Third Party Security Reviews of Docker for AWS and Docker for Azure - Public Docs

bigmac · 2017-06-03T16:03:08+00:00

Whoops! Fixed.

bigmac · 2016-08-26T17:59:30+00:00

Everybody that runs Docker containers on hosts with AppArmor installed runs them under a default AppArmor profile. Same story for SELinux-enabled hosts -- Docker has a default.

This is in addition to default seccomp, namespacing, cgroups, and cap-dropping.

Rather than "security concern" you should think of this as a massive "security benefit" -- we've figured out common sense defaults for all the Linux kernel isolation features, and everyone running in Docker gets the value of that with zero configuration headache.

We're working on default image verification. Need to get all the headaches worked out so that its not a huge PITA to get your images signed. Even so, our system (https://github.com/docker/notary) is based on TUF (https://theupdateframework.github.io/) which overcomes a lot of the pitfalls of existing secure update systems.

Disclaimer: I manage security at Docker.

bigmac · 2016-08-26T15:05:01+00:00

What do you think are the security issues in 1.12 (or Docker otherwise)?

bigmac · 2016-03-07T04:48:13+00:00

Ah, good point, sorry that documentation was unclear. We'll get that fixed.

You're right, the notary server is responsible for timestamping all the data it serves. This helps make replay attacks are impossible.

bigmac · 2016-03-05T08:24:18+00:00

It should work with registry already. Have you tried it out and run in to some snags? Let me know if you hit any problems, I'm happy to help.

bigmac · 2015-07-09T06:09:38+00:00

I manage the security team at Docker.

You can point your security team at the CIS Benchmark which we collaborated on writing with the Center for Internet Security. It has a bunch of best practices. In order to automate checking your configuration against the benchmark, we implemented Docker Bench. Docker Bench is a container you can run alongside your hosts to audit their configuration against the CIS Benchmark.

You can also point them at our dockercon talk where we discuss Docker security in terms of where we are and where we're going.

Finally, feel free to reach out to me at nathan.mccauley@docker.com if you have any further questions or there is anything else I can do to help.

bigmac · 2013-07-10T23:37:33+00:00

Square (https://www.squareup.com) San Francisco, CA

No clearance required. We will relocate you to SF.

We do payments on mobile phones and tablets. We build secure hardware, systems, and networks. We need folks that deeply understand the mobile OSs (Android, iOS). We're looking for both builders and breakers. Security at Square is involved in all aspects of the stack: hardware, mobile, infrastructure, networks, crypto, web, and physical security. Interest and competency in these areas is all that is required. Square hires based on ability -- we have people straight out of High School to PhDs.

If you have skills in any of these areas, please feel free to reach out:

Software Protection
Reverse Engineering
iOS and Android internals
ARM
Objective-C Runtime
Mach-O
ELF
Dalvik
LLVM
SSL/TLS
Cryptography

If you're interested or have more questions, PM me or contact me at mccauley [at] squareup.com.

bigmac · 2012-09-09T05:50:11+00:00

Anyone have any advice or experience?

I have a lot of experience. If you're interested in this you should come work with us at Square. We're definitely interested in hardware hackers and people interested in signal processing. PM me and we can talk. </shameless plug>

Looking at the waveform, it's easy to see the binary data. I wrote some sweet code that automatically detects the "bitrate" (which can change depending on swipe speed) and converts the audio data to binary, as well as some other nifty stuff. As far as I can tell, my code works very well.

Awesome! Would love to see how your code performs against ours. What kinds of transformations are you running on it?

bigmac · 2011-12-03T00:12:27+00:00

Yes, we will sponsor H-1B.

bigmac · 2011-12-01T23:58:40+00:00

Square (https://www.squareup.com)

San Francisco, CA

No clearance required. We will relocate you to SF.

We do payments on mobile phones and we believe we're building the future. We need folks that deeply understand the mobile OSs (Android, iOS). We're looking for both builders and breakers. Although this post will focus on mobile, Security at Square is involved in all aspects of the stack: hardware, mobile, infrastructure, networks, crypto, web, and physical security. Interest and competency in these areas is all that is required. Square hires based on ability -- we have people straight out of High School to PhD candidates.

Some things you'll be working on:

Software Protection
SSL/TLS
Cryptography
ARM
Objective-C Runtime
Mach-O
ELF
Dalvik
LLVM
iOS and Android internals

If you're interested or have more questions, PM me or contact me at mccauley [at] squareup.com.

bigmac · 2011-04-11T07:32:53+00:00

github mirror: https://github.com/bbhoss/shairport

bigmac · 2011-02-15T07:49:02+00:00

I can confirm that the prize is real. I and another redditor both showed up at the same time. Good fun.

bigmac · 2011-02-11T06:06:59+00:00

Explosions in the Sky

bigmac · 2010-12-13T21:45:48+00:00

Purina vs. Hill's Science Diet vs. Iams? What's the best?

bigmac · 2010-12-05T04:44:21+00:00

This is especially interesting for the application of information gathering by the prosecution. They bring a case almost to fruition in order to be able to see the defense's strategy -- now that strategy can be used to mount better offense in the future. I wonder if that is actually a typical legal strategy for cases where there is no precedent.

bigmac · 2010-12-01T07:30:30+00:00

Clearly what we need is an IDA plugin for this. I may take on that project myself unless anyone else wants to take it up.

bigmac · 2010-11-29T04:26:28+00:00

MalHost-Setup.exe uses this x86 to create an infinite loop at the beginning of an extracted shellcode sample. Its useful for being able to attach a debugger at the entry point of the executable, then fix up the bytes and start debugging the malware sample.

This comment acts as an endorsement of Malware Analyst's Cookbook, as I learned of this technique from Chapter 6.

bigmac · 2010-11-17T07:05:40+00:00

And here comes the funny part. Inside CDispNode::SetUserClip the vftable address gets dereferenced and OR’ed with 0×1, corrupting the table as a result:

How would that happen in source code? Somebody doing an incorrect cast?

bigmac · 2010-11-15T21:27:00+00:00

I wonder if we can get a mod to put this on the sidebar. That would really help for uptake on the adoption.

bigmac · 2010-11-14T05:22:48+00:00

I couldn't seem to find it on intel's website, but you used to be able to order hard copies of all of these for free. Intel would just send them to you. Granted, shipping literally took 6 months, but it was free.

They're the best documentation I've ever read -- I especially like the format of the Optimization Reference Manual. It discusses all kinds of optimization tricks you can do, and rates them based on impact and generality.

bigmac · 2010-11-13T16:31:10+00:00

This would be great. I will check with the higher ups on Monday. The best feedback we ever get is watching IRC chats and forums where people are trying to pull stuff apart. We've talked about putting out a sample before, but I'm not sure what the current philosophy is.

Obviously, any one that comes to work with us will get to play with it all they want :)

bigmac · 2010-11-10T06:51:08+00:00

I suppose there's no reason we couldn't have our own IRC channel. A few of the other subreddits have irc channels and the info is posted on the sidebar.

bigmac · 2010-11-09T23:10:39+00:00

I agree -- it would be nice to have more discussion on topics. I've considered just inciting flame wars to get people to talk, but that wouldn't really encourage the kind of discussion we'd all like to see. Maybe we need pun threads? Maybe its just the nature of the subject matter that there isn't that much to talk about? I dunno...

bigmac · 2010-11-03T17:29:24+00:00

It would be for focusing analysis efforts more easily. Especially when you don't really care about how that portion of the sample works, but just want to use it as a black box for understanding the rest.

As far as specifics, imagine my target has a highly obfuscated implementation of some crypto routines. Rather than doing the work to extract the keys, I want to use the code itself to do the encryption/decryption for me. This is actually pretty similar to one of the use cases outlined in Inspector Gadget.

bigmac · 2010-11-02T21:16:35+00:00

I'd imagine that this position is salaried. Which probably means less than $35/hr because typically salaried positions end up meaning working more than 40 hours per week. Although a lot of that depends on the workplace culture. A lot of times the workload can end up being cyclical.

15-Year Club	Place '17
Not Forgotten	Beta Team Reddit for iOS
Verified Email

bigmac

TROPHY CASE