Aqua Security this week reported a new type of cyberattack that exploits Docker application programming interfaces (APIs) to build and run a malicious container image on the host.
Asaf Morag, lead data analyst for Aqua Security, says this approach enables cybercriminals to end-run static analysis tools that only discover malicious code prior to it being deployed in a runtime environment. Cybercriminals are essentially taking advantage of a host’s ability to spin up Docker containers in seconds to evade detection by static analysis tools, he says.
Previously, most container security research focused on container images before they are deployed. However, Morag notes it appears cybercriminals are now taking advantage of containers to launch attacks directly on the host.
