Slashdot Mirror

← Back to Stories (view on slashdot.org)

Docker Image Insecurity

Posted by Soulskill on from the totally-secure-for-undefined-values-of-secure dept.

An anonymous reader writes Developer Jonathan Rudenberg has discovered and pointed out a glaring security hole in Docker's system. He says, "Recently while downloading an 'official' container image with Docker I saw this line: ubuntu:14.04: The image you are pulling has been verified

I assumed this referenced Docker's heavily promoted image signing system and didn't investigate further at the time. Later, while researching the cryptographic digest system that Docker tries to secure images with, I had the opportunity to explore further. What I found was a total systemic failure of all logic related to image security.

Docker's report that a downloaded image is 'verified' is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest. An attacker could provide any image alongside a signed manifest. This opens the door to a number of serious vulnerabilities." Docker's lead security engineer has responded here.

20 of 73 comments (clear)

  1. Read the update by jbolden · · Score: 5, Informative

    Read the update. Pretty much the Docker team is implementing a container verification system and working through the details of decentralized security. v1 is part of the mechanism being in place. It assumes that an upstream verification is in place which is at best-semi helpful. Everyone agrees that the current system does nothing and the message is highly misleading in that it might lead someone to believe that there is a security system in place when the plumbing isn't finished.

    So there is no argument here between the parties (what nothing to fight about on /.). Worth pointing out to the /. community however not to take that message seriously yet.

    1. Re:Read the update by postbigbang · · Score: 4, Informative

      Seems as though you're giving them a free ride for a rather poorly implemented message. And this is Slashdot, where we'll fight if we feel like it.

      Docker's been pretty loose and fast, and "not taking that message seriously yet" in a supposedly production environment seems a bit sophomoric.

      --
      ---- Teach Peace. It's Cheaper Than War.
    2. Re:Read the update by Todd+Knarr · · Score: 4, Insightful

      Upstream verification won't help. The client has to verify that the image it received is the same one the server verified, otherwise someone can hack a router to silently redirect the client to a malicious server and serve up whatever image they want alongside a copy of the signed manifest for the official image and you're fsckd. What they need is:

      1. The manifest has to be signed.
      2. The manifest has to contain a secure checksum (cryptographic hash) of the official image the server has.
      3. The client has to verify the signature of the manifest to confirm that the manifest hasn't been altered and comes from the official source.
      4. The client has to verify that the checksum of the image it received matches the checksum for the image in the manifest.

      5. Step 4 is apparently what's missing from the client.

    3. Re:Read the update by postbigbang · · Score: 4, Interesting

      It's nice to try to deflate this, but the blunder and the QA mistake remain. As I like to hesitate on the side of caution, I'd change this quickly. Just agreeing that one screwed up and not halting distribution for this head-desk sort of error -- in the face of the enormous security risk endowed -- isn't quite satisfactory.

      I'm here to punish no one, but in a crazy sort of way, I find this one to be a bit mind-boggling, to the tune that each and every appliance that wasn't independently MD5'd is now a freaking five star security risk. Chain of authorities are tremendously important, and reasonable people would believe, mistakenly, that all is fine, when none of it now is, because the chain of authorities chain has been broken, and for what I know, from its inception.

      So you're telling me to cool down, and I'm telling you that every single Docker implementation is now reasonably suspect, because of this go-lightly screw-up.

      --
      ---- Teach Peace. It's Cheaper Than War.
    4. Re:Read the update by jbolden · · Score: 2

      No Docker implementation is any worse than it was before. They went from no security to slightly better security that in practice in most install is unlikely to be useful but with a misleadingly reassuring message.

      There could very well be problems since people could be letting down their guard when they shouldn't. My point is that there isn't much debate since the Docker people explained what was going on, everyone agrees that is what is going on and the Docker people agree the message everything is OK shouldn't be in place before the plumbing is to make everything OK.

    5. Re:Read the update by jbolden · · Score: 2

      It is a bit more complex but yes. A much better message might be something like "plumbing 2 of 4 steps functional -- passed" or even "checksum passed: note if you don't know how the Docker checksum works you probably don't have enough auxiliary plumbing for it to be working for you, so please be cautious". which would make it clear that nothing is really being tested at this point for most users.

       

    6. Re:Read the update by jbolden · · Score: 2

      Yes. You have to run an out of band security system at this point for Docker same as before.

    7. Re:Read the update by jbolden · · Score: 2

      Yes. All the time. One of the core idea of modern PaaS systems is that from an OS standpoint what runs in dev runs in test and production no configuration during migration. Google for example last year was running over a billion containers in production.

  2. What is this new madness? by tgibson · · Score: 3, Insightful

    I'm about to leave for Sears, inseam and waist measurements in hand. And here I read that my image security is at risk. I better find a new brand of pants I guess.

  3. What? by ArchieBunker · · Score: 5, Insightful

    Don't tell us what the fuck a docker is or anything...

    --
    Only the State obtains its revenue by coercion. - Murray Rothbard
    1. Re:What? by stjobe · · Score: 2

      Docker is an open platform for developers and sysadmins to build, ship, and run distributed applications.

      --
      "Total destruction the only solution" - Bob Marley
  4. Dockers is a brand of khaki garments by Anonymous Coward · · Score: 5, Funny

    Dockers is a brand of khaki garments and other accessories from Levi Strauss & Co.

    It's obviously a single pant-leg or shoe, hence, Docker, not Dockers.

    You're welcome.

    1. Re:Dockers is a brand of khaki garments by PPH · · Score: 2

      And I'd be pretty insecure if mine had a hole in them.

      Not even considering how my image would suffer.

      --
      Have gnu, will travel.
  5. Can it be enabled? by ThePhilips · · Score: 2

    Docker's report that a downloaded image is 'verified' is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest.

    Can it be enabled? If yes, then I do not see a problem.

    Otherwise, the signing crap is just that: crap.

    It takes needlessly long time to verify the signature. (Because they are not slow! - they are so secure, so very much OMG secure.)

    It is a huge risk to reconfigure a production system to use unsigned data if emergency arises. (Think recovery from a local backup.)

    Developers forget to renew their certificates and suddenly, in the middle of a production, whole system goes down, because OMG the certificate has expired and data may be not secure!!!

    And then, in the end, the signing keys get leaked or stolen...

    --
    All hope abandon ye who enter here.
  6. Love that response by Tailhook · · Score: 4, Insightful

    A summary of that wall-of-text "response" from the Docker "lead security engineer":

    "Bullshit, bullshit v1 bullshit. Bullshit discussions about bullshit CVE bullshit. (yes we know its broken) Bullshit v2 bullshit, next version bullshit Bullshit."

    If you can't dazzle them with your intelligence, baffle them with your bullshit.

    --
    Maw! Fire up the karma burner!
    1. Re:Love that response by paulpach · · Score: 2

      If you can't dazzle them with your intelligence, baffle them with your bullshit.

      1) They have complete lack of image validation
      2) Docker prints "Image validated" as part of the pull.

      This is just flat out embarrassing, If I was the "lead security engineer" of that, I would actually worry about job stability.
      There is not a whole lot he could say that would save face.
      And yet, the response is truly terrible. He essentially says "yeap, we knew about it, shipped it anyway, and talked about fixing it"

      It does not take a PR genius to figure out a good response. For example: "Thank you for pointing it out, we will have a patch soon" or respond with an actual patch. This is not rocket science, validating a signature properly only takes a few lines of shell script or C code, and has been solved a long time ago by most other package managers.

  7. They must love xkcd by hendrik42 · · Score: 2, Funny

    http://xkcd.com/1181/

  8. Re:Docker is dead by PCM2 · · Score: 2

    Err. Rocket is from the guys that brought you CoreOS. CoreOS uses systemd. Not the same thing.

    --
    Breakfast served all day!
  9. THESE AREN'T THE DROIDS YOU'RE LOOKING FOR by twitnutttt · · Score: 2

    I'm glad I'm not the only one who had that reaction. Unintelligible drivel!

    Here are my favorite excerpts:
    -- "There is nothing particularly new in Jonathan's post and I thank him for facilitating a conversation [about nothing particularly new apparently]."
    -- "Image security is of the upmost importance to us. For these reasons, we've [reached] many of the same conclusions [that there is no image security]."
    -- "v1 is not v2. v1 has a flawed design. we have a draft for v2. v2 will be better. v2 will be much more shiny. when you have v2, you will forget how insecure v1 is. until then, we recommend you use v2, because v1 is not secure. v2 is still in draft."
    -- "THESE AREN'T THE DROIDS YOU'RE LOOKING FOR."

  10. Summary is scaremongering by Anonymous Coward · · Score: 2, Insightful

    Read the article, summary makes it sound as if Docker doesn't verify the checksums and it does. What his complaint is, that it verifies the checksum AFTER decompress, de-tar'ing from a HTTPS source, and only does a cursory check on the TAR file.

    He complains that the check on the TAR file is imperfect, which is true, and that the act of unpacking might reveal a vulnerability in the unpacker which could compromise the machine.

    So, to be clear, his proposed attack is "intercept the https source" (which is possible by the NSA/GCHQ due to the certificate authority weakness), they then send a TAR which triggers a bug in unpack and takes control of a machine (which surely needs this untar bug to be fixed rather than docker to slap a fix around it), and then creates a plausible clean version sent to Docker to be verified.

    It's then presented on slashdot, as "docker doesn't verify signatures" which is misleading to the point of deception.