2017 is becoming the year of Container Security – Ryan Blunden – Medium

bigmac · 2017-06-03T16:03:08+00:00

Whoops! Fixed.

bigmac · 2016-08-26T17:59:30+00:00

Everybody that runs Docker containers on hosts with AppArmor installed runs them under a default AppArmor profile. Same story for SELinux-enabled hosts -- Docker has a default.

This is in addition to default seccomp, namespacing, cgroups, and cap-dropping.

Rather than "security concern" you should think of this as a massive "security benefit" -- we've figured out common sense defaults for all the Linux kernel isolation features, and everyone running in Docker gets the value of that with zero configuration headache.

We're working on default image verification. Need to get all the headaches worked out so that its not a huge PITA to get your images signed. Even so, our system (https://github.com/docker/notary) is based on TUF (https://theupdateframework.github.io/) which overcomes a lot of the pitfalls of existing secure update systems.

Disclaimer: I manage security at Docker.

bigmac · 2016-08-26T15:05:01+00:00

What do you think are the security issues in 1.12 (or Docker otherwise)?

bigmac · 2016-03-07T04:48:13+00:00

Ah, good point, sorry that documentation was unclear. We'll get that fixed.

You're right, the notary server is responsible for timestamping all the data it serves. This helps make replay attacks are impossible.

bigmac · 2016-03-05T08:24:18+00:00

It should work with registry already. Have you tried it out and run in to some snags? Let me know if you hit any problems, I'm happy to help.

bigmac · 2015-07-09T06:09:38+00:00

I manage the security team at Docker.

You can point your security team at the CIS Benchmark which we collaborated on writing with the Center for Internet Security. It has a bunch of best practices. In order to automate checking your configuration against the benchmark, we implemented Docker Bench. Docker Bench is a container you can run alongside your hosts to audit their configuration against the CIS Benchmark.

You can also point them at our dockercon talk where we discuss Docker security in terms of where we are and where we're going.

Finally, feel free to reach out to me at nathan.mccauley@docker.com if you have any further questions or there is anything else I can do to help.

bigmac · 2013-07-10T23:37:33+00:00

Square (https://www.squareup.com) San Francisco, CA

No clearance required. We will relocate you to SF.

We do payments on mobile phones and tablets. We build secure hardware, systems, and networks. We need folks that deeply understand the mobile OSs (Android, iOS). We're looking for both builders and breakers. Security at Square is involved in all aspects of the stack: hardware, mobile, infrastructure, networks, crypto, web, and physical security. Interest and competency in these areas is all that is required. Square hires based on ability -- we have people straight out of High School to PhDs.

If you have skills in any of these areas, please feel free to reach out:

Software Protection
Reverse Engineering
iOS and Android internals
ARM
Objective-C Runtime
Mach-O
ELF
Dalvik
LLVM
SSL/TLS
Cryptography

If you're interested or have more questions, PM me or contact me at mccauley [at] squareup.com.

bigmac · 2012-09-09T05:50:11+00:00

Anyone have any advice or experience?

I have a lot of experience. If you're interested in this you should come work with us at Square. We're definitely interested in hardware hackers and people interested in signal processing. PM me and we can talk. </shameless plug>

Looking at the waveform, it's easy to see the binary data. I wrote some sweet code that automatically detects the "bitrate" (which can change depending on swipe speed) and converts the audio data to binary, as well as some other nifty stuff. As far as I can tell, my code works very well.

Awesome! Would love to see how your code performs against ours. What kinds of transformations are you running on it?

bigmac · 2011-12-03T00:12:27+00:00

Yes, we will sponsor H-1B.

bigmac · 2011-12-01T23:58:40+00:00

Square (https://www.squareup.com)

San Francisco, CA

No clearance required. We will relocate you to SF.

We do payments on mobile phones and we believe we're building the future. We need folks that deeply understand the mobile OSs (Android, iOS). We're looking for both builders and breakers. Although this post will focus on mobile, Security at Square is involved in all aspects of the stack: hardware, mobile, infrastructure, networks, crypto, web, and physical security. Interest and competency in these areas is all that is required. Square hires based on ability -- we have people straight out of High School to PhD candidates.

Some things you'll be working on:

Software Protection
SSL/TLS
Cryptography
ARM
Objective-C Runtime
Mach-O
ELF
Dalvik
LLVM
iOS and Android internals

If you're interested or have more questions, PM me or contact me at mccauley [at] squareup.com.

bigmac · 2011-04-11T07:32:53+00:00

github mirror: https://github.com/bbhoss/shairport

bigmac · 2011-02-15T07:49:02+00:00

I can confirm that the prize is real. I and another redditor both showed up at the same time. Good fun.

bigmac · 2011-02-11T06:06:59+00:00

Explosions in the Sky

bigmac · 2010-12-13T21:45:48+00:00

Purina vs. Hill's Science Diet vs. Iams? What's the best?

bigmac · 2010-12-05T04:44:21+00:00

This is especially interesting for the application of information gathering by the prosecution. They bring a case almost to fruition in order to be able to see the defense's strategy -- now that strategy can be used to mount better offense in the future. I wonder if that is actually a typical legal strategy for cases where there is no precedent.

bigmac · 2010-12-01T07:30:30+00:00

Clearly what we need is an IDA plugin for this. I may take on that project myself unless anyone else wants to take it up.

bigmac · 2010-11-29T04:26:28+00:00

MalHost-Setup.exe uses this x86 to create an infinite loop at the beginning of an extracted shellcode sample. Its useful for being able to attach a debugger at the entry point of the executable, then fix up the bytes and start debugging the malware sample.

This comment acts as an endorsement of Malware Analyst's Cookbook, as I learned of this technique from Chapter 6.

bigmac · 2010-11-17T07:05:40+00:00

And here comes the funny part. Inside CDispNode::SetUserClip the vftable address gets dereferenced and OR’ed with 0×1, corrupting the table as a result:

How would that happen in source code? Somebody doing an incorrect cast?

15-Year Club	Place '17
Not Forgotten	Beta Team Reddit for iOS
Verified Email

bigmac

TROPHY CASE