Overview
Explore the security implications of Windows process-isolated containers in this Black Hat conference talk. Delve into the foundations of cloud services, focusing on virtualization and container isolation. Examine how Windows isolates container processes and filesystems, and prevents containers from executing potentially harmful syscalls. Investigate the implementation of Ntoskrnl using server silos and job objects. Discover answers to critical questions about container isolation and potential attacker capabilities. Learn about past vulnerabilities, anti-system debugging techniques, UEFI, and NVM. Conclude with a demonstration and discussion of mitigation strategies for enhanced container security.
Syllabus
Introduction
Containers
User flag
Past vulnerabilities
Trivia
AntiSystem Debug
UEFI
NVM
Demo
Mitigation
Taught by
Black Hat