Testing Container Threat Detection

Beta

This feature is covered by the Pre-GA Offerings Terms of the Google Cloud Platform Terms of Service. Pre-GA features may have limited support, and changes to pre-GA features may not be compatible with other pre-GA versions. For more information, see the launch stage descriptions.

Verify that Container Threat Detection is working by intentionally triggering detectors and checking for findings. Container Threat Detection is a built-in service for the Security Command Center Premium tier. To view Container Threat Detection findings, it must be enabled in Security Command Center sources & services settings.

Before you begin

To detect potential threats to your containers, you need to make sure that your clusters are on a supported version of Google Kubernetes Engine (GKE). For more information see using a supported GKE version.

Added binary executed

To trigger an added binary executed finding, drop a binary in your container and execute it. This example deploys the latest Ubuntu 18.04 image, copies /bin/ls to another location, and then executes it. This is unexpected because the copy of the binary wasn't part of the original container image, even when that image is on Ubuntu 18.04, and containers are meant to be immutable.

1. Go to the Google Cloud Console.
   Go to the Google Cloud Console
2. Select the project that contains the container you want to use to test.
3. Click Activate Cloud Shell.

4. In Cloud Shell, set environment variables.

   1. Your service account email:

      export SERVICE_ACCOUNT_EMAIL=[e-mail]
      

   2. The zone your cluster is in:

      export ZONE=cluster-zone
      

   3. The project your container is in:

      export CONSUMER_PROJECT=project-name
      

   4. Your cluster name:

      export CLUSTER_NAME=cluster-name
      

5. Access the cluster control plan:

   gcloud container clusters get-credentials $CLUSTER_NAME \
    --zone $ZONE \
    --project $CONSUMER_PROJECT
   

6. Drop a binary and execute it:

   tag="dropped-binary-$(date +%Y-%m-%d-%H-%M-%S)"
   kubectl run --restart=Never --rm=true --wait=true -i \
   --image marketplace.gcr.io/google/ubuntu1804:latest \
   $tag -- bash -c "cp /bin/ls /tmp/$tag; /tmp/$tag"
   

This should create an added binary executed finding that you can view in Security Command Center, and in Cloud Logging if you've configured Logging for Container Threat Detection.

Added library loaded

To trigger an added library loaded finding, drop a library in your container and then load it. This example deploys the latest Ubuntu 18.04 image, copies /lib/x86_64-linux-gnu/libc.so.6 to another location, and then loads it using ld. This is unexpected because the copy of the library was not part of the original container image, even if that image is on Ubuntu 18.04, and containers are meant to be immutable.

1. Go to the Google Cloud Console.
   Go to the Google Cloud Console
2. Select the project that contains the container you want to use to test.
3. Click Activate Cloud Shell.

4. In Cloud Shell, set environment variables.

   1. Your service account email:

      export SERVICE_ACCOUNT_EMAIL=[e-mail]
      

   2. The zone your cluster is in:

      export ZONE=cluster-zone
      

   3. The project your container is in:

      export CONSUMER_PROJECT=project-name
      

   4. Your cluster name:

      export CLUSTER_NAME=cluster-name
      

5. Access the cluster control plan:

   gcloud container clusters get-credentials $CLUSTER_NAME \
    --zone $ZONE \
    --project $CONSUMER_PROJECT
   

6. Drop a library and use ld to load it:

   tag="dropped-library-$(date +%Y-%m-%d-%H-%M-%S)" \
   kubectl run --restart=Never --rm=true --wait=true -i \
   --image marketplace.gcr.io/google/ubuntu1804:latest \
   $tag -- bash -c "cp /lib/x86_64-linux-gnu/libc.so.6 /tmp/$tag; /lib64/ld-linux-x86-64.so.2 /tmp/$tag"
   

This should create an added library loaded finding that you can view in Security Command Center, and in Cloud Logging if you've configured Logging for Container Threat Detection.

• Some information may be missing from the process section of added library loaded findings due to a known bug.
• Resource name for regional clusters will not be properly displayed due to a known bug.

Reverse shell

To trigger a reverse shell finding, start a binary with stdin redirection to a TCP connected socket. This example starts /bin/echo with redirection to the Google public DNS 8.8.8.8 on the DNS port. Nothing is printed when you run this example. To prevent any external code injection through a man-in-the-middle (MITM) attack, this example doesn't use the /bin/bash binary.

1. Go to the Google Cloud Console.
   Go to the Google Cloud Console
2. Select the project that contains the container you want to use to test.
3. Click Activate Cloud Shell.

4. In Cloud Shell, set environment variables.

   1. Your service account email:

      export SERVICE_ACCOUNT_EMAIL=[e-mail]
      

   2. The zone your cluster is in:

      export ZONE=cluster-zone
      

   3. The project your container is in:

      export CONSUMER_PROJECT=project-name
      

   4. Your cluster name:

      export CLUSTER_NAME=cluster-name
      

5. Access the cluster control plan:

   gcloud container clusters get-credentials $CLUSTER_NAME \
    --zone $ZONE \
    --project $CONSUMER_PROJECT
   

6. Start a binary with /bin/echo redirection to the Google public DNS:

   tag="reverse-shell-$(date +%Y-%m-%d-%H-%M-%S)"
   kubectl run --restart=Never --rm=true --wait=true -i \
   --image marketplace.gcr.io/google/ubuntu1804:latest \
   $tag -- bash -c "/bin/echo >& /dev/tcp/8.8.8.8/53 0>&1"
   

This should create a reverse shell finding you can view in Security Command Center, and in Cloud Logging if you've configured Logging for Container Threat Detection.

What's next

• Learn how to use Container Threat Detection.