<story><title>Threat Actors Now Target Docker via Container Escape Features</title><url>https://www.trendmicro.com/en_us/research/21/b/threat-actors-now-target-docker-via-container-escape-features.html</url></story><parent_chain></parent_chain><comment><author>jamescun</author><text>It may be quipped that Docker or Kubernetes is remote code execution (RCE) as a service!&lt;p&gt;The vulnerability pointed out here is server operators who have exposed Docker&amp;#x27;s API to the public internet, allowing anyone to run a container. The use of a privileged container is just icing on the cake, and probably not nessecary for a cryptominer.&lt;p&gt;A more subtle and interesting attack vector is genuine container imags that become compromised, much like any other package manager, particularly ones that search for the Docker API on the host&amp;#x27;s internal IP address, hoping only public network access is firewalled.</text></comment>
<story><title>Threat Actors Now Target Docker via Container Escape Features</title><url>https://www.trendmicro.com/en_us/research/21/b/threat-actors-now-target-docker-via-container-escape-features.html</url></story><parent_chain></parent_chain><comment><author>terom</author><text>This looks like the attacker is just using a publicly exposed Docker API honeypot to run a new Docker container with `privileged: true`. I don&amp;#x27;t see why that&amp;#x27;s particularly interesting given that they could just bind-mount the host &amp;#x2F; filesystem with `pid: host` and do pretty much whatever they want?&lt;p&gt;It would be much more interesting to see a remote-code-execution attack against some vulnerable service deploying a container escape payload to escalate privileges from the Docker container to the host.</text></comment>