Most Docker container images have critical flaws

Developers must act appropriately to prevent further spread of malware

Over two million container images hosted on the Docker Hub repository harbor at least one critical vulnerability, according to new research. 

In an analysis carried out by cyber security firm Prevasio on four million image containers, over half (51%) contained at least one critical vulnerability.

The research also found incidents of container images carrying embedded malware. It found 6,432 malicious or potentially harmful containers, representing 0.16% of all publicly available images at Docker Hub.

“Our analysis of malicious containers also shows that quite a few images contain a dynamic payload. That is, an image in its original form does not have a malicious binary. However, at runtime, it might be scripted to download a source of a coin miner, to then compile and execute it,” said Sergei Shevchenko, CTO at Prevasio.

In its report, Prevasio said if a developer takes a shortcut by fetching a pre-built image instead of composing a new image from scratch, there’s a viable risk that such pre-built images might come with a Trojan installed. If such an image ends up in production, the attackers may potentially access such containerized applications remotely via a backdoor.

Mark Bower, senior vice president at Comforte AG, told IT Pro that platforms like Kubernetes enable immense application delivery power. However, the built-in security controls reflect classical data-at-rest and transport encryption, perimeter, and access control-based security. 

“While these controls are important, the last decade has seen leading enterprises and data processors shift towards data-centric over perimeter controls to combat advanced malware, ransomware and insider risk to sensitive data,” Bower said.

“Fundamentally, to thwart the variations of malware and attacks from misconfiguration or API exploitation, a data-centric approach is vital even with advanced container and app orchestration ecosystems to avoid data compromise or attacks that can create havoc for data-hungry enterprises depending on them.”

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), told IT Pro that when selecting an image from Docker Hub, a development team is implicitly stating that they trust the security practices of the author of that container image. 

“Such implicit trust is risky from a security perspective, which is why many organizations are now creating hardened container images where the image hardening process is managed by a dedicated team skilled in operating system hardening which is separate from the core development team.

"These hardened images are then pushed to an internal registry and policies are defined that only allow images originating from hardened images in that internal registry to execute in a production cluster,” Mackey said.

Featured Resources

Consumer choice and the payment experience

A software provider's guide to getting, growing, and keeping customers

Download now

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Download now

Business in the new economy landscape

How we coped with 2020 and looking ahead to a brighter 2021

Download now

How to increase cyber resilience within your organisation

Cyber resilience for dummies

Download now

Recommended

HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
Ransomware criminals look to other hackers to provide them with network access
ransomware

Ransomware criminals look to other hackers to provide them with network access

17 Jun 2021
FBI still frowns on ransomware payments
ransomware

FBI still frowns on ransomware payments

11 Jun 2021
Windows devices targeted by PuzzleMaker malware exploiting Chrome zero-day flaw
zero-day exploit

Windows devices targeted by PuzzleMaker malware exploiting Chrome zero-day flaw

9 Jun 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

16 Jun 2021
What is HTTP error 400 and how do you fix it?
Network & Internet

What is HTTP error 400 and how do you fix it?

16 Jun 2021
EU plans to launch bloc-wide cyber task force
cyber attacks

EU plans to launch bloc-wide cyber task force

22 Jun 2021