Attackers as Instructors: Using Container Isolation to Reduce Risk and Understand Vulnerabilities
Attackers as Instructors: Using Container Isolation to Reduce Risk and Understand Vulnerabilities
复制标题
DOI：
10.1007/978-3-031-35504-2_9
复制
发表时间：
2023
影响因子：
3.7
通讯作者：
Yunsen Lei;Julian P. Lanson;Craig A. Shue;Timothy Wood
中科院分区：
文献类型：
--
作者：
Yunsen Lei;Julian P. Lanson;Craig A. Shue;Timothy Wood
为了实现规模经济，流行的互联网目的地同时为共享物理基础设施上的数百或数千用户提供服务。这种资源共享会导致滥用权限并影响其他用户的攻击。我们的工作使用容器化来创建“一次性服务器”，这些服务器会动态实例化并根据每个用户的权限进行定制。这可以隔离用户并消除攻击者的持续存在。此外，它还简化了分析，允许融合日志以帮助防御者定位与安全事件相关的漏洞。因此，我们减轻攻击并将其转换为调试跟踪以帮助修复。我们使用三个系统评估该方法，包括流行的 WordPress 内容管理系统。它消除了攻击者的持久性、传播和权限滥用。它具有较低的 CPU 和延迟成本，并且需要线性内存消耗，我们通过定制的页面合并技术来减少这种消耗。
To achieve economies of scale, popular Internet destinations concurrently serve hundreds or thousands of users on shared physical infrastructure. This resource sharing enables attacks that misuse permissions and affect other users. Our work uses containerization to create “single-use servers” which are dynamically instantiated and tailored for each user’s permissions. This isolates users and eliminates attacker persistence. Further, it simplifies analysis, allowing the fusion of logs to help defenders localize vulnerabilities associated with security incidents. We thus mitigate attacks and convert them into debugging traces to aid remediation. We evaluate the approach using three systems, including the popular WordPress content management system. It eliminates attacker persistence, propagation, and permission misuse. It has low CPU and latency costs and requires linear memory consumption, which we reduce with a customized page merging technique.