the actual scripting used for these attacks as I am learning more about cybersecurity.
From the blog CS@Worcester – Auger CS by Joseph Auger and used with permission of the author. All other rights reserved by the author.
