The COW: Container on Windows Who Escaped the Silo
Eran Segal investigates Windows container isolation (Process Isolation & Hyper-V), demonstrating novel container escape techniques via Silo IPC mechanisms.
Summary
The Foundations of Windows Container Sandboxing
Windows Containers use Server Silos and Job Objects for process-isolated containers and lightweight Hyper-V VMs for hardware-enforced isolation.
Analyzing Windows Kernel Silo Architecture
Eran Segal explores how the NT kernel isolates named objects, registry hives, and file system namespaces between silos and the host OS.
Discovering IPC and Driver Boundary Escapes
Segal demonstrates exploiting unconstrained driver communication handles and shared system memory mappings to break out of Windows container silos.
Securing Multi-Tenant Windows Cloud Workloads
The author provides guidance on hardening Windows container hosts, configuring Hyper-V isolation boundaries, and monitoring kernel telemetry.
Related talks
Main Stage·44 min
Billy Jheng · Muhammad Ramdhan
Billy Jheng and Muhammad Ramdhan demonstrate multiple novel container escape vectors in Google Kubernetes Engine (GKE) to achieve host node takeover.
Main Stage·36 min
Aviv Sasson
Aviv Sasson details discovering FabricEscape, a severe vulnerability in Microsoft Service Fabric allowing unprivileged containers to seize full cluster admin rights.
Main Stage·40 min
Michael Bargury
Michael Bargury explores enterprise domination through low-code shadow IT, abusing Microsoft Power Platform connectors and flows to exfiltrate corporate data.