Reverse Engineering and Exploiting Builds in the Cloud
summary
Shows concrete exploits against cloud CI: Google Cloud Build demo uses Docker ADD to bypass intermediate-network isolation, fetch metadata and an OAuth token that grants broad GCP access — the exploit works and uploads logs; Dockerfile build-time ARG/ENV misuse leaks secrets; partial image-hash FROM interpolation lets attackers reuse cached private images; fork-bomb CMDs cause container-runtime DoS. Includes tooling: Terria (image/component verification) and Break Out the Box; recommendations: set cgroup limits, clear caches, avoid shared mutable state.
AI-written summary · about
chapters (32)
- 0:00Intro
- 0:20Shoutouts
- 0:41Heroku Engineering
- 1:53What is CICD
- 3:12CICD Components
- 4:07Common Deployment Patterns
- 4:25Fully Multitenant
- 5:28Single Tenant
- 8:05Networking
- 9:05Virtual Network
- 9:49Add Directive
- 11:08Demo
- 29:28Whats the impact
- 30:34Remediation
- 32:05Assumptions
- 32:47Power of Command
- 33:26Commands in Containers
- 34:21Orchestrators Fail
- 34:56Component Verification
- 36:05Supply Chain Attacks
- 36:40Potential Attack Scenario
- 37:10Build Environments
- 38:05How do we do this
- 38:43Demo OCR Image
- 39:30Demo OCR Image Containers
- 40:45Evil Forks
- 41:42Cheat Sheets
- 41:53Conclusion
- 42:43Wrapup
- 43:50Multitenancy
- 44:45Research
- 45:11Thank you
related talks
37mSecuring Containers by Breaking In
39mExploiting Blind Memory Corruption in Cloud Services
44mLive Hacking Cloud Architectures
41mIdentifying and Mitigating Cloud and Container Threats
45mLive Hacking Cloud Architectures
38mA Treasure Map of Hacking (and Defending) Kubernetes- 41mIdentifying and Mitigating Cloud and Container Threats
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown