Protecting the Cloud from Inside

(1)

Protecting the Cloud from Inside

Alexandra Shulman-Peleg, PhD Cloud Security Researcher,

IBM Cyber Security Center of Excellence

• Intra-cloud security intelligence

• Protection of Linux containers

(2)

2

Securely Moving Corporate Applications to a Cloud

Customer’s view:

My infrastructure moved to a 3rd party cloud service – Help me to protect my assets.

Detection and remediation of cloud

vulnerabilities.

Public cloud

(3)

Cloud Infrastructure Layer (IaaS) Cloud Application Layer (PaaS)

Container security NoSQL security

Use cloud insights to raise the security

(4)

4

The cloud’s code:

• Controls distributed and complex environments • Executes automatically with admin privileges • Has modules in scripting languages

• Is open source with well known weaknesses

• May share the same kernel and host OS between applications of different users (e.g. Linux containers)

Cloud Trends

Cloud software is more vulnerable

(5)

Cloud Trends

Automation brings order! Each module knows its role!

(6)

6

Automating Code Distribution and Deployment with Containers

• Container cloud (IaaS)

• Deployment packages (PaaS)

• 70% of organizations are evaluating Docker

• 49% are concerned with Docker security

Survey of Vmblog.com (745 participants)

(7)

Containers - Emerging Building Blocks of Clouds

Lightweight OS-level virtualization via grouping resources like processes, files, and devices into isolated spaces.

Benefits:

• Portability and easy deployment

• Application isolation

• Near native performance

Server Host OS Bins /Libs Bins/Libs Bins /Libs App A App B App C App D Server Hypervisor Host OS Bins/ Libs

App A App B _{App C}

Guest OS Bins/ Libs Guest OS Guest OS Bins/ Libs Containers VMs

(8)

Containers’ Threats

Threats • Kernel exploits • Container Engine • Shared resources • Shared Bins/Libs • Mis-configurations Attack flow: • “Escape to host” via kernel exploits

• Propagating to additional servers

(9)

How to make my containers secure?

“Securing the Infrastructure and the Workloads of Linux Containers”, Workshop on Security and Privacy in the Cloud, Sept. 2015.

(10)

10

Open Source Linux Tools to the Rescue!

Linux Security Modules (LSMs, e.g. AppArmor, SElinux) are lightweight, loadable kernel modules enforcing access control.

Advantages of LSM:

• Part of Linux distributions

• Provide mandatory access control (MAC)

Disadvantages of LSMs:

• Complicated configuration and tuning

Profile to restrict the Docker daemon (none exists) Profiles to restrict the containers (limited docker-default profile)

(11)

Tracing Execution and Profile Generation

1. Invoke Docker API (build/run etc.).

2. Use SystemTap to monitor the kernel operations. 3. Generate LSM profiles

splitting between the host and the containers_.

https://github.com/LinuxContainerSecurity/ LiCShield.git

(12)

12

Profile Distribution and Enforcement

• Construct the security policy once for each image - apply to all the instances. Server Server Host OS Docker Daemon Docker Daemon My image Deploy

(13)

1. Linux host + container engine – high protection! Protecting server’s runtime with HIDS

2. Containers’ – “protection as a service”

Per image training and creation of AppArmor, Selinux policies

Overview of Host’s Runtime Protection

Server Host OS Bins/ Libs Bins/ Libs

App A App B App C App D

Container Engine Container Engine

Bins/Libs

Host Based Intrusion Detection (HIDS)

“As a service” workload protection

Per Image profiles

Secure, yet, Usable – Protecting Servers and Containers

(14)

14

No SQL, No Injection?

Workshop on Web 2.0 Security and Privacy (W2SP) 2015 A. Ron, A. Shulman-Peleg, E. Bronshtein, A. Puzanov

(15)

The Popularity of NoSQL Continues to Rise

(16)

16

NoSQL Attack Vectors

Attackers web browser Attackers web browser Attacked web server Attacked web server Client/Protocol wrapper Client/Protocol wrapper NoSQL data store Injection added Data Injection processed Data

• The new data models of NoSQL make old attacks, like SQL injections irrelevant.

• Attackers get new opportunities for injecting their

(17)

• Tautologies - bypassing access control by injecting code in conditional statements that are always true.

• Union queries – changing the data set returned for a given query.

NoSQL Injection Techniques

db.logins.find({ username: { $ne: 1 }, password: { $ne: 1 } }) username[$ne]=1&password[$ne]=1

{ username: ‘tolkien’, $or: [ {}, { ‘a’: ‘a’, password: ‘’ } ],

$comment: ‘successful MongoDB injection’ }

username=tolkien’, $or: [ {}, { ‘a’:’a&password=’ } ], $comment:’successful MongoDB injection’

(18)

18

• JavaScript injections - Passing un-sanitized user input to queries may allow injecting arbitrary JavaScript code.

• Origin violation - a legitimate user and its web browser are exploited to perform some unwanted action on behalf of the attacker.

(19)

Piggy-backed queries - where an attacker exploits some

assumptions in the interpretation of escape sequences special characters (e.g. termination characters like CRLF) to insert

additional queries to be executed by the database.

NoSQL Injection Techniques – Caches

Attackers web browser Attackers web browser Attacked web front end Attacked web front end Protocol wrapper Protocol wrapper Injection added Data Data In -m e m o ry d a ta sto re In -m e m o ry d a ta sto re Injection

Cloud or BigData Framework

Data Data Data

(20)

20

Mitigation of Attacks and Injections

Continuous Mitigation Development and testing Development and testing Secure Deployment Secure Deployment Monitoring and Protection Monitoring and Protection Insider’s view https://developer.ibm.com/bluemix/2015/07/02/vulnerability-advisor/

(21)

Cloud Operation Layer

Cloud Infrastructure Layer (IaaS)

Admin monitoring: logs, accounting etc. Admin disruptive:

Chef, TripleO, DevOps

Network, VMs, Containers, Storage, Users Heat, Mistral, ...

IDaaS, NoSQL data stores, Spark cloud Foundry

Cloud Application Layer (PaaS)

Details of the workload to be executed Security tools and policies Security and Policy Dashboard

Protecting the Cloud from the Inside

Security Intelligence for Cloud Management Infrastructures

S. Berger, S. Garion, Y. Moatti, D. Naor, D. Pendarakis, A. Shulman-Peleg JR Rao, E. Valdez, Y. Weinsberg, to appear.

(22)

22

IBM Cyber Security Center of Excellence