Malicious Compliance Automated: Building Secure Containers and Obfusca...
summary
Demonstrates that image minification plus metadata obfuscation makes scanners blind while the app still runs: using Docker Slim and the minify toolkit shrinks an image to 49 MB (down ~370 MB) and removes ~390 reported vulnerabilities, while scanners like Clair, Docker Scout and Trivy report wildly different counts (Clair 141 critical, Docker Scout 15 critical, Trivy ~2,700 medium+). Adding the --appuscate-metadata flag alters binary hashes (three extra bytes appended) and package version/name strings (e.g. 1.3.8 → 11.3.8), causing most SCA tools to report no findings despite real vulnerabilities remaining.
AI-written summary · about
chapters (14)
- 0:00Malicious compliance in containers
- 1:45Vulnerability scanner chaos demo
- 5:58Docker Slim and minification
- 7:49Shrinking image with Docker Slim
- 10:02Scanner results after minification
- 12:50Minification breaks scanners
- 16:46Obfuscating metadata
- 18:55Automating malicious compliance
- 20:18Obfuscation limits
- 25:47Scanner weaknesses call to action
- 27:53Why scanners can't be trusted
- 30:04SBOM tools state
- 31:11Docker Slim impact
- 31:53Malicious compliance solution
related talks
50mContainer Attack Surface Reduction Beyond Name Space Isolation
35mEnhancing Software Composition Analysis Resilience Against Container Image Obfuscation
41mIdentifying and Mitigating Cloud and Container Threats
35mSecuring Containers by Breaking In
32mA Security State Of Mind: Compliance and ...
29m5 Best Security Practices for your Production-Ready Containers
30mMaster the Container Security Model with- 41mIdentifying and Mitigating Cloud and Container Threats