Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Challenge of Persistence in Containers and Serverless

Summary: Unit 42 lays out how containers and serverless functions frustrate attacker persistence: containers typically live from a few hours to a couple of days and are relaunched on every image change, while serverless functions run for seconds and the AWS Lambda runtime lasts about 15 minutes untriggered. Attackers can still hook persistent storage, volumes, bind mounts or databases, exploit misconfigurations like excessive capabilities or exposed credentials, or escape via kernel, runtime or orchestrator flaws such as CVE-2019-5736, and Unit 42 researcher Yuval Avrahami showed persistence between Lambda invocations by keeping a function warm.

Bottom line: The ephemeral design that makes containers and serverless easier to clean up is the same property an attacker must defeat to keep a foothold, so the real question is whether your runtime defenses and audits would catch a backdoor planted in a volume, a bind mount or a warm Lambda instance before the next relaunch erases the evidence.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Vulnerabilities & Patching
Related