Real-Life Story of the 1st Mainframe Container Breakout
Ian Coldwater and Chad Rikansrud unite container and mainframe hacking to achieve the world's first container escape on an IBM LinuxONE mainframe.
Summary
When Mainframe Architecture Meets Modern Containerization
IBM introduced containerized workloads (Docker/Kubernetes) to its enterprise s390x LinuxONE mainframe systems to modernize enterprise core banking applications.
Collaborative Exploitation Across Two Distinct Disciplines
Container security specialist Ian Coldwater and mainframe hacker Chad Rikansrud combine forces to audit container isolation on mainframe silicon.
Executing the First Mainframe Container Breakout
Exploiting Linux kernel capabilities, shared device nodes, and s390x hardware virtualization quirks, the team successfully escapes an unprivileged container, gaining root on the host mainframe.
Hardening Linux on z Systems
The authors present remediation steps for enterprise sysadmins running container workloads on IBM Z and LinuxONE architectures.
Related talks
Main Stage·36 min
Aviv Sasson
Aviv Sasson details discovering FabricEscape, a severe vulnerability in Microsoft Service Fabric allowing unprivileged containers to seize full cluster admin rights.
Main Stage·39 min
Eran Segal
Eran Segal investigates Windows container isolation (Process Isolation & Hyper-V), demonstrating novel container escape techniques via Silo IPC mechanisms.
Main Stage·44 min
Billy Jheng · Muhammad Ramdhan
Billy Jheng and Muhammad Ramdhan demonstrate multiple novel container escape vectors in Google Kubernetes Engine (GKE) to achieve host node takeover.